如何在Java中阻止读写和连接操作

Question

We are building online grader, a system which accepts some java code, runs it, gets results and verify that results are correct.

Obviously, running untrusted code is unsafe, so we need to make sure code submitter does not break/compromise whole grader system.

For example such sumbitter could read passwords and modify grading entry in database. Or even worse, it could fill out the whole file system, RAM or consume all threads and prevent grading for other submitters.

Is there any API that allows me to block read write and connect operation.

Answer 1

使用内置的安全管理器功能。

Answer 2

SecurityManager solved this issues.

class MySecurityManager extends SecurityManager {
@Override
public void checkRead(FileDescriptor fd) {
    throw new SecurityException("File reading is not allowed");
}

@Override
public void checkWrite(FileDescriptor fd) {
    throw new SecurityException("File writing is not allowed");
}

@Override
public void checkConnect(String host, int port) {
    throw new SecurityException("Socket connections are not allowed");
  }
 }