如何限制Java应用程序的读写权限

Question

Currently I am creating a playground for a programming language (pl). The code entered in the playground is remotly executed on a server.

The pl runs in the Java VM and is executed in a docker container. Since you can read and write to files in the pl I need to take away these permissions from the Java application that executes the code.

I am executing the Java app like this:

java -cp path/to/app.jar "app.package.main" -x "place code here"

How can I remove the read and write permissions from a Java application?

Answer 1

You need to provide a custom Security Manager configuration as a parameter:

java -Djava.security.manager

BUT: this does not mean the program will work, because if something is forbidden an

AccessControlException

is thrown and the program will crash, or at least (most likely) behave differently.

See this tutorial: https://docs.oracle.com/javase/tutorial/security/tour2/step2.html

The better solution is probably to get the code and alter it to fit your needs (only if the licensing allows this of course).