How to stop application code access to JBoss system/server c

[krishc]

Hi,

Does JBoss server have any feature through which application code "will not" get access to JBoss system/server classes (any security sensitive classes) ? As I understand, any application user can walk their way to JBoss internal classes through classloading heirarchy or use reflection to achieve the same ?

Thanks,
Krish

[starksm64]

Run with a security manager so that the security sensitive code permission checks can be enforced.

[krishc]

Thanks for your reply.

1. So we can stop an Appication user from loading a Jboss system/sensitive class through Loader.loadClass(..),Class.forName(..), Foo.class etc once we turn on security manager ?

2. I am guessing this will be done with java2.policy only and no changes to the loader heirarchy ?

Krish