[Bug java/20704] New: CNI code is called/loaded without any security checks

[Bug java/20704] New: CNI code is called/loaded without any security checks

[mark at gcc dot gnu dot org]

Classes using native CNI methods are loaded without any extra security checks.
When a class uses native JNI methods it needs to make sure the appropriate
library  containing the JNI functions are loaded. Which means that at a certain
point the call chain must have had a RuntimePermission("loadLibrary") because
Runtime.loadLibrary() has to be called. For classes using CNI native methods no
such requirement is needed which means that "CNI native code" can be called
through such classes without a security check for the RuntimePermission being done.

A "solution" could be to have the static initializer of such classes using CNI
native code make a security check themselves for RuntimePermission("loadLibrary").
This does mean we need some way to simulate the "trusted" way of calling
Runtime.loadLibrary() through a PrivilegedAction (which means the class itself
needs to have the RuntimePermission, but the rest of the call chain doesn't).

-- 
           Summary: CNI code is called/loaded without any security checks
           Product: gcc
           Version: 4.0.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: java
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: mark at gcc dot gnu dot org
                CC: gcc-bugs at gcc dot gnu dot org,java-prs at gcc dot gnu
                    dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=20704

[Bug libgcj/20704] CNI code is called/loaded without any security checks

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-03-31 17:30 -------
Confirmed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
          Component|java                        |libgcj
     Ever Confirmed|                            |1
   Last reconfirmed|0000-00-00 00:00:00         |2005-03-31 17:30:04
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=20704