NetPermission

NetPermission

Security permission for network operations in JNode.

Overview

NetPermission is JNode's permission class for controlling network operation access. It extends Java's java.security.BasicPermission and is used by the security manager to gate privileged network operations such as DHCP configuration and BOOTP client initialization.

Key Components

File	Purpose
net/src/net/org/jnode/net/NetPermission.java	The permission class itself
net/src/net/org/jnode/net/ipv4/dhcp/DHCPClient.java	Uses NetPermission("dhcpClient")
net/src/net/org/jnode/net/ipv4/bootp/BOOTPClient.java	Uses NetPermission("bootpClient")

How It Works

NetPermission extends BasicPermission which means it supports single-name matching (no wildcards). The class is straightforward:

public class NetPermission extends BasicPermission {
    public NetPermission(String name) {
        super(name);
    }

    public NetPermission(String name, String actions) {
        super(name, actions);
    }
}

Permission Checking Flow

When a network operation requires authorization:

1. The code retrieves the current SecurityManager via System.getSecurityManager()
2. If a security manager exists, sm.checkPermission(new NetPermission(targetName)) is called
3. The security manager traverses the protection domain permissions and checks if any imply the requested permission
4. If denied, a SecurityException is thrown; otherwise the operation proceeds

Usage Examples

DHCP Client (DHCPClient.java:64-70):

public final void configureDevice(final Device device) throws IOException {
    this.device = device;

    final SecurityManager sm = System.getSecurityManager();
    if (sm != null) {
        sm.checkPermission(new NetPermission("dhcpClient"));
    }
    // ... privileged configuration operations
}

BOOTP Client (BOOTPClient.java:55-59):

public void configureDevice(Device device) throws IOException {
    final SecurityManager sm = System.getSecurityManager();
    if (sm != null) {
        sm.checkPermission(new NetPermission("bootpClient"));
    }
    // ... BOOTP configuration
}

Known Permission Names

Name	Authorized Operation
dhcpClient	DHCP-based network configuration
bootpClient	BOOTP-based network configuration

Gotchas

• No actions parameter: NetPermission extends BasicPermission which only supports a name; the actions string is ignored in permission checking. This is consistent with other BasicPermission subclasses like SocketPermission.
• Security manager optional: Code defensively checks for null security manager before calling checkPermission.
• Static permission names: Permission names are hardcoded strings in the source; there's no central registry of valid names.
• Plugin classloader isolation: Permissions are checked against the protection domain of the calling code, so plugin classloader boundaries affect what permissions are available.