Hi Roman, On Wed, 2006-04-19 at 21:33 +0200, Roman Kennke wrote: > In Toolkit.getDefaultToolkit() we need to use the system classloader. > Otherwise the toolkit must be on the bootclasspath in order to be > loadable. Using the system classloader it is sufficient to have it in
Since getting access to a ClassLoader is a privileged operation and
getDefaultToolkit() can be called from unprivileged code this needs to
be wrapped in a PrivilegedAction. Same for access to the system property
(this was already wrong here). Fixed as follows:
2006-04-20 Mark Wielaard <[EMAIL PROTECTED]>
* java/awt/Toolkit.java (getDefaultToolkit): Get classloader in
PrivilegedAction. Access awt.toolkit through SystemProperties.
There are a couple more cleanups needed in our awt code to make it work
properly when an SecurityManager is installed (a lot of places call
getSystemEventQueue() which is also privileged). A good way to test this
is running netx. The nice thing is that these operations actually fail,
which means out security framework is doing its job :) The hard part is
figuring out when it is appropriate to bypass the security manager in
the core code.
Committed,
Mark
Index: java/awt/Toolkit.java
===================================================================
RCS file: /cvsroot/classpath/classpath/java/awt/Toolkit.java,v
retrieving revision 1.39
diff -u -r1.39 Toolkit.java
--- java/awt/Toolkit.java 19 Apr 2006 19:32:26 -0000 1.39
+++ java/awt/Toolkit.java 20 Apr 2006 19:57:07 -0000
@@ -1,5 +1,5 @@
/* Toolkit.java -- AWT Toolkit superclass
- Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004, 2005
+ Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006
Free Software Foundation, Inc.
This file is part of GNU Classpath.
@@ -531,11 +531,19 @@
{
if (toolkit != null)
return toolkit;
- String toolkit_name = System.getProperty("awt.toolkit",
- default_toolkit_name);
+ String toolkit_name = SystemProperties.getProperty("awt.toolkit",
+ default_toolkit_name);
try
{
- ClassLoader cl = ClassLoader.getSystemClassLoader();
+ ClassLoader cl;
+ cl = (ClassLoader) AccessController.doPrivileged
+ (new PrivilegedAction()
+ {
+ public Object run()
+ {
+ return ClassLoader.getSystemClassLoader();
+ }
+ });
Class cls = cl.loadClass(toolkit_name);
Object obj = cls.newInstance();
if (!(obj instanceof Toolkit))
signature.asc
Description: This is a digitally signed message part
