Listing 1

import java.security.*;

public class TestProperty {
    public static void main(String[] args) throws Exception {
        System.setSecurityManager(new MySecurityManager());      
        System.out.println(System.getProperty("user.home"));
    }
}

public class MySecurityManager extends SecurityManager {
    public void checkPropertyAccess(String key) {
        String[] allowed = getAllowedProperties();
        for (int i = 0; i < allowed.length; i++) {
            if (key.equals(allowed[i])) {
                return;
            }
        }
        throw new SecurityException("Not allowed!");
    }

    private String[] getAllowedProperties() {
        return new String[] {"user.home", "user.dir"};
    }
}


Listing 2

public class MySecurityManager extends SecurityManager {
    public void checkPropertyAccess(String key) {
        String[] allowed = getAllowedProperties();
        for (int i = 0; i < allowed.length; i++) {
            if (key.equals(allowed[i])) {
                return;
            }
        }
        super.checkPropertyAccess(key);
    }
    // This method is supposed to return different things
    // at different times
    private String[] getAllowedProperties() {
        return new String[] {"user.home", "user.dir"};
    }
}


Listing 3

import java.security.*;
import java.util.*;

public class TestPolicy extends Policy {
    private static CodeSource appCodeSource;
    private static PermissionCollection permissions;
    private static Permissions allPermissions;

    // assume that TestPolicy and the application are from the same code source static {
        appCodeSource = TestPolicy.class.getProtectionDomain().getCodeSource();
        permissions = new MyPermissionCollection();
        allPermissions = new Permissions();
        allPermissions.add(new AllPermission());
    }

    static class MyPermissionCollection extends PermissionCollection {
        public void add(Permission permission) {
        }

        public boolean implies(Permission permission) {
            if (permission instanceof PropertyPermission) {
                return getAllowedPropertyPermissions().implies(permission);
            }
            // we allow all other permissions
            return true;
        }

        public Enumeration elements() {
            return new Enumeration() {
                public boolean hasMoreElements() {
                    return false;
                }

                public Object nextElement() {
                    return null;
                }
            };
        }

        // This method is supposed to return dynamic results
        private Permissions getAllowedPropertyPermissions() {
            Permissions perms = new Permissions();
            perms.add(new PropertyPermission("user.dir", "read"));
            perms.add(new PropertyPermission("user.home", "read"));
            return perms;
        }
    };
      
    public PermissionCollection getPermissions(CodeSource codesource) {
        if (appCodeSource.equals(codesource)) {
            return permissions;
        }
        return allPermissions;
    }

    public boolean implies(ProtectionDomain domain, Permission permission) {
        return getPermissions(domain.getCodeSource()).implies(permission);
    }

    public PermissionCollection getPermissions(ProtectionDomain domain) {
        return getPermissions(domain.getCodeSource());
    }

    public void refresh() {
    }

    public static void main(String[] args) throws Exception {
        Policy.setPolicy(new TestPolicy());
        System.setSecurityManager(new SecurityManager());
        System.out.println(System.getProperty("user.home"));
    }
}