Sign all plugins (their jar file), to avoi

Project:JNode Core
Component:Miscellaneous
Category:feature request
Priority:normal
Assigned:Unassigned
Status:active
Description

Sign all plugins (their jar file), to avoid malicious code from entering the system.

Package Sealing

Submitted by monochromata on Tue, 04/19/2005 - 12:18.

Maybe packages defined by plugin JARs should also be sealed in addition to being signed.

Sebastian

Good idea

Submitted by admin on Tue, 04/19/2005 - 13:40.

I think that is a good idea (sealing is not yet implemented in JNode, but that can change).
However, we should discuss if this would have any negative sideeffects.

Ewout

Negative sideeffects

Submitted by monochromata on Tue, 04/19/2005 - 14:42.

Yes, I also don't know the implications when using multiple custom classloaders. Maybe it is neccessary to limit package sealing to child classloaders. E.g. only throw a SecurityException when an attempt is made to load classes that are part of the sealed package using the classloader that loaded the sealed package, or one of its child classloaders.

More thought may go into this topic when this issue is processed.

Sebastian