为什么java安全管理器不禁止创建新的Thread（）或启动它？ [英] why java security manager doesn't forbid neither creating new Thread() nor starting it?
问题描述
您是否碰巧知道为什么java安全管理器不禁止创建新线程或启动它们？新的FileWriter在安全管理器下，但新的Thread（）和threadInstance.start（）都不是更安全的安全管理器，并且可以调用。
do you happen to know explanation why java security manager doesn't forbid creating new threads or starting them? new FileWriter is under security manager, but neither new Thread(), nor threadInstance.start() isn't uneder security manager, and are possible to call.
- 禁止它会不会有用吗？
- 难以实现吗？
- 或创建并启动新线程禁止它是不是很相关？
推荐答案
在此处执行了访问检查线程构造函数，以查看调用者是否有权更改将添加新线程的ThreadGroup。这就是您如何实施安全策略以禁止创建新线程。
There is an access check performed in the Thread constructor to see if the caller has permission to change the ThreadGroup that the new thread would be added to. That is how you would implement a security policy to forbid creation of new threads.
（还有一个关于创建ThreadGroups的检查......检查你是否有权将新组添加到其父组。）
(And there is another check on the creation of ThreadGroups ... that checks if you have permission to add the new group to its parent.)
所以回答你的问题：
为什么java安全管理器不禁止创建新线程（）也没有启动它？
Why java security manager doesn't forbid neither creating new Thread() nor starting it?
原因是你的JVM当前的安全策略允许父线程修改它的线程组。您应该能够修改该策略设置以防止这种情况发生，从而阻止创建子线程。
The reason is that your JVM's current security policy allows the parent thread to modify its ThreadGroup. You should be able to modify that policy setting to prevent that, and hence prevent creation of child threads.
对于它是否有用禁止吗？
Wouldn't it be useful to forbid it?
确实如此。允许不受信任的代码创建/启动线程是不明智的，因为：1）线程一旦启动就无法安全地被杀死，2）创建/启动大量线程可能会使JVM（可能是操作系统）陷入困境。
It is. It is unwise to allow untrusted code to create / start threads because: 1) threads once started cannot be safely killed, and 2) creating / starting lots of threads can bring the JVM (and maybe the OS) to its knees.
是否难以实施？
Would it be hard to implement?
来自您的观点，只需更改政策。
From your perspective, just change the policy.
这篇关于为什么java安全管理器不禁止创建新的Thread（）或启动它？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
