[concurrency-interest] ThreadPoolExecutor.shutdown() and permission

David Holmes dholmes at dltech.com.au
Wed Oct 19 11:35:46 EDT 2005


> In ThreadPoolExecutor.shutdown(), if i have correctly understand the
> documentation, the code first checks if permission "modifyThread"
> is granted and then for each worker threads checks checkAccess.
> Why in order to check permission "modifyThread",
> you use AccessController.checkPermission() and not
> securityManager.checkPermission() ?

Only AccessController.checkPermission guarantees that you actually check if
you have the permission. This class can't be modified by the application.

The SecurityManager.checkAccess could do anything it wants even ignoring the
installed security policy.

So to perform shutdown() you have to have the global modifyThread
permission, and for each worker thread the SecurityManager's checkAccess
must succeed.

David Holmes

More information about the Concurrency-interest mailing list