SecurityManager with custom thread groups

[David Nemeskey]

Hi,

I would like to have an architecture where certain threads (and threads created by them) cannot access other threads and thread groups outside their own. More specifically, if I have thread A in thread group AG, the thread should be able to create thread groups A1G, A2G... if those are children of AG. It should also be able to create threads in them. However, it should not be able to access any other thread groups.

I figured I would create a CustomThreadGroup class for AG, and use a SecurityManager to check permissions. The overwritten checkaccess method looks like this:

public void checkAccess(ThreadGroup g) {
  ThreadGroup currGroup = Thread.currentThread().getThreadGroup();
  if (currGroup instanceof CustomThreadGroup) {
    if (getCustomAncestor(g) != getCustomAncestor(currGroup)) {
      throw new SecurityException("Trying to access unrelated group.");
    }
  }
}

, where getCustomAncestor returns the uppermost CustomThreadGroup in the thread group tree (or null).

The problem with this is, that in getCustomAncestor, I have to call the getParent() method of the thread group. This, however, results in another checkAccess() call, and that in another getCustomAncestor, resulting in a StackOverflowError.

My question would be:
How to prevent the recursivity? I thought about creating a thread in the SecurityManager (private Thread class), that can access both groups, but isn't it an overkill to such a problem? Isn't there a simpler (API) way?

Thanks,
David
[ June 15, 2008: Message edited by: David Nemeskey ]