5.5 The RMISecurityManager Class

package java.rmi;

public class RMISecurityManager extends java.lang.SecurityManager {

	public RMISecurityManager();

	public synchronized void checkAccess(Thread t)
		throws RMISecurityException;

	public synchronized void checkAccess(ThreadGroup g)
		throws RMISecurityException;

	public synchronized void checkPackageAccess(String pkg)
		throws RMISecurityException;

	public synchronized void checkPackageDefinition(String pkg)
		throws RMISecurityException;
}

The RMISecurityManager can be used when the application does not require specialized security functions but does need the protection it provides. This simple security manger disables all functions except class definition and access, so that other classes for remote objects, their arguments, and returns can be loaded as needed. A downloaded class is allowed to make a connection if the connection was initiated via the RMI transport.

If no security manager has been set, stubs and classes can only be loaded from the local classpath. This ensures that some security manager is responsible for the actions of stubs and classes loaded from remote locations as part of any remote method invocation. A security manager is set using System.setSecurityManager.