Is there an easy way to investigate if AccessController.doPrivileged() is really needed?

Question

I have this code that attaches a JavaServer to the RMIRegistry, which is done in a PrivilegedAction

        //start javaengineserver
        AccessController.doPrivileged(new PrivilegedAction() 
        {
            public Object run() 
            {
                try
                {
                    startServer(port, getSession());
                } catch (RmiException e) 
                {
                    e.printStackTrace();
                    AWTSwingErrorDialog.show(e, "Error while attaching JavaEngineServer to rmiregistry.exe");
                }
                return null;
            }
        });

I found some other Questions about the doPrivileged method, and they all say that there are some comands that need the extra permissions like getting Environment Variables.

So i looked threw the code behind the startServer(port, session) method and i haven't found anything that looks like it needs extra permissions, but is there a way to confirm that, other than Test all the usages and functionality by hand?

Thank you.

Answer 1

I don't think there is a (reliable) easy way. There is an unreliable way though: temporarily replace that code with something that just calls startServer, and try running it in a security sandbox.

I suspect that the doPrivileged call is needed though. A method with that name and a port parameter is likely to try to create / bind / listen on a ServerSocket. The latter will fail if the SecurityManager.checkListen method does not allow the operation ... which it won't do in a typical sandbox. (We don't normally want untrusted code to be able to start stealth network services ...)