Update Java security policy at runtime?

问题:

Is there a legal way to add/remove permissions to Java security policy at runtime?

回答1:

Javadoc says that Policy.refresh() for file-based policy would re-read the file. Thus, it is possible to modify system-wide policy at runtime by editing policy file and then calling Policy.refresh()

回答2:

From 1.4 dynamic ProtectionDomains can delegate to the Policy. Dynamically removing permissions from code is unlikely to make any sense. The two argument forms of AccessController.doPrivileged might also be useful.

回答3:

It is possible to set custom Policy implementation, using Policy.setPolicy() method. For example see JAAS in Action book.