Managing access to OSGI bundles

Question

How can i control access to my bundles. I have a set of bundles that expose packages through export in MANIFEST.MF. Packages exposed are supposed to be used only within my set of bundles. No other external bundles should be allowed to use these packages using "import package".

Is there any way i can impose these restrictions?

Answer 1

You can take a look at OSGi Security (2.Security Layer OSGi Core Spec) to manage restrictions to various resources (bundles, packages, services etc.).

In your case you can set PackagePermission with IMPORT/EXPORT actions to your bundles. The other bundles will not have any permissions to import your packages.

Answer 2

First, is it a problem that someone else imports your package? Unless you're exporting implementations that no one should see (in which case you should reconsider your partitioning anyway), there is usually no problem in having some packages lying around that others may or may not import.

If you're sure you need to hide certain packages, there are no easy ways to do so. Some things that come to mind are

• use a ResolverHook to restrict the visibility of your packages (only available from 4.3),
• run your bundles in an embedded framework, and only expose the packages you want to share from that framework to the host.

However, both of these are pretty heavy-handed methods, and I would stay away from them unless you're e.g. building your own application server.