Enforcing security rules at runtime
Various arrangements for implementing a security policy at runtime are presented. A plurality of calls in a syntax tree may be identified. Each call of the plurality of calls may be substituted with a corresponding security-modified call to create a plurality of security-modified methods calls. Each security-modified call may be linked with a security class. Following modification of each call of the plurality of calls, the plurality of security-modified calls may be compiled into bytecode.
1. A method for implementing a security policy at runtime, the method comprising:
identifying, by a computer system, a plurality of calls;
modifying, by the computer system, each call of the plurality of calls with a corresponding security-modified call to create a plurality of security-modified calls, wherein each security-modified call is linked with a security class that causes the plurality of security-modified calls to be compared to a security policy at a time of execution; and
following modification of each call of the plurality of calls, compiling, by the computer system, the plurality of security-modified calls.
2. The method for implementing the security policy at runtime of claim 1 , the method further comprising:
executing, by the computer system, bytecode, wherein compiling the plurality of security-modified calls results in creation of the bytecode.
3. The method for implementing the security policy at runtime of claim 2 , wherein executing the bytecode comprises:
executing a security-modified method of the plurality of security-modified calls;
checking for permission for a call corresponding to the security-modified method using the security policy; and
based on a result of checking for permission for the call corresponding to the security-modified method, executing the call corresponding to the security-modified method, wherein the result indicates executing the call corresponding to the security-modified method is permissible.
4. The method for implementing the security policy at runtime of claim 2 , wherein executing the bytecode comprises:
executing a security-modified method of the plurality of security-modified calls;
checking for permission for a call corresponding to the security-modified method using the security policy; and
based on a result of checking for permission for the call corresponding to the security-modified method, blocking execution of the call corresponding to the security-modified method, wherein the result indicates executing the call corresponding to the security-modified method is impermissible.
5. The method for implementing the security policy at runtime of claim 1 , further comprising:
receiving, by the computer system, uncompiled code from a second computer system; and
creating, by the computer system, a syntax tree based on the uncompiled code received from the second computer system, wherein the plurality of calls are identified from the syntax tree.
6. The method for implementing the security policy at runtime of claim 5 , further comprising:
executing, by the computer system, bytecode, wherein compiling the plurality of security-modified calls results in creation of the bytecode.
7. The method for implementing the security policy at runtime of claim 1 , wherein:
identifying the plurality of calls comprises identifying the plurality of calls from a syntax tree;
modifying each call of the plurality of calls comprises modifying each call of the plurality of calls in the syntax tree with the corresponding security-modified call; and
compiling the plurality of security-modified calls comprises compiling the syntax tree.
8. The method for implementing the security policy at runtime of claim 7 , further comprising:
prior to modifying each call of the plurality of calls, analyzing the syntax tree for impermissible constructors.
9. The method for implementing the security policy at runtime of claim 7 , wherein uncompiled code is in a programming language that permits editing of the syntax tree.
10. The method for implementing the security policy at runtime of claim 9 , wherein the programming language is GROOVY.
11. A computer program product residing on a non-transitor processor-readable medium for implementing a security policy at runtime, the computer program product comprising computer-readable instructions configured to cause a computer to:
identify a plurality of calls;
modify each call of the plurality of calls with a corresponding security-modified call to create a plurality of security-modified calls, wherein each security-modified call is linked with a security class that causes the plurality of security-modified calls to be compared to a security policy at a time of execution; and
following modification of each call of the plurality of calls, compile the plurality of security-modified calls.
12. The computer program product of claim 11 , wherein the computer program product further comprises computer-readable instructions configured to cause the computer to:
execute bytecode, wherein compiling the plurality of security-modified calls results in creation of the bytecode.
13. The computer program product of claim 12 , wherein the computer-readable instructions configured to cause the computer to execute the bytecode comprises computer-readable instructions to cause the computer to:
execute a security-modified method of the plurality of security-modified calls;
check for permission for a call corresponding to the security-modified method using the security policy; and
based on a result of checking for permission for the call corresponding to the security-modified method, execute the call corresponding to the security-modified method, wherein the result indicates executing the call corresponding to the security-modified method is permissible.
14. The computer program product of claim 12 , wherein the computer-readable instructions configured to cause the computer to execute the bytecode comprises computer-readable instructions to cause the computer to:
execute a security-modified method of the plurality of security-modified calls;
check for permission for a call corresponding to the security-modified method using the security policy; and
based on a result of checking for permission for the call corresponding to the security-modified method, block execution of the call corresponding to the security-modified method, wherein the result indicates executing the call corresponding to the security-modified method is impermissible.
15. The computer program product of claim 11 , wherein the computer program product further comprises computer-readable instructions configured to cause the computer to:
receive uncompiled code from a second computer system; and
create a syntax tree based on the uncompiled code received from the second computer system, wherein the plurality of calls are identified from the syntax tree.
16. The computer program product of claim 15 , wherein the computer program product further comprises computer-readable instructions configured to cause the computer to:
execute bytecode, wherein compiling the plurality of security-modified calls results in creation of the bytecode.
17. The computer program product of claim 11 , wherein:
the computer-readable instructions configured to cause the computer to identify the plurality of calls comprises computer-readable instructions configured to cause the computer to identify the plurality of calls from a syntax tree;
the computer-readable instructions configured to cause the computer to modify each call of the plurality of calls comprises computer-readable instructions configured to cause the computer to modify each call of the plurality of calls in the syntax tree with the corresponding security-modified call; and
the computer-readable instructions configured to cause the computer to compile the plurality of security-modified calls comprises computer-readable instructions configured to cause the computer to compile the syntax tree.
18. The computer program product of claim 17 , wherein the computer program product further comprises computer-readable instructions configured to cause the computer to:
prior to modifying each call of the plurality of calls, analyze the syntax tree for impermissible constructors.
19. The computer program product of claim 17 , wherein uncompiled code is in the GROOVY programming language.
20. A system for implementing a security policy at runtime, the system comprising:
a computer system, comprising:
a processor; and
a memory communicatively coupled with and readable by the processor and having stored therein processor-readable instructions which, when executed by the processor, cause the processor to:
identify a plurality of calls;
modify each call of the plurality of calls with a corresponding security-modified call to create a plurality of security-modified calls, wherein each security-modified call is linked with a security class that causes the plurality of security-modified calls to be compared to a security policy at a time of execution; and
following modification of each call of the plurality of calls, compile the plurality of security-modified calls.