Also, I have to confirm you are launching eclipse with security enabled

-Djava.security.manager -Djava.security.policy=${workspace_loc}\test.permisiuni_osgi.main\all.policy

When you use PackagePermission how are you using it?

pluginB = Activator.getDefault().getBundle().getBundleContext().installBundle(bLocationString);			

// add deny permissions
ConditionalPermissionInfo info = permissionAdmin.newConditionalPermissionInfo(
	bundle.getLocation() + "_2",
	new ConditionInfo[]{
		new ConditionInfo(BundleLocationCondition.class.getName(), new String[] {bundle.getLocation()})
	}
	, new PermissionInfo[]{			
			new PermissionInfo(PackagePermission.class.getName(), "p2", "import")				
	}, 
	ConditionalPermissionInfo.DENY
);

pluginB.start();

... But it is much more fine grain ...

Yes indeed, I use the Require Bundle.

So if I understand correctly, my only option is to deny the use of "Require bundle" and to force the third party plugins use the "import package" statements. This way, if the plugin uses "illegal" packages, it is stopped from the beginning (i.e. during the plugin startup). So there is no way to make equinox control the package access during runtime (i.e. during class instantiation).

Is this understanding correct?

If yes, another thought crosses my mind: using a custom classloader for the plugin, that checks for permissions during "findClass()" calls.

Thank you.
Best regards,
Cristian.

So if I understand correctly, my only option is to deny the use of "Require bundle" and to force the third party plugins use the "import package" statements. This way, if the plugin uses "illegal" packages, it is stopped from the beginning (i.e. during the plugin startup). So there is no way to make equinox control the package access during runtime (i.e. during class instantiation).

Thanks for the tip.

I understand that my first statement is also correct, right? I.e., besides modifying the class loader (or using a hook), I can block the access to a class only by doing this:

Quote:

So if I understand correctly, my only option is to deny the use of "Require bundle" and to force the third party plugins use the "import package" statements. This way, if the plugin uses "illegal" packages, it is stopped from the beginning (i.e. during the plugin startup). So there is no way to make equinox control the package access during runtime (i.e. during class instantiation).

Best regards,
Cristian.