Skip to main content

Network system access

Simple Story

Three layers watch the telephone: one reads the compiled answer before any call, one stands inside the room, and one sits beneath it.

They see different things, which is why all three exist. In Postcompile the one beneath the room never runs.

For the fields an exercise author writes, see Network system access in the instructor guide. This page is about how the domain is enforced.

Model​

NetworkPermission, one record per host and port, with separate connect, send and receive flags.

Validation and normalisation​

Host and port are validated separately. A wildcard host is accepted by the model but is almost never what an exercise means.

What it generates​

Architecture, aspect-oriented programming (AOP) and Phobos test cases. The Phobos path produces the network section of SpecificExercise.cfg.

Static enforcement​

Matched against network-access-methods.txt. In every domain, a policy with no network allowance produces a static deny-all rule that fires before any runtime mechanism is consulted.

Runtime enforcement​

JavaInstrumentationAdviceNetworkSystemToolbox inside the Java Virtual Machine (JVM). Outside it, the Phobos LD_PRELOAD firewall (libnetblocker.so) applies the same allow-list to the whole process, including anything the JVM shells out to.

Where the code lives​

  • policy/policySubComponents/NetworkPermission.java
  • aop/java/instrumentation/advice/JavaInstrumentationAdviceNetworkSystemToolbox.java
  • templates/phobos/phobos-network.sh and the NETBLOCKER_CONF contract

Known gaps​

Ares writes the Phobos section but only enforces it when the Phobos wrapper runs the build. In Postcompile Ares generates the Phobos cases and never dispatches them.

A test fixture that opens a socket inside the sandboxed JVM is itself subject to the policy, so network tests must use an external echo server. See Testing conventions.