# HG changeset patch
# User Doug Simon <doug.simon@oracle.com>
# Date 1433163751 -7200
# Node ID 6d9c8d0d0f7ca6379ad6a1f3adcc7db8afa399e3
# Parent  b311a60991da7c771b22a068ece86d01375e4149
added SecurityManager checks and field/method reflection hiding (JBS:GRAAL-51)

diff -r b311a60991da -r 6d9c8d0d0f7c graal/com.oracle.jvmci.service/src/com/oracle/jvmci/service/Services.java
--- a/graal/com.oracle.jvmci.service/src/com/oracle/jvmci/service/Services.java	Mon Jun 01 15:01:34 2015 +0200
+++ b/graal/com.oracle.jvmci.service/src/com/oracle/jvmci/service/Services.java	Mon Jun 01 15:02:31 2015 +0200
@@ -43,11 +43,17 @@
 
     /**
      * Gets an {@link Iterable} of the implementations available for a given service.
+     *
+     * @throws SecurityException if a security manager is present and it denies
+     *             <tt>{@link RuntimePermission}("jvmciServices")</tt>
      */
     @SuppressWarnings("unchecked")
     @CallerSensitive
     public static <S> Iterable<S> load(Class<S> service) {
-        // TODO(ds): add SecurityManager checks
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new RuntimePermission("jvmciServices"));
+        }
         if (Service.class.isAssignableFrom(service)) {
             try {
                 return (Iterable<S>) cache.get(service);
@@ -68,11 +74,16 @@
      * @param service the service whose implementation is being requested
      * @param required specifies if an {@link InternalError} should be thrown if no implementation
      *            of {@code service} is available
+     * @throws SecurityException if a security manager is present and it denies
+     *             <tt>{@link RuntimePermission}("jvmciServices")</tt>
      */
     @SuppressWarnings("unchecked")
     @CallerSensitive
     public static <S> S loadSingle(Class<S> service, boolean required) {
-        // TODO(ds): add SecurityManager checks
+        SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(new RuntimePermission("jvmciServices"));
+        }
         Iterable<S> impls = null;
         if (Service.class.isAssignableFrom(service)) {
             try {
@@ -106,5 +117,10 @@
         return singleImpl;
     }
 
+    static {
+        Reflection.registerMethodsToFilter(Services.class, "getServiceImpls");
+        Reflection.registerFieldsToFilter(Services.class, "cache");
+    }
+
     private static native <S> S[] getServiceImpls(Class<?> service);
 }