This article about Java security says:
Code in the Java library consults the Security Manager whenever a dangerous operation is about to be attempted.
It will only consult the SecurityManager if the code says so. It won't do it for every single operation.
For example in Runtime.exit
, you see that the SecurityManager is consulted:
public void exit(int status) {
SecurityManager security = System.getSecurityManager();
if (security != null) {
security.checkExit(status);
}
Shutdown.exit(status);
}
Similarly, in File
, you will see that most methods consult the SecurityManager. Example:
public boolean canWrite() {
SecurityManager security = System.getSecurityManager();
if (security != null) {
security.checkWrite(path);
}
return fs.checkAccess(this, FileSystem.ACCESS_WRITE);
}
If you are writing a method which might be "dangerous" then you should also consult the SecurityManager.