This is the interface for MBean manipulation on the agent
side. It contains the methods necessary for the creation,
registration, and deletion of MBeans as well as the access methods
for registered MBeans. This is the core component of the JMX
infrastructure.
User code does not usually implement this interface. Instead,
an object that implements this interface is obtained with one of
the methods in the MBeanServerFactory
class.
Every MBean which is added to the MBean server becomes
manageable: its attributes and operations become remotely
accessible through the connectors/adaptors connected to that MBean
server. A Java object cannot be registered in the MBean server
unless it is a JMX compliant MBean.
Assuming that there is a security manager, or that the
implementation chooses to make checks anyway, the checks are made
as detailed below. In what follows, className
is the
string returned by MBeanInfo.getClassName()
for the target
MBean.
For the invoke
method, the caller's
permissions must imply MBeanPermission(className, operationName, name, "invoke")
.
For the getAttribute
method, the
caller's permissions must imply MBeanPermission(className, attribute, name, "getAttribute")
.
For the getAttributes
method, the
caller's permissions must imply MBeanPermission(className, null, name, "getAttribute")
.
Additionally, for each attribute a in the AttributeList
, if the caller's permissions do not imply MBeanPermission(className, a, name, "getAttribute")
, the
MBean server will behave as if that attribute had not been in the
supplied list.
For the setAttribute
method, the
caller's permissions must imply MBeanPermission(className, attrName, name, "setAttribute")
, where
attrName
is attribute.getName()
.
For the setAttributes
method, the
caller's permissions must imply MBeanPermission(className, null, name, "setAttribute")
.
Additionally, for each attribute a in the AttributeList
, if the caller's permissions do not imply MBeanPermission(className, a, name, "setAttribute")
, the
MBean server will behave as if that attribute had not been in the
supplied list.
For the addNotificationListener
methods,
the caller's permissions must imply MBeanPermission(className, null, name,
"addNotificationListener")
.
For the removeNotificationListener
methods,
the caller's permissions must imply MBeanPermission(className, null, name,
"removeNotificationListener")
.
For the getMBeanInfo
method, the
caller's permissions must imply MBeanPermission(className, null, name, "getMBeanInfo")
.
For the getObjectInstance
method,
the caller's permissions must imply MBeanPermission(className, null, name, "getObjectInstance")
.
For the isInstanceOf
method, the
caller's permissions must imply MBeanPermission(className, null, name, "isInstanceOf")
.
For the queryMBeans
method, the
caller's permissions must imply MBeanPermission(null, null, name, "queryMBeans")
.
Additionally, for each MBean that matches name
,
if the caller's permissions do not imply MBeanPermission(className, null, name, "queryMBeans")
, the
MBean server will behave as if that MBean did not exist.
Certain query elements perform operations on the MBean server.
If the caller does not have the required permissions for a given
MBean, that MBean will not be included in the result of the query.
The standard query elements that are affected are Query.attr(String)
, Query.attr(String,String)
, and Query.classattr()
.
For the queryNames
method, the checks
are the same as for queryMBeans
except that
"queryNames"
is used instead of
"queryMBeans"
in the MBeanPermission
objects. Note that a "queryMBeans"
permission implies
the corresponding "queryNames"
permission.
For the getDomains
method, the caller's
permissions must imply MBeanPermission(null, null, name, "getDomains")
. Additionally,
for each domain d in the returned array, if the caller's
permissions do not imply MBeanPermission(null, null, new ObjectName("d:x=x"),
"getDomains")
, the domain is eliminated from the array. Here,
x=x
is any key=value pair, needed to
satisfy ObjectName's constructor but not otherwise relevant.
For the getClassLoader
method, the
caller's permissions must imply MBeanPermission(className, null, loaderName,
"getClassLoader")
.
For the getClassLoaderFor
method,
the caller's permissions must imply MBeanPermission(className, null, mbeanName,
"getClassLoaderFor")
.
For the getClassLoaderRepository
method, the caller's permissions must
imply MBeanPermission(null, null, null, "getClassLoaderRepository")
.
For the deprecated deserialize
methods, the
required permissions are the same as for the methods that replace
them.
For the instantiate
methods, the caller's
permissions must imply MBeanPermission(className, null, null, "instantiate")
.
For the registerMBean
method, the
caller's permissions must imply MBeanPermission(className, null, name, "registerMBean")
. Here
className
is the string returned by MBeanInfo.getClassName()
for an object of this class.
If the MBeanPermission
check succeeds, the MBean's
class is validated by checking that its ProtectionDomain
implies MBeanTrustPermission("register")
.
Finally, if the name
argument is null, another
MBeanPermission
check is made using the
ObjectName
returned by MBeanRegistration.preRegister
.
For the createMBean
methods, the caller's
permissions must imply the permissions needed by the equivalent
instantiate
followed by
registerMBean
.
For the unregisterMBean
method,
the caller's permissions must imply MBeanPermission(className, null, name, "unregisterMBean")
.