Securing your applications - OSGi in Action - page 445

To grant a specific PackagePermission , you need to supply the name and actions
parameters for its constructor; these parameters are described in table 14.2.

Table 14.2 PackagePermission constructor parameters

Parameter Description

String name Name of the package or packages to which this permission applies

String
actions

Comma-delimited list of the actions granted by the permission
( export , import , or exportonly )

For convenience, you can use * or a trailing .* as a wildcard to target several packages
with a single permission. For the actions, import gives a bundle permission to import
the named packages, export gives a bundle permission to export and import the pack-
age, and exportonly does as its name implies. You may wonder why export also gives
permission to import the named packages. It's to support bundles' ability to import
packages they export (that is, substitutable exports), as described in section 5.1.1.
To get an idea of how PackagePermission works, let's take a conceptual look at how
the framework uses it. Assume you have a bundle with the following imports and
exports:

Import-Package: org.foo, org.bar
Export-Package: org.bar
When the framework resolves this bundle, it checks to see whether the bundle has the
following permissions granted to it:
■ PackagePermission.IMPORT permission for the org.foo package
■ PackagePermission.IMPORT permission for the org.bar package
■ PackagePermission.EXPORT permission for the org.bar package
For these checks to succeed, you'd have to grant the necessary permissions, such as

new PackagePermission("org.foo", PackagePermission.IMPORT);
new PackagePermission("org.bar", PackagePermission.EXPORT);
Notice that you don't need to grant the bundle permission to import org.bar ,
because it's implied by the export action.
That's the basics for PackagePermission ; let's move on to the next OSG i permission.

14.3.2 BundlePermission

Similar to PackagePermission , BundlePermission is a module-layer permission for
controlling bundle and fragment dependencies. To grant a BundlePermission , you
need to construct it with the parameters shown in table 14.3.
As with PackagePermission , you can use * or a trailing .* as a wildcard to target sev-
eral packages with a single permission. To control bundle dependencies, the provide
action gives a bundle permission to be required by bundles matching the supplied
symbolic name, whereas require gives it permission to require matching bundles.