Attempts to lift the security restriction on the underlying channel.
This requires the administer privilege on the server.

@throws SecurityException If we fail to upgrade the connection.
338317
public void upgrade() {
        ByteArrayOutputStream out = new ByteArrayOutputStream();
        if (execute(Arrays.asList("groovy", "="),
                new ByteArrayInputStream(
                        "hudson.remoting.Channel.current().setRestricted(false)"
                                .getBytes(defaultCharset())),
                out, out) != 0) {
            throw new SecurityException(out.toString()); // failed to upgrade
        }
    }
811682
private void requestAuthorization(HttpServletResponse resp) throws IOException {

        // Authorisation is required for the requested action.
        resp.setHeader(CmsRequestUtil.HEADER_WWW_AUTHENTICATE, "Basic realm=\"" + BASIC_REALM + "\"");

        resp.sendError(HttpServletResponse.SC_UNAUTHORIZED);
    }
376350
private static void checkPermission() {
        SecurityManager security = System.getSecurityManager();
        if (security != null)
            security.checkPermission(modifyThreadPermission);
    }
1102866
@Override
    public void update(IPermission perm) throws AuthorizationException {

        Connection conn = null;
        try {
            conn = RDBMServices.getConnection();
            String sQuery = getUpdatePermissionSql();
            if (log.isDebugEnabled()) log.debug("RDBMPermissionImpl.update(): " + sQuery);
            PreparedStatement ps = conn.prepareStatement(sQuery);
            try {
                primUpdate(perm, ps);
            } finally {
                ps.close();
            }
        } catch (Exception ex) {
            log.error("Exception updating permission [" + perm + "]", ex);
            throw new AuthorizationException("Problem updating Permission " + perm);
        } finally {
            RDBMServices.releaseConnection(conn);
        }
    }
616343
@Override
    public synchronized void processAuthorize(WebSocketChannel channel, String authorizeToken) {
        nextHandler.processAuthorize(channel, authorizeToken); 
    }
95454
public void setSecurityHandler(SecurityHandler securityHandler) {
        handler.setSecurityEnabled(securityHandler != null);
        handler.setSecurityHandler(securityHandler);
    }
1081291
private void checkSuperUser() throws AccessControlException {
    // collects user and groups
    String user = AuthenticatedClientUser.getClientUser(ServerConfiguration.global());
    List<String> groups = getGroups(user);
    if (!isPrivilegedUser(user, groups)) {
      throw new AccessControlException(ExceptionMessage.PERMISSION_DENIED
          .getMessage(user + " is not a super user or in super group"));
    }
  }
906819
public void run() {
    originalSecurityManager = System.getSecurityManager();
    System.setSecurityManager(new NGSecurityManager(originalSecurityManager));

    if (!(System.in instanceof ThreadLocalInputStream)) {
      System.setIn(new ThreadLocalInputStream(in));
    }
    if (!(System.out instanceof ThreadLocalPrintStream)) {
      System.setOut(new ThreadLocalPrintStream(out));
    }
    if (!(System.err instanceof ThreadLocalPrintStream)) {
      System.setErr(new ThreadLocalPrintStream(err));
    }

    try {
      if (listeningAddress.isInetAddress()) {
        if (listeningAddress.getInetAddress() == null) {
          serversocket = new ServerSocket(listeningAddress.getInetPort());
        } else {
          serversocket =
              new ServerSocket(
                  listeningAddress.getInetPort(), 0, listeningAddress.getInetAddress());
        }
      } else {
        if (Platform.isWindows()) {
          boolean requireStrictLength = true;
          serversocket =
              new NGWin32NamedPipeServerSocket(
                  listeningAddress.getLocalAddress(), requireStrictLength);
        } else {
          serversocket = new NGUnixDomainServerSocket(listeningAddress.getLocalAddress());
        }
      }

      String portDescription;
      if (listeningAddress.isInetAddress() && listeningAddress.getInetPort() == 0) {
        // if the port is 0, it will be automatically determined.
        // add this little wait so the ServerSocket can fully
        // initialize and we can see what port it chose.
        int runningPort = getPort();
        while (runningPort == 0) {
          try {
            Thread.sleep(50);
          } catch (Throwable toIgnore) {
          }
          runningPort = getPort();
        }
        portDescription = ", port " + runningPort;
      } else {
        portDescription = "";
      }

      // at this moment server is capable to accept connections
      running.set(true);

      // Only after this point nailgun server is ready to accept connections on all platforms.
      // test_ng.py on *nix relies on reading this line from stdout to start connecting to server.
      out.println(
          "NGServer "
              + NGConstants.VERSION
              + " started on "
              + listeningAddress.toString()
              + portDescription
              + ".");

      while (!shutdown.get()) {
        // this call blocks until a new connection is available, or socket is closed and
        // IOException is thrown
        Socket socket = serversocket.accept();

        // get a session and run nail on it
        // the session is responsible to return itself to the pool
        // TBD: should we reconsider this?
        sessionPool.take().run(socket);
      }
    } catch (IOException ex) {
      // If shutdown is called while the accept() method is blocking, it wil throw IOException
      // Do not propagate it if we are in shutdown mode
      if (!shutdown.get()) {
        throw new RuntimeException(ex);
      }
    }

    // close all idle sessions and wait for all running sessions to complete
    try {
      sessionPool.shutdown();
    } catch (Throwable ex) {
      // we are going to die anyways so let's just continue
      LOG.log(Level.WARNING, "Exception shutting down Nailgun server", ex);
    }

    // restore system streams
    System.setIn(in);
    System.setOut(out);
    System.setErr(err);

    System.setSecurityManager(originalSecurityManager);

    running.set(false);
  }
593760
private void throwAuthzException() throws SecurityException {
        SubjectManager subjectManager = new SubjectManager();
        String name = "UNAUTHENTICATED";
        if (subjectManager.getInvocationSubject() != null) {
            name = subjectManager.getInvocationSubject().getPrincipals().iterator().next().getName();
        }
        Tr.audit(tc, "MANAGEMENT_SECURITY_AUTHZ_FAILED", name, "MBeanAccess", requiredRoles);
        String message = Tr.formatMessage(tc, "MANAGEMENT_SECURITY_AUTHZ_FAILED", name, "MBeanAccess", requiredRoles);
        throw new SecurityException(message);
    }
492919
public void updateClientCookies(Boolean clientCookies) throws SecurityException {
	checkWriteAccess();
	boolean hasAccess = ConfigWebUtil.hasAccess(config, SecurityManager.TYPE_SETTING);
	if (!hasAccess) throw new SecurityException("no access to update scope setting");

	Element scope = _getRootElement("scope");
	scope.setAttribute("setclientcookies", Caster.toString(clientCookies, ""));
    }
1063123
public void init() throws Exception {
    // configure the SSLContext with a TrustManager
    SSLContext ctx = SSLContext.getInstance("TLS");
    if (ignoreCertificates) {
      ctx.init(new KeyManager[0],
          new TrustManager[] { new DefaultTrustManager() }, new SecureRandom());
      SSLContext.setDefault(ctx);
    }
    HostnameVerifier hv = new IgnoreHostName();
    HttpsURLConnection.setDefaultHostnameVerifier(hv);
  }
1345133
private function updateClientAccessToken()
    {
        $user = $this->securityContext->getToken()->getUser();
        $this->client->updateAccessToken($user->getAccessToken());
    }
1052839
@Process(actionType = ModifySaslSecurity.class)
    public void modifySaslSecurity(final ModifySaslSecurity action, final Dispatcher.Channel channel) {

        final List<Property> connectors = getModelsFor(action.getConnectorAddress());
        Outcome<FunctionContext> outcome = new Outcome<FunctionContext>() {
            @Override
            public void onFailure(FunctionContext context) {
                channel.nack(context.getError());
            }

            @Override
            public void onSuccess(FunctionContext context) {
                lastModifiedInstance = action.getConnectorName();
                read(action.getConnectorAddress().getResourceType(), connectors, channel);
            }
        };

        // It's not guaranteed that the security singleton already exists. If the parent connector
        // was created by the console, it does exists. However if the parent connector was created using
        // the CLI we need to create the security singleton before we try to modify it.
        AddressTemplate securityAddress = action.getConnectorAddress().append("security=" + SASL_SINGLETON);
        new Async<FunctionContext>(new Progress.Nop()).waterfall(new FunctionContext(), outcome,
                new VerifySaslSingleton(dispatcher, statementContext, action.getConnectorName(), securityAddress),
                new CreateSaslSingleton(dispatcher, statementContext, action.getConnectorName(), securityAddress) {
                    @Override
                    public void execute(Control<FunctionContext> control) {
                        int status = control.getContext().pop();
                        if (status == 200) {
                            control.proceed();
                        } else {
                            super.execute(control);
                        }
                    }
                },
                new ModifySaslSingleton(dispatcher, statementContext, action.getConnectorName(), securityAddress,
                        action.getChangedValues()));
    }
762815
public void updateLocale(String locale) throws SecurityException {
	checkWriteAccess();
	boolean hasAccess = ConfigWebUtil.hasAccess(config, SecurityManager.TYPE_SETTING);
	if (!hasAccess) throw new SecurityException("no access to update regional setting");

	Element scope = _getRootElement("regional");
	scope.setAttribute("locale", locale.trim());
    }
639022
@Override
    public void update(IPermission[] perms) throws AuthorizationException {
        if (perms.length > 0) {
            try {
                primUpdate(perms);
            } catch (Exception ex) {
                log.error("Exception updating permissions " + Arrays.toString(perms), ex);
                throw new AuthorizationException(ex);
            }
        }
    }
8010
SecurityException getException(String argument) {
        SecurityException exception =  new SecurityException("Access denied to " + argument);
        Class[] classStack = getClassContext();
        secureAccess.getBreachHandler().handleBreach(exception, classStack);
        return exception;
    }
1209907
public void updateSessionType(String type) throws SecurityException {
	checkWriteAccess();
	boolean hasAccess = ConfigWebUtil.hasAccess(config, SecurityManager.TYPE_SETTING);
	if (!hasAccess) throw new SecurityException("no access to update scope setting");

	type = type.toLowerCase().trim();

	Element scope = _getRootElement("scope");
	scope.setAttribute("session-type", type);
    }