Java sandbox. Using SecurityManager to redirect I/O access -

currently i'm trying write sandbox running untrusted java code. idea isolate java application accessing file system or network sockets. solution have @ moment rewritten securitymanager, forbids access io or network.

now want not forbid, redirect calls file system, i.e. if application wants write "/home/user/application.txt" path file should replaced "/temp/trusted_folder/application.txt". want allow applications access file system in particular folder , redirect other calls folder.

so here method class fileoutputstream, sm asked, whether there permission write given path.

 public fileoutputstream(file file, boolean append)     throws filenotfoundexception {     string name = (file != null ? file.getpath() : null);     securitymanager security = system.getsecuritymanager();     if (security != null) {         security.checkwrite(name);     }     if (name == null) {         throw new nullpointerexception();     }     fd = new filedescriptor();     fd.incrementandgetusecount();     this.append = append;     if (append) {         openappend(name);     } else {         open(name);     } } 

obviously, sm not have access fileoutputstream , can not change inner variables in method (like name or file) or somehow affect execution order, except throwing securityexception. understand, accessing inner fields violation of object oriented principles, understand, local variable visible , exist inside method, declared.

so question is: there ways allow security manager replace calls file system? if not, there other approaches can use in order this?

i hope clear enough.

the securitymanager cannot that, can yes or no.

i can think of 2 options:

1. do on os level file system. there things chroot jails. transparent application, requires work outside of java.

2. provide api application opens fileoutputstream them. api layer gets decide files from, , privileged (in security manager terms) open files anywhere. of course, requires sandboxed application uses api instead of java.io.file directly. more flexible, , @ point necessary application aware of sandbox , use sandbox api, on java webstart for example.