java.policy

// Java Security Policy for Student Code Execution
// This policy restricts what student code can do

grant {
    // Allow basic I/O operations (System.out, System.in)
    permission java.lang.RuntimePermission "writeFileDescriptor";
    permission java.lang.RuntimePermission "readFileDescriptor";

    // Allow reading system properties that are safe
    permission java.util.PropertyPermission "line.separator", "read";
    permission java.util.PropertyPermission "java.version", "read";
    permission java.util.PropertyPermission "java.vendor", "read";
    permission java.util.PropertyPermission "os.name", "read";
    permission java.util.PropertyPermission "file.separator", "read";
    permission java.util.PropertyPermission "path.separator", "read";

    // Allow program to exit (needed for normal termination)
    permission java.lang.RuntimePermission "exitVM";

    // DENY everything else by default:
    // - NO file system access (java.io.FilePermission)
    // - NO network access (java.net.SocketPermission)
    // - NO process execution (java.lang.RuntimePermission "exec")
    // - NO reflection (java.lang.reflect.ReflectPermission)
    // - NO native code (java.lang.RuntimePermission "loadLibrary")
    // - NO security manager changes (java.lang.RuntimePermission "setSecurityManager")
};