src/share/classes/java/lang/ClassLoader.java

*** 1401,1411 ****
          if (parent == null)
              return null;
          SecurityManager sm = System.getSecurityManager();
          if (sm != null) {
              ClassLoader ccl = getCallerClassLoader();
!             if (ccl != null && !isAncestor(ccl)) {
                  sm.checkPermission(SecurityConstants.GET_CLASSLOADER_PERMISSION);
              }
          }
          return parent;
      }
--- 1401,1411 ----
          if (parent == null)
              return null;
          SecurityManager sm = System.getSecurityManager();
          if (sm != null) {
              ClassLoader ccl = getCallerClassLoader();
!             if (needsClassLoaderPermissionCheck(ccl, this)) {
                  sm.checkPermission(SecurityConstants.GET_CLASSLOADER_PERMISSION);
              }
          }
          return parent;
      }
*** 1471,1481 ****
              return null;
          }
          SecurityManager sm = System.getSecurityManager();
          if (sm != null) {
              ClassLoader ccl = getCallerClassLoader();
!             if (ccl != null && ccl != scl && !scl.isAncestor(ccl)) {
                  sm.checkPermission(SecurityConstants.GET_CLASSLOADER_PERMISSION);
              }
          }
          return scl;
      }
--- 1471,1481 ----
              return null;
          }
          SecurityManager sm = System.getSecurityManager();
          if (sm != null) {
              ClassLoader ccl = getCallerClassLoader();
!             if (needsClassLoaderPermissionCheck(ccl, scl)) {
                  sm.checkPermission(SecurityConstants.GET_CLASSLOADER_PERMISSION);
              }
          }
          return scl;
      }
*** 1521,1530 ****
--- 1521,1547 ----
              }
          } while (acl != null);
          return false;
      }
  
+     // Tests if class loader access requires "getClassLoader" permission
+     // check.  A class loader 'from' can access class loader 'to' if
+     // class loader 'from' is same as class loader 'to' or an ancestor
+     // of 'to'.  The class loader in a system domain can access
+     // any class loader.
+     static boolean needsClassLoaderPermissionCheck(ClassLoader from,
+                                                    ClassLoader to)
+     {
+         if (from == to)
+             return false;
+ 
+         if (from == null)
+             return false;
+ 
+         return !to.isAncestor(from);
+     }
+ 
      // Returns the invoker's class loader, or null if none.
      // NOTE: This must always be invoked when there is exactly one intervening
      // frame from the core libraries on the stack between this method's
      // invocation and the desired invoker.
      static ClassLoader getCallerClassLoader() {