MaxCompute用户指南：MapReduce：Java沙箱

MaxCompute MapReduce 及 UDF 程序在分布式环境中运行时，受到 Java 沙箱的限制（MapReduce 作业的主程序则不受此限制），具体限制如下：

• 
  不允许直接访问本地文件，只能通过 MaxCompute MapReduce/Graph 提供的接口间接访问。
  读取 -resources 选项指定的资源，包括文件、Jar 包和资源表等。
• 
  通过 System.out 和 System.err 输出日志信息，可以通过 MaxCompute 客户端的 Log 命令查看日志信息。

不允许直接访问分布式文件系统，只能通过 MaxCompute MapReduce/Graph 访问到表的记录。
不允许 JNI 调用限制。
不允许创建 Java 线程，不允许启动子进程执行 Linux 命令。
不允许访问网络，包括获取本地 IP 地址等，都会被禁止。
Java 反射限制：suppressAccessChecks 权限被禁止，无法 setAccessible 某个 private 的属性或方法，以达到读取 private 属性或调用 private 方法的目的。
具体的说，在代码中，直接使用下面这些方法会报 access denied 异常。
访问本地文件的相关方法，如下所示：
java.io.File:

1.       public boolean delete()
2.       public void deleteOnExit()
3.       public boolean exists()
4.       public boolean canRead()
5.       public boolean isFile()
6.       public boolean isDirectory()
7.       public boolean isHidden()
8.       public long lastModified()
9.       public long length()
10.       public String[] list()
11.       public String[] list(FilenameFilter filter)
12.       public File[] listFiles()
13.       public File[] listFiles(FilenameFilter filter)
14.       public File[] listFiles(FileFilter filter)
15.       public boolean canWrite()
16.       public boolean createNewFile()
17.       public static File createTempFile(String prefix, String suffix)
18.       public static File createTempFile(String prefix,  String suffix,File directory)
19.       public boolean mkdir()
20.       public boolean mkdirs()
21.       public boolean renameTo(File dest)
22.       public boolean setLastModified(long time)
23.       public boolean setReadOnly()

java.io.RandomAccessFile:

1.       RandomAccessFile(String name, String mode)
2.       RandomAccessFile(File file, String mode)

java.io.FileInputStream:

1.       FileInputStream(FileDescriptor fdObj)
2.       FileInputStream(String name)
3.       FileInputStream(File file)

java.io.FileOutputStream:

1.       FileOutputStream(FileDescriptor fdObj)
2.       FileOutputStream(File file)
3.       FileOutputStream(String name)
4.       FileOutputStream(String name, boolean append)

java.lang.Class:

1.     public ProtectionDomain getProtectionDomain()

java.lang.ClassLoader:

1.     ClassLoader()
2.     ClassLoader(ClassLoader parent)

java.lang.Runtime:

1.     public Process exec(String command)
2.     public Process exec(String command, String envp[])
3.     public Process exec(String cmdarray[])
4.     public Process exec(String cmdarray[], String envp[])
6.     public void exit(int status)
7.     public static void runFinalizersOnExit(boolean value)
9.     public void addShutdownHook(Thread hook)
10.     public boolean removeShutdownHook(Thread hook)
12.     public void load(String lib)
13.     public void loadLibrary(String lib)

java.lang.System:

1.     public static void exit(int status)
2.     public static void runFinalizersOnExit(boolean value)
4.     public static void load(String filename)
5.     public static void loadLibrary( String libname)
7.     public static Properties getProperties()
8.     public static void setProperties(Properties props)
9.     public static String getProperty(String key) // 只允许部分key可以访问
10.     public static String getProperty(String key, String def) // 只允许部分key可以访问
11.     public static String setProperty(String key, String value)
13.     public static void setIn(InputStream in)
14.     public static void setOut(PrintStream out)
15.     public static void setErr(PrintStream err)
17.     public static synchronized void setSecurityManager(SecurityManager s)

System.getProperty 允许的 key 列表，如下所示：

1.     java.version
2.     java.vendor
3.     java.vendor.url
4.     java.class.version
5.     os.name
6.     os.version
7.     os.arch
8.     file.separator
9.     path.separator
10.     line.separator
12.     java.specification.version
13.     java.specification.vendor
14.     java.specification.name
16.     java.vm.specification.version
17.     java.vm.specification.vendor
18.     java.vm.specification.name
19.     java.vm.version
20.     java.vm.vendor
21.     java.vm.name
22.     file.encoding
23.     user.timezone

java.lang.Thread:

1.     Thread()
2.     Thread(Runnable target)
3.     Thread(String name)
4.     Thread(Runnable target, String name)
5.     Thread(ThreadGroup group, ...)
7.     public final void checkAccess()
8.     public void interrupt()
9.     public final void suspend()
10.     public final void resume()
11.     public final void setPriority (int newPriority)
12.     public final void setName(String name)
13.     public final void setDaemon(boolean on)
14.     public final void stop()
15.     public final synchronized void stop(Throwable obj)
17.     public static int enumerate(Thread tarray[])
18.     public void setContextClassLoader(ClassLoader cl)

java.lang.ThreadGroup:

1.     ThreadGroup(String name)
2.     ThreadGroup(ThreadGroup parent, String name)
4.     public final void checkAccess()
5.     public int enumerate(Thread list[])
6.     public int enumerate(Thread list[], boolean recurse)
7.     public int enumerate(ThreadGroup list[])
8.     public int enumerate(ThreadGroup list[], boolean recurse)
9.     public final ThreadGroup getParent()
10.     public final void setDaemon(boolean daemon)
11.     public final void setMaxPriority(int pri)
12.     public final void suspend()
13.     public final void resume()
14.     public final void destroy()
16.     public final void interrupt()
17.     public final void stop()

java.lang.reflect.AccessibleObject:

1.     public static void setAccessible(...)
2.     public void setAccessible(...)

java.net.InetAddress:

1.     public String getHostName()
2.     public static InetAddress[] getAllByName(String host)
3.     public static InetAddress getLocalHost()

java.net.DatagramSocket:

1.     public InetAddress getLocalAddress()

java.net.Socket:

1.     Socket(...)

java.net.ServerSocket:

1.     ServerSocket(...)
2.     public Socket accept()
3.     protected final void implAccept(Socket s)
4.     public static synchronized void setSocketFactory(...)
5.     public static synchronized void setSocketImplFactory(...)

java.net.DatagramSocket:

1.     DatagramSocket(...)
2.     public synchronized void receive(DatagramPacket p)

java.net.MulticastSocket:

1.     MulticastSocket(...)

java.net.URL:

1.     URL(...)
2.     public static synchronized void setURLStreamHandlerFactory(...)
3.     java.net.URLConnection
4.     public static synchronized void setContentHandlerFactory(...)
5.     public static void setFileNameMap(FileNameMap map)

java.net.HttpURLConnection:

1.     public static void setFollowRedirects(boolean set)
2.     java.net.URLClassLoader
3.     URLClassLoader(...)

java.security.AccessControlContext:

1.     public AccessControlContext(AccessControlContext acc, DomainCombiner combiner)
2.     public DomainCombiner getDomainCombiner()