Understanding AccessController.doPrivileged
<p>I am going through this API, excerpt from javadoc <a href="https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html#privileged_code" rel="nofollow">https://docs.oracle.com/javase/8/docs/technotes/guides/security/doprivileged.html#privileged_code</a></p>

<blockquote>
  <p>"When the AccessController.checkPermission method is invoked by the
  most recent caller, the basic algorithm for deciding whether to allow
  or deny the requested access is as follows:</p>
  
  <ol>
  <li>If the code for any caller in the call chain does not have the requested permission, then an AccessControlException is thrown</li>
  <li>Unless the following is true: a caller whose code is granted the said permission has been marked as privileged, and all parties
  subsequently called by this caller (directly or indirectly) have the
  said permission."</li>
  </ol>
</blockquote>

<p>As per my understanding from the above doc, </p>

<blockquote>
  <p>Lets say frameA (having XYZ ) <strong>->calls</strong> frameB ( inherits the XYZ
  permission) <strong>->calls</strong> frameC (inherits the permission XYZ). Because
  the SecurityManager is common for the main thread </p>
  
  <p>So if the frameB wants to execute a code that needs permission ABC
  then the policy should be  changed to grant that permission . But when
  i  wrap the code in AccessController.doPrivileged it is not throwing
  SecurtyException. </p>
  
  <p>So i am confused why it is behaving like this, is this because the
  wrapped code  is automatically given "All Permission" ? If so, point2
  above is contradicting this because it says <strong>" a caller whose code is
  granted the said permission has been marked as privileged"</strong></p>
</blockquote>

<p>Following is what i am trying to test :</p>

<pre><code>import java.security.*;

public class TestingDoPrivileged {

    static SecurityPermission XYZ = new SecurityPermission("xyz");
    static SecurityPermission ABC = new SecurityPermission("abc");
    static SecurityPermission SET_POLICY = new SecurityPermission("setPolicy");

    public static void main(String[] args) {
        setDummySecurityManager();
        frameA();
    }

    private static void frameA() {
        //set the permission XYZ
        setPolicy(XYZ,SET_POLICY);

        //Here the code/resource frameA  has access to XYZ permission
        //Now call frameB which needs ABC permission for the code to execute.
        frameB();

    }
    private static void frameB() {
        //this will pass as this code has the permission XYZ because the policy is set in frameA with XYZ permission
        System.getSecurityManager().checkPermission(XYZ);
        try {
            // this will fail as this code does not have permission for abc
            System.getSecurityManager().checkPermission(ABC);
        } catch (AccessControlException e) {
            System.out.println("passed");
            //pass
        }
        //As the caller of frameB which is frameA has the permission to XYZ only, the following code should fail,
        // right? But it is passing.
        AccessController.doPrivileged((PrivilegedAction) () -&gt; {
            frameC();
            return null;
        });
    }
    private static void frameC() {
        System.getSecurityManager().checkPermission(ABC);
    }

    private static void setDummySecurityManager() {
        setPolicy(SET_POLICY);
        SecurityManager sm = new SecurityManager();
        System.setSecurityManager(sm);
    }
    private static void setPolicy(Permission... perms) {
        Policy.setPolicy(new Policy() {
            @Override
            public PermissionCollection getPermissions(CodeSource codesource) {
                PermissionCollection pc = new Permissions();
                for (Permission pm : perms)
                    pc.add(pm);
                return pc;
            }
        });
    }
}
</code></pre>