make the restricted flag modifiable. This allows restricted channel to be...

make the restricted flag modifiable. This allows restricted channel to be "upgraded" to unrestricted channel.

remoting/src/main/java/hudson/remoting/Channel.java

@@ -114,7 +114,7 @@ public class Channel implements VirtualChannel, IChannel {
      * and error reports.
      */
     private final String name;
-    /*package*/ final boolean isRestricted;
+    private volatile boolean isRestricted;
     /*package*/ final ExecutorService executor;
 
     /**
@@ -774,6 +774,17 @@ public class Channel implements VirtualChannel, IChannel {
         return inClosed!=null;
     }
 
+    /**
+     * Returns true if this channel is currently does not load classes from the remote peer.
+     */
+    public boolean isRestricted() {
+        return isRestricted;
+    }
+
+    public void setRestricted(boolean b) {
+        isRestricted = b;
+    }
+
     /**
      * Waits for this {@link Channel} to be closed down, but only up the given milliseconds.
      *

remoting/src/main/java/hudson/remoting/RemoteClassLoader.java

@@ -45,7 +45,7 @@ import java.util.HashSet;
  * Loads class files from the other peer through {@link Channel}.
  *
  * <p>
- * If the {@linkplain Channel#isRestricted channel is restricted}, this classloader will be
+ * If the {@linkplain Channel#isRestricted() channel is restricted}, this classloader will be
  * created by will not attempt to load anything from the remote classloader. The reason we
  * create such a useless instance is so that when such classloader is sent back to the remote side again,
  * the remoting system can re-discover what {@link ClassLoader} this was tied to.
@@ -103,7 +103,7 @@ final class RemoteClassLoader extends URLClassLoader {
             // first attempt to load from locally fetched jars
             return super.findClass(name);
         } catch (ClassNotFoundException e) {
-            if(channel.isRestricted)
+            if(channel.isRestricted())
                 throw e;
             // delegate to remote
             if (channel.remoteCapability.supportsMultiClassLoaderRPC()) {
@@ -170,7 +170,7 @@ final class RemoteClassLoader extends URLClassLoader {
     public URL findResource(String name) {
         // first attempt to load from locally fetched jars
         URL url = super.findResource(name);
-        if(url!=null || channel.isRestricted)   return url;
+        if(url!=null || channel.isRestricted())   return url;
 
         try {
             if(resourceMap.containsKey(name)) {
@@ -209,7 +209,7 @@ final class RemoteClassLoader extends URLClassLoader {
     }
 
     public Enumeration<URL> findResources(String name) throws IOException {
-        if(channel.isRestricted)
+        if(channel.isRestricted())
             return new Vector<URL>().elements();
 
         // TODO: use the locally fetched jars to speed up the look up

remoting/src/main/java/hudson/remoting/UserRequest.java

@@ -105,7 +105,7 @@ final class UserRequest<RSP,EXC extends Throwable> extends Request<UserResponse<
                 }
 
                 Callable<RSP,EXC> callable = (Callable<RSP,EXC>)o;
-                if(channel.isRestricted && !(callable instanceof RPCRequest))
+                if(channel.isRestricted() && !(callable instanceof RPCRequest))
                     // if we allow restricted channel to execute arbitrary Callable, the remote JVM can pick up many existing
                     // Callable implementations (such as ones in Hudson's FilePath) and do quite a lot. So restrict that.
                     // OTOH, we need to allow RPCRequest so that method invocations on exported objects will go through.