Index: lucene/common-build.xml
===================================================================
--- lucene/common-build.xml	(revision 1378491)
+++ lucene/common-build.xml	(working copy)
@@ -796,6 +796,11 @@
             <sysproperty key="tempDir" value="." />
             <sysproperty key="java.io.tmpdir" value="." />
 
+            <!-- Restrict file modify access to build dir only and install security manager -->
+            <sysproperty key="tests.sandbox.dir" value="${build.dir}" />
+            <sysproperty key="java.security.manager" value="" />
+            <sysproperty key="java.security.policy" value="${common.dir}/tools/junit4/tests.policy" />
+
             <sysproperty key="lucene.version" value="${dev.version}"/>
 
             <sysproperty key="jetty.testMode" value="1"/>
Index: lucene/tools/junit4/tests.policy
===================================================================
--- lucene/tools/junit4/tests.policy	(revision 0)
+++ lucene/tools/junit4/tests.policy	(working copy)
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Policy file to prevent tests from writing outside the test sandbox directory
+// (must be given as a sysprop: tests.sandbox.dir)
+// This policy also disallows stuff like listening on network ports of interfaces
+// different than 127.0.0.1.
+
+// PLEASE NOTE: You may need to enable other permissions when new tests are added,
+// everything not allowed here is forbidden!
+
+grant { 
+  permission java.io.FilePermission "<<ALL FILES>>", "read,execute";
+  permission java.io.FilePermission "${tests.sandbox.dir}${/}-", "read,execute,write,delete";
+  permission java.net.SocketPermission "127.0.0.1:1024-", "accept,listen";
+  permission java.net.SocketPermission "*", "connect,resolve";
+  permission java.util.PropertyPermission "*", "read,write";
+  permission java.lang.reflect.ReflectPermission "*";
+  permission java.lang.RuntimePermission "*";
+  permission java.net.NetPermission "*";
+  permission java.util.logging.LoggingPermission "control";
+  permission java.lang.management.ManagementPermission "*";
+  permission javax.management.MBeanPermission "*", "*";
+  permission javax.management.MBeanServerPermission "*";
+  permission javax.management.MBeanTrustPermission "*";
+};
Index: lucene/tools/junit4/tests.policy
===================================================================
--- lucene/tools/junit4/tests.policy	(revision 0)
+++ lucene/tools/junit4/tests.policy	(working copy)

Property changes on: lucene/tools/junit4/tests.policy
___________________________________________________________________
Added: svn:eol-style
## -0,0 +1 ##
+native
\ No newline at end of property