8338411: Implement JEP 486: Permanently Disable the Security Manager #21498

seanjmullan · 2024-10-14T13:52:24Z

This is the implementation of JEP 486: Permanently Disable the Security Manager. See JEP 486 for more details. The CSR describes in detail the main changes in the JEP and also includes an apidiff of the specification changes.

NOTE: the majority (~95%) of the changes in this PR are test updates (removal/modifications) and API specification changes, the latter mostly to remove @throws SecurityException. The remaining changes are primarily the removal of the SecurityManager, Policy, AccessController and other Security Manager API implementations. There is very little new code.

The code changes can be broken down into roughly the following categories:

Degrading the behavior of Security Manager APIs to either throw Exceptions by default or provide an execution environment that disallows access to all resources by default.
Changing hundreds of methods and constructors to no longer throw a SecurityException if a Security Manager was enabled. They will operate as they did in JDK 23 with no Security Manager enabled.
Changing the java command to exit with a fatal error if a Security Manager is enabled.
Removing the hotspot native code for the privileged stack walk and the inherited access control context. The remaining hotspot code and tests related to the Security Manager will be removed immediately after integration - see JDK-8341916.
Removing or modifying hundreds of tests. Many tests that tested Security Manager behavior are no longer relevant and thus have been removed or modified.

There are a handful of Security Manager related tests that are failing and are at the end of the test/jdk/ProblemList.txt, test/langtools/ProblemList.txt and test/hotspot/jtreg/ProblemList.txt files - these will be removed or separate bugs will be filed before integrating this PR.

Inside the JDK, we have retained calls to SecurityManager::getSecurityManager and AccessController::doPrivileged for now, as these methods have been degraded to behave the same as they did in JDK 23 with no Security Manager enabled. After we integrate this JEP, those calls will be removed in each area (client-libs, core-libs, security, etc).

I don't expect each reviewer to review all the code changes in this JEP. Rather, I advise that you only focus on the changes for the area (client-libs, core-libs, net, security, etc) that you are most familiar with.

Progress

Change must not contain extraneous whitespace
Change requires CSR request JDK-8338412 to be approved
Commit message must refer to an issue
Change requires a JEP request to be targeted
Change must be properly reviewed (2 reviews required, with at least 1 Reviewer, 1 Author)

Issues

JDK-8338411: Implement JEP 486: Permanently Disable the Security Manager (Enhancement - P3)
JDK-8338625: JEP 486: Permanently Disable the Security Manager (JEP)
JDK-8338412: Implement JEP 486: Permanently Disable the Security Manager (CSR)

Reviewers

Daniel Fuchs (@dfuch - Reviewer) Review applies to f89d9d09
Magnus Ihse Bursie (@magicus - Reviewer) Review applies to d05122fb
Erik Joelsson (@erikj79 - Reviewer) Review applies to d05122fb
Chris Plummer (@plummercj - Reviewer) Review applies to d05122fb
Coleen Phillimore (@coleenp - Reviewer) Review applies to d05122fb
Naoto Sato (@naotoj - Reviewer) Review applies to d05122fb
Mandy Chung (@mlchung - Reviewer) Review applies to 7958ee2b
Phil Race (@prrace - Reviewer) Review applies to b7b95a40
Weijun Wang (@wangweij - Reviewer) Review applies to b7b95a40
Joe Wang (@JoeWang-Java - Reviewer) Review applies to d05122fb
Kevin Walls (@kevinjwalls - Reviewer)
Alexander Zvegintsev (@azvegint - Reviewer) Review applies to f89d9d09
Alexey Ivanov (@aivanov-jdk - Reviewer) Review applies to 7958ee2b
Roger Riggs (@RogerRiggs - Reviewer)
Prasanta Sadhukhan (@prsadhuk - Reviewer) Review applies to cb50dfde
Brent Christian (@bchristi-git - Reviewer) Review applies to 2f90c839
Athijegannathan Sundararajan (@sundararajana - Reviewer) Review applies to 2f90c839
Attila Szegedi (@szegedi - Reviewer) Review applies to 7958ee2b

Reviewers without OpenJDK IDs

@dmlloyd (no known openjdk.org user name / role) Review applies to f89d9d09

Contributors

Sean Mullan <[email protected]>
Alan Bateman <[email protected]>
Weijun Wang <[email protected]>
Aleksei Efimov <[email protected]>
Brian Burkhalter <[email protected]>
Daniel Fuchs <[email protected]>
Harshitha Onkar <[email protected]>
Joe Wang <[email protected]>
Jorn Vernee <[email protected]>
Justin Lu <[email protected]>
Kevin Walls <[email protected]>
Lance Andersen <[email protected]>
Naoto Sato <[email protected]>
Roger Riggs <[email protected]>
Brent Christian <[email protected]>
Stuart Marks <[email protected]>
Ian Graves <[email protected]>
Phil Race <[email protected]>
Erik Gahlin <[email protected]>
Jaikiran Pai <[email protected]>

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/21498/head:pull/21498
$ git checkout pull/21498

Update a local copy of the PR:
$ git checkout pull/21498
$ git pull https://git.openjdk.org/jdk.git pull/21498/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 21498

View PR using the GUI difftool:
$ git pr show -t 21498

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/21498.diff

Using Webrev

Link to Webrev Comment

Co-authored-by: Sean Mullan <[email protected]> Co-authored-by: Alan Bateman <[email protected]> Co-authored-by: Weijun Wang <[email protected]> Co-authored-by: Aleksei Efimov <[email protected]> Co-authored-by: Brian Burkhalter <[email protected]> Co-authored-by: Daniel Fuchs <[email protected]> Co-authored-by: Harshitha Onkar <[email protected]> Co-authored-by: Joe Wang <[email protected]> Co-authored-by: Jorn Vernee <[email protected]> Co-authored-by: Justin Lu <[email protected]> Co-authored-by: Kevin Walls <[email protected]>> Co-authored-by: Lance Andersen <[email protected]> Co-authored-by: Naoto Sato <[email protected]> Co-authored-by: Roger Riggs <[email protected]> Co-authored-by: Brent Christian <[email protected]>

…java, not useful without SM

…stance.

setInitialContextFactoryBuilder and setObjectFactoryBuilder methods in javax.naming.spi.NamingManager.

permission cannot be used anymore to control access.

description.

…sion checks of the Class.getNestHost and getNestMembers methods, which no longer apply.

…ested by other tests

…ava, useless without SM

ModuleDescriptor.location().

…attacker to create new instances

…Class<?> clazz, int which)

RogerRiggs

Good to go!

seanjmullan · 2024-11-12T15:47:01Z

/integrate

seanjmullan · 2024-11-12T15:56:26Z

/reviewers 2

openjdk · 2024-11-12T15:57:07Z

@seanjmullan This pull request has not yet been marked as ready for integration.

openjdk · 2024-11-12T15:57:20Z

@seanjmullan
The total number of required reviews for this PR (including the jcheck configuration and the last /reviewers command) is now set to 2 (with at least 1 Reviewer, 1 Author).

LanceAndersen

Thank you for all of your hard work on this JEP Sean.

seanjmullan · 2024-11-12T16:04:21Z

/integrate

seanjmullan · 2024-11-12T16:34:06Z

/integrate

seanjmullan · 2024-11-12T17:12:19Z

/integrate

openjdk · 2024-11-12T17:16:15Z

Going to push as commit db85090.
Since your change was applied there have been 5 commits pushed to the master branch:

c12b386: 8338007: [JVMCI] ResolvedJavaMethod.reprofile can crash ciMethodData
81752c4: 8338565: Test crashed: assert(is_path_empty()) failed: invariant
e5eaa7f: 8343946: JFR: Wildcard should only work with COUNT for 'jfr view'
2989d87: 8343805: RISC-V: JVM crashes on startup when disabling compressed instructions
78b8015: 8338383: Implement JEP 491: Synchronize Virtual Threads without Pinning

Your commit was automatically rebased without conflicts.

openjdk · 2024-11-12T17:16:29Z

@seanjmullan Pushed as commit db85090.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

openjdk · 2024-11-12T17:16:48Z

@seanjmullan The command integrate can only be used in open pull requests.

openjdk · 2024-11-12T17:16:57Z

@seanjmullan The command integrate can only be used in open pull requests.

AlanBateman and others added 30 commits September 30, 2024 18:02

ServerSocket bind/accept no longer throw SecurityException

591d3d6

Merge

781eecd

hack out Security Manager from LoaderHandler

4035376

Update spec for RMIClassLoader

6d2006d

Fix whitespace.

6c325c2

Restore URL parsing to LoaderHandler::getClassLoader.

463d46b

Merge

439ed26

Remove vmTestbase/nsk/jvmti/AttachOnDemand/attach004/TestDescription.…

53e06d0

…java, not useful without SM

Remove leftover SecurityException text from RMIConnection.getObjectIn…

9e1cec8

…stance.

Remove leftover "@see java.lang.SecurityManager#checkSetFactory" from

7cf5824

setInitialContextFactoryBuilder and setObjectFactoryBuilder methods in javax.naming.spi.NamingManager.

Remove unnecessary comma.

77b58bf

Merge

b5f2ca3

Fix typo.

938737a

Remove text about granting permission and add api note indicating

2612400

permission cannot be used anymore to control access.

Remove text about implementers using Security Manager checks from class

4688f78

description.

Remove Security Manager text from EXIT_ON_CLOSE.

34da8c7

Removed TestSecurityManagerChecks.java - this test was testing permis…

c62c4ad

…sion checks of the Class.getNestHost and getNestMembers methods, which no longer apply.

Drop reference to permissions from Font.getFont

d8e15dd

Merge

29c0bb2

Update record tests to not require SM

23e0f09

Remove tests for repeating annotations with SM set, no SM case well t…

bd27286

…ested by other tests

Change reflect/Nestmates/TestReflectionAPI to not test with a SM set

7f451ea

Remove test/langtools/tools/javac/api/ToolProvider/ToolProviderTest.j…

c9ab253

…ava, useless without SM

Remove text about granting permissions to module from

36522ed

ModuleDescriptor.location().

Remove text about Proxy objects being granted AllPermission.

c769f2d

Remove text about needing ReflectPermission to access AccessibleObject.

79b4b21

JDK-8003881: Prevent lambda implementing inner classes from allowing …

e46d99c

…attacker to create new instances

JDK-8007035: deprecate public void SecurityManager.checkMemberAccess(…

422c489

…Class<?> clazz, int which)

Update copyright header

1f4be6f

RogerRiggs approved these changes Nov 12, 2024

View reviewed changes

Merge

7c996a5

kevinjwalls approved these changes Nov 12, 2024

View reviewed changes

RogerRiggs approved these changes Nov 12, 2024

View reviewed changes

openjdk bot added the merge-conflict Pull request has merge conflict with target branch label Nov 12, 2024

openjdk bot mentioned this pull request Nov 12, 2024

8344034: Remove security manager dependency in Serialization #22041

Closed

3 tasks

RogerRiggs approved these changes Nov 12, 2024

View reviewed changes

openjdk bot mentioned this pull request Nov 12, 2024

8344039: Remove security manager dependency in java.time #22042

Closed

3 tasks

openjdk bot removed the merge-conflict Pull request has merge conflict with target branch label Nov 12, 2024

LanceAndersen approved these changes Nov 12, 2024

View reviewed changes

coffeys approved these changes Nov 12, 2024

View reviewed changes

aivanov-jdk approved these changes Nov 12, 2024

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Nov 12, 2024

openjdk bot added the integrated Pull request has been integrated label Nov 12, 2024

openjdk bot closed this Nov 12, 2024

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Nov 12, 2024

mur47x111 mentioned this pull request Nov 12, 2024

Patch Hadoop Client API jar to avoid deprecated Java Security API renaissance-benchmarks/renaissance#453

Merged

graalvmbot mentioned this pull request Nov 19, 2024

[GR-59836] Update labsjdk to 24+24-jvmci-b01 oracle/graal#10108

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8338411: Implement JEP 486: Permanently Disable the Security Manager #21498

8338411: Implement JEP 486: Permanently Disable the Security Manager #21498

seanjmullan commented Oct 14, 2024 •

edited by openjdk bot

Loading

RogerRiggs left a comment

seanjmullan commented Nov 12, 2024

seanjmullan commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

LanceAndersen left a comment

seanjmullan commented Nov 12, 2024

seanjmullan commented Nov 12, 2024

seanjmullan commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

8338411: Implement JEP 486: Permanently Disable the Security Manager #21498

8338411: Implement JEP 486: Permanently Disable the Security Manager #21498

Conversation

seanjmullan commented Oct 14, 2024 • edited by openjdk bot Loading

Progress

Issues

Reviewers

Reviewers without OpenJDK IDs

Contributors

Reviewing

RogerRiggs left a comment

Choose a reason for hiding this comment

seanjmullan commented Nov 12, 2024

seanjmullan commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

LanceAndersen left a comment

Choose a reason for hiding this comment

seanjmullan commented Nov 12, 2024

seanjmullan commented Nov 12, 2024

seanjmullan commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

openjdk bot commented Nov 12, 2024

seanjmullan commented Oct 14, 2024 •

edited by openjdk bot

Loading