Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support JEP 486: Permanently Disable the Security Manager #20586

Merged
merged 1 commit into from
Nov 15, 2024
Merged

Support JEP 486: Permanently Disable the Security Manager #20586

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions jcl/src/java.base/share/classes/com/ibm/oti/util/ExternalMessages-MasterIndex.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@

K002c=Access\ denied\ {0}
K002d=Access\ denied\ {0} due to untrusted AccessControlContext since {1} is denied
K002e=checking\ permissions\ is\ not\ supported

K0053=Package\ {0}\ already\ defined.
K0056=Already\ destroyed
Expand Down
20 changes: 10 additions & 10 deletions jcl/src/java.base/share/classes/java/lang/Access.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,14 +290,12 @@ public Stream<Package> packages(ClassLoader classLoader) {
return classLoader.createOrGetClassLoaderValueMap();
}

/*[IF (JAVA_SPEC_VERSION >= 11) & (JAVA_SPEC_VERSION < 24)]*/
@SuppressWarnings("removal")
public void invalidatePackageAccessCache() {
JasonFengJ9 marked this conversation as resolved.
Show resolved Hide resolved
/*[IF JAVA_SPEC_VERSION >= 10]*/
java.lang.SecurityManager.invalidatePackageAccessCache();
/*[ELSE] JAVA_SPEC_VERSION >= 10 */
return;
/*[ENDIF] JAVA_SPEC_VERSION >= 10 */
SecurityManager.invalidatePackageAccessCache();
}
/*[ENDIF] (JAVA_SPEC_VERSION >= 11) & (JAVA_SPEC_VERSION < 24) */

public Class<?> defineClass(ClassLoader classLoader, String className, byte[] classRep, ProtectionDomain protectionDomain, String str) {
ClassLoader targetClassLoader = (null == classLoader) ? ClassLoader.bootstrapClassLoader : classLoader;
Expand Down Expand Up @@ -352,10 +350,12 @@ public ServicesCatalog getServicesCatalog(ModuleLayer ml) {
return ml.getServicesCatalog();
}

/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
public void addNonExportedPackages(ModuleLayer ml) {
SecurityManager.addNonExportedPackages(ml);
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */

public List<Method> getDeclaredPublicMethods(Class<?> clz, String name, Class<?>... types) {
return clz.getDeclaredPublicMethods(name, types);
Expand Down Expand Up @@ -541,11 +541,6 @@ public boolean addEnableNativeAccess(ModuleLayer moduleLayer, String moduleName)
return moduleLayer.addEnableNativeAccess(moduleName);
}

@Override
public boolean allowSecurityManager() {
return System.allowSecurityManager();
}

@Override
public int getCharsLatin1(long i, int index, byte[] buf) {
return StringLatin1.getChars(i, index, buf);
Expand All @@ -562,6 +557,11 @@ public void putCharUTF16(byte[] val, int index, int c) {
}

/*[IF JAVA_SPEC_VERSION < 24]*/
@Override
public boolean allowSecurityManager() {
return System.allowSecurityManager();
}

@Override
public long stringConcatHelperPrepend(long indexCoder, byte[] buf, String value) {
return StringConcatHelper.prepend(indexCoder, buf, value);
Expand Down
4 changes: 2 additions & 2 deletions jcl/src/java.base/share/classes/java/lang/System.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1298,11 +1298,11 @@ static void initSecurityManager(ClassLoader applicationClassLoader) {
}
/*[ENDIF] JAVA_SPEC_VERSION >= 9 */

/*[IF JAVA_SPEC_VERSION >= 23]*/
/*[IF JAVA_SPEC_VERSION == 23]*/
static boolean allowSecurityManager() {
return !throwUOEFromSetSM;
}
/*[ENDIF] JAVA_SPEC_VERSION >= 23 */
/*[ENDIF] JAVA_SPEC_VERSION == 23 */

/**
* Sets the active security manager. Note that once
Expand Down
12 changes: 10 additions & 2 deletions jcl/src/java.base/share/classes/java/security/AccessControlContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
*/
package java.security;

import com.ibm.oti.util.Msg;
import java.io.IOException;
import java.io.StreamTokenizer;
import java.io.StringReader;
Expand Down Expand Up @@ -496,6 +497,7 @@ static Permission[] combinePermObjs(Permission[] checked, Permission[] toBeCombi
return (Permission[]) combineObjs(false, checked, toBeCombined, start, len, justCombine);
}

/*[IF JAVA_SPEC_VERSION < 24]*/
/**
* Perform ProtectionDomain.implies(permission) with known ProtectionDomain objects already implied
*
Expand Down Expand Up @@ -661,7 +663,7 @@ static boolean checkPermissionWithCache(
}
}
/*[MSG "K002c", "Access denied {0}"]*/
throw new AccessControlException(com.ibm.oti.util.Msg.getString("K002c", perm), perm); //$NON-NLS-1$
throw new AccessControlException(Msg.getString("K002c", perm), perm); //$NON-NLS-1$
}
}
if (null != accCurrent
Expand Down Expand Up @@ -697,6 +699,7 @@ static boolean checkPermissionWithCache(
}
return true;
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */

/**
* Helper to print debug information for checkPermission().
Expand Down Expand Up @@ -730,6 +733,10 @@ private boolean debugHelper(Permission perm) {
* if perm is null
*/
public void checkPermission(Permission perm) throws AccessControlException {
/*[IF JAVA_SPEC_VERSION >= 24]*/
/*[MSG "K002e", "checking permissions is not supported"]*/
throw new AccessControlException(Msg.getString("K002e")); //$NON-NLS-1$
/*[ELSE] JAVA_SPEC_VERSION >= 24 */
if (perm == null) throw new NullPointerException();
if (null != context && (STATE_AUTHORIZED != authorizeState) && containPrivilegedContext && null != System.getSecurityManager()) {
// only check SecurityPermission "createAccessControlContext" when context is not null, not authorized and containPrivilegedContext.
Expand All @@ -743,7 +750,7 @@ public void checkPermission(Permission perm) throws AccessControlException {
}
if (STATE_NOT_AUTHORIZED == authorizeState) {
/*[MSG "K002d", "Access denied {0} due to untrusted AccessControlContext since {1} is denied"]*/
throw new AccessControlException(com.ibm.oti.util.Msg.getString("K002d", perm, SecurityConstants.CREATE_ACC_PERMISSION), perm); //$NON-NLS-1$
throw new AccessControlException(Msg.getString("K002d", perm, SecurityConstants.CREATE_ACC_PERMISSION), perm); //$NON-NLS-1$
}
}

Expand All @@ -752,6 +759,7 @@ public void checkPermission(Permission perm) throws AccessControlException {
debug = debugHelper(perm);
}
checkPermissionWithCache(perm, null, this.context, debug ? DEBUG_ENABLED | DEBUG_ACCESS_DENIED : DEBUG_DISABLED, this.doPrivilegedAcc,this.isLimitedContext, this.limitedPerms, this.nextStackAcc, new AccessCache());
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */
}

/**
Expand Down
21 changes: 19 additions & 2 deletions jcl/src/java.base/share/classes/java/security/AccessController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
*/
package java.security;

import com.ibm.oti.util.Msg;
import sun.security.util.SecurityConstants;

/*[IF JAVA_SPEC_VERSION >= 9]
Expand All @@ -48,6 +49,11 @@ public final class AccessController {
initializeInternal();
}

/*[IF JAVA_SPEC_VERSION >= 24]*/
private static AccessControlContext ACC_NO_PERM = new AccessControlContext(
JasonFengJ9 marked this conversation as resolved.
Show resolved Hide resolved
new ProtectionDomain[] { new ProtectionDomain(null, null) });
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */

static final int OBJS_INDEX_ACC = 0;
static final int OBJS_INDEX_PDS = 1;
static final int OBJS_ARRAY_SIZE = 3;
Expand Down Expand Up @@ -179,13 +185,14 @@ private static void throwACE(boolean debug, Permission perm, ProtectionDomain pD
}
if (createACCdenied) {
/*[MSG "K002d", "Access denied {0} due to untrusted AccessControlContext since {1} is denied"]*/
throw new AccessControlException(com.ibm.oti.util.Msg.getString("K002d", perm, SecurityConstants.CREATE_ACC_PERMISSION), perm); //$NON-NLS-1$
throw new AccessControlException(Msg.getString("K002d", perm, SecurityConstants.CREATE_ACC_PERMISSION), perm); //$NON-NLS-1$
} else {
/*[MSG "K002c", "Access denied {0}"]*/
throw new AccessControlException(com.ibm.oti.util.Msg.getString("K002c", perm), perm); //$NON-NLS-1$
throw new AccessControlException(Msg.getString("K002c", perm), perm); //$NON-NLS-1$
}
}

/*[IF JAVA_SPEC_VERSION < 24]*/
/**
* Helper method to check whether the running program is allowed to access the resource
* being guarded by the given Permission argument
Expand Down Expand Up @@ -268,6 +275,7 @@ private static boolean checkPermissionHelper(Permission perm, AccessControlConte
}
return limitedPermImplied;
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */

/**
* Helper to print debug stack information for checkPermission().
Expand Down Expand Up @@ -368,6 +376,10 @@ private static boolean debugHelperJEP140(Object[] objects, Permission perm) {
* NullPointerException if perm is null
*/
public static void checkPermission(Permission perm) throws AccessControlException {
/*[IF JAVA_SPEC_VERSION >= 24]*/
/*[MSG "K002e", "checking permissions is not supported"]*/
throw new AccessControlException(Msg.getString("K002e")); //$NON-NLS-1$
/*[ELSE] JAVA_SPEC_VERSION >= 24 */
if (perm == null) {
throw new NullPointerException();
}
Expand Down Expand Up @@ -421,6 +433,7 @@ public static void checkPermission(Permission perm) throws AccessControlExceptio
System.err.println("access allowed " + perm); //$NON-NLS-1$
DebugRecursionDetection.getTlDebug().remove();
}
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */
}

/**
Expand Down Expand Up @@ -452,7 +465,11 @@ private static void keepalive(Permission... perms) {
* @see AccessControlContext
*/
public static AccessControlContext getContext() {
/*[IF JAVA_SPEC_VERSION >= 24]*/
return ACC_NO_PERM;
/*[ELSE] JAVA_SPEC_VERSION >= 24 */
return getContextHelper(false);
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */
}

/**
Expand Down
2 changes: 2 additions & 0 deletions runtime/jcl/common/java_lang_Class.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1423,11 +1423,13 @@ Java_java_security_AccessController_getAccSnapshot(JNIEnv* env, jclass jsAccessC
if (NULL != vmThread->currentException) {
goto _walkStateUninitialized;
}
#if JAVA_SPEC_VERSION < 24
/* AccessControlContext is allocated in the same space as the thread, so no exception can occur */
contextObject = vmThread->threadObject;
JasonFengJ9 marked this conversation as resolved.
Show resolved Hide resolved
if (NULL != contextObject) {
contextObject = J9VMJAVALANGTHREAD_INHERITEDACCESSCONTROLCONTEXT(vmThread, contextObject);
}
#endif /* JAVA_SPEC_VERSION < 24 */
/* Walk the stack, caching the constant pools of the frames. */
walkState.skipCount = startingFrame + 1; /* skip this JNI frame as well */
walkState.userData1 = STACK_WALK_STATE_MAGIC; /* set to NULL when a limited doPrivileged frame is discovered */
Expand Down
2 changes: 1 addition & 1 deletion runtime/oti/vmconstantpool.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,7 +231,7 @@ SPDX-License-Identifier: EPL-2.0 OR Apache-2.0 OR GPL-2.0-only WITH Classpath-ex

<!-- Common field references shared between OpenJ9 and OpenJDK Thread. -->
<fieldref class="java/lang/Thread" name="contextClassLoader" signature="Ljava/lang/ClassLoader;"/>
<fieldref class="java/lang/Thread" name="inheritedAccessControlContext" signature="Ljava/security/AccessControlContext;"/>
<fieldref class="java/lang/Thread" name="inheritedAccessControlContext" signature="Ljava/security/AccessControlContext;" versions="8-23"/>
<fieldref class="java/lang/Thread" name="name" signature="Ljava/lang/String;"/>
<fieldref class="java/lang/Thread" name="parkBlocker" signature="Ljava/lang/Object;"/>
<fieldref class="java/lang/Thread" name="tid" signature="J"/>
Expand Down