Skip to content

Commit aadbf00

Browse files
pshiptonpshipton
authored
Merge pull request #20586 from JasonFengJ9/disablesm
Support JEP 486: Permanently Disable the Security Manager
2 parents 2383bbd + eb1c325 commit aadbf00

File tree

7 files changed

+45
-17
lines changed

7 files changed

+45
-17
lines changed

‎jcl/src/java.base/share/classes/com/ibm/oti/util/ExternalMessages-MasterIndex.properties

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535

3636
K002c=Access\ denied\ {0}
3737
K002d=Access\ denied\ {0} due to untrusted AccessControlContext since {1} is denied
38+
K002e=checking\ permissions\ is\ not\ supported
3839

3940
K0053=Package\ {0}\ already\ defined.
4041
K0056=Already\ destroyed

‎jcl/src/java.base/share/classes/java/lang/Access.java

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -290,14 +290,12 @@ public Stream<Package> packages(ClassLoader classLoader) {
290290
return classLoader.createOrGetClassLoaderValueMap();
291291
}
292292

293+
/*[IF (JAVA_SPEC_VERSION >= 11) & (JAVA_SPEC_VERSION < 24)]*/
293294
@SuppressWarnings("removal")
294295
public void invalidatePackageAccessCache() {
295-
/*[IF JAVA_SPEC_VERSION >= 10]*/
296-
java.lang.SecurityManager.invalidatePackageAccessCache();
297-
/*[ELSE] JAVA_SPEC_VERSION >= 10 */
298-
return;
299-
/*[ENDIF] JAVA_SPEC_VERSION >= 10 */
296+
SecurityManager.invalidatePackageAccessCache();
300297
}
298+
/*[ENDIF] (JAVA_SPEC_VERSION >= 11) & (JAVA_SPEC_VERSION < 24) */
301299

302300
public Class<?> defineClass(ClassLoader classLoader, String className, byte[] classRep, ProtectionDomain protectionDomain, String str) {
303301
ClassLoader targetClassLoader = (null == classLoader) ? ClassLoader.bootstrapClassLoader : classLoader;
@@ -352,10 +350,12 @@ public ServicesCatalog getServicesCatalog(ModuleLayer ml) {
352350
return ml.getServicesCatalog();
353351
}
354352

353+
/*[IF JAVA_SPEC_VERSION < 24]*/
355354
@SuppressWarnings("removal")
356355
public void addNonExportedPackages(ModuleLayer ml) {
357356
SecurityManager.addNonExportedPackages(ml);
358357
}
358+
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
359359

360360
public List<Method> getDeclaredPublicMethods(Class<?> clz, String name, Class<?>... types) {
361361
return clz.getDeclaredPublicMethods(name, types);
@@ -541,11 +541,6 @@ public boolean addEnableNativeAccess(ModuleLayer moduleLayer, String moduleName)
541541
return moduleLayer.addEnableNativeAccess(moduleName);
542542
}
543543

544-
@Override
545-
public boolean allowSecurityManager() {
546-
return System.allowSecurityManager();
547-
}
548-
549544
@Override
550545
public int getCharsLatin1(long i, int index, byte[] buf) {
551546
return StringLatin1.getChars(i, index, buf);
@@ -562,6 +557,11 @@ public void putCharUTF16(byte[] val, int index, int c) {
562557
}
563558

564559
/*[IF JAVA_SPEC_VERSION < 24]*/
560+
@Override
561+
public boolean allowSecurityManager() {
562+
return System.allowSecurityManager();
563+
}
564+
565565
@Override
566566
public long stringConcatHelperPrepend(long indexCoder, byte[] buf, String value) {
567567
return StringConcatHelper.prepend(indexCoder, buf, value);

‎jcl/src/java.base/share/classes/java/lang/System.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1298,11 +1298,11 @@ static void initSecurityManager(ClassLoader applicationClassLoader) {
12981298
}
12991299
/*[ENDIF] JAVA_SPEC_VERSION >= 9 */
13001300

1301-
/*[IF JAVA_SPEC_VERSION >= 23]*/
1301+
/*[IF JAVA_SPEC_VERSION == 23]*/
13021302
static boolean allowSecurityManager() {
13031303
return !throwUOEFromSetSM;
13041304
}
1305-
/*[ENDIF] JAVA_SPEC_VERSION >= 23 */
1305+
/*[ENDIF] JAVA_SPEC_VERSION == 23 */
13061306

13071307
/**
13081308
* Sets the active security manager. Note that once

‎jcl/src/java.base/share/classes/java/security/AccessControlContext.java

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
*/
2323
package java.security;
2424

25+
import com.ibm.oti.util.Msg;
2526
import java.io.IOException;
2627
import java.io.StreamTokenizer;
2728
import java.io.StringReader;
@@ -496,6 +497,7 @@ static Permission[] combinePermObjs(Permission[] checked, Permission[] toBeCombi
496497
return (Permission[]) combineObjs(false, checked, toBeCombined, start, len, justCombine);
497498
}
498499

500+
/*[IF JAVA_SPEC_VERSION < 24]*/
499501
/**
500502
* Perform ProtectionDomain.implies(permission) with known ProtectionDomain objects already implied
501503
*
@@ -661,7 +663,7 @@ static boolean checkPermissionWithCache(
661663
}
662664
}
663665
/*[MSG "K002c", "Access denied {0}"]*/
664-
throw new AccessControlException(com.ibm.oti.util.Msg.getString("K002c", perm), perm); //$NON-NLS-1$
666+
throw new AccessControlException(Msg.getString("K002c", perm), perm); //$NON-NLS-1$
665667
}
666668
}
667669
if (null != accCurrent
@@ -697,6 +699,7 @@ static boolean checkPermissionWithCache(
697699
}
698700
return true;
699701
}
702+
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
700703

701704
/**
702705
* Helper to print debug information for checkPermission().
@@ -730,6 +733,10 @@ private boolean debugHelper(Permission perm) {
730733
* if perm is null
731734
*/
732735
public void checkPermission(Permission perm) throws AccessControlException {
736+
/*[IF JAVA_SPEC_VERSION >= 24]*/
737+
/*[MSG "K002e", "checking permissions is not supported"]*/
738+
throw new AccessControlException(Msg.getString("K002e")); //$NON-NLS-1$
739+
/*[ELSE] JAVA_SPEC_VERSION >= 24 */
733740
if (perm == null) throw new NullPointerException();
734741
if (null != context && (STATE_AUTHORIZED != authorizeState) && containPrivilegedContext && null != System.getSecurityManager()) {
735742
// only check SecurityPermission "createAccessControlContext" when context is not null, not authorized and containPrivilegedContext.
@@ -743,7 +750,7 @@ public void checkPermission(Permission perm) throws AccessControlException {
743750
}
744751
if (STATE_NOT_AUTHORIZED == authorizeState) {
745752
/*[MSG "K002d", "Access denied {0} due to untrusted AccessControlContext since {1} is denied"]*/
746-
throw new AccessControlException(com.ibm.oti.util.Msg.getString("K002d", perm, SecurityConstants.CREATE_ACC_PERMISSION), perm); //$NON-NLS-1$
753+
throw new AccessControlException(Msg.getString("K002d", perm, SecurityConstants.CREATE_ACC_PERMISSION), perm); //$NON-NLS-1$
747754
}
748755
}
749756

@@ -752,6 +759,7 @@ public void checkPermission(Permission perm) throws AccessControlException {
752759
debug = debugHelper(perm);
753760
}
754761
checkPermissionWithCache(perm, null, this.context, debug ? DEBUG_ENABLED | DEBUG_ACCESS_DENIED : DEBUG_DISABLED, this.doPrivilegedAcc,this.isLimitedContext, this.limitedPerms, this.nextStackAcc, new AccessCache());
762+
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */
755763
}
756764

757765
/**

‎jcl/src/java.base/share/classes/java/security/AccessController.java

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
*/
2323
package java.security;
2424

25+
import com.ibm.oti.util.Msg;
2526
import sun.security.util.SecurityConstants;
2627

2728
/*[IF JAVA_SPEC_VERSION >= 9]
@@ -48,6 +49,11 @@ public final class AccessController {
4849
initializeInternal();
4950
}
5051

52+
/*[IF JAVA_SPEC_VERSION >= 24]*/
53+
private static AccessControlContext ACC_NO_PERM = new AccessControlContext(
54+
new ProtectionDomain[] { new ProtectionDomain(null, null) });
55+
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */
56+
5157
static final int OBJS_INDEX_ACC = 0;
5258
static final int OBJS_INDEX_PDS = 1;
5359
static final int OBJS_ARRAY_SIZE = 3;
@@ -179,13 +185,14 @@ private static void throwACE(boolean debug, Permission perm, ProtectionDomain pD
179185
}
180186
if (createACCdenied) {
181187
/*[MSG "K002d", "Access denied {0} due to untrusted AccessControlContext since {1} is denied"]*/
182-
throw new AccessControlException(com.ibm.oti.util.Msg.getString("K002d", perm, SecurityConstants.CREATE_ACC_PERMISSION), perm); //$NON-NLS-1$
188+
throw new AccessControlException(Msg.getString("K002d", perm, SecurityConstants.CREATE_ACC_PERMISSION), perm); //$NON-NLS-1$
183189
} else {
184190
/*[MSG "K002c", "Access denied {0}"]*/
185-
throw new AccessControlException(com.ibm.oti.util.Msg.getString("K002c", perm), perm); //$NON-NLS-1$
191+
throw new AccessControlException(Msg.getString("K002c", perm), perm); //$NON-NLS-1$
186192
}
187193
}
188194

195+
/*[IF JAVA_SPEC_VERSION < 24]*/
189196
/**
190197
* Helper method to check whether the running program is allowed to access the resource
191198
* being guarded by the given Permission argument
@@ -268,6 +275,7 @@ private static boolean checkPermissionHelper(Permission perm, AccessControlConte
268275
}
269276
return limitedPermImplied;
270277
}
278+
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
271279

272280
/**
273281
* Helper to print debug stack information for checkPermission().
@@ -368,6 +376,10 @@ private static boolean debugHelperJEP140(Object[] objects, Permission perm) {
368376
* NullPointerException if perm is null
369377
*/
370378
public static void checkPermission(Permission perm) throws AccessControlException {
379+
/*[IF JAVA_SPEC_VERSION >= 24]*/
380+
/*[MSG "K002e", "checking permissions is not supported"]*/
381+
throw new AccessControlException(Msg.getString("K002e")); //$NON-NLS-1$
382+
/*[ELSE] JAVA_SPEC_VERSION >= 24 */
371383
if (perm == null) {
372384
throw new NullPointerException();
373385
}
@@ -421,6 +433,7 @@ public static void checkPermission(Permission perm) throws AccessControlExceptio
421433
System.err.println("access allowed " + perm); //$NON-NLS-1$
422434
DebugRecursionDetection.getTlDebug().remove();
423435
}
436+
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */
424437
}
425438

426439
/**
@@ -452,7 +465,11 @@ private static void keepalive(Permission... perms) {
452465
* @see AccessControlContext
453466
*/
454467
public static AccessControlContext getContext() {
468+
/*[IF JAVA_SPEC_VERSION >= 24]*/
469+
return ACC_NO_PERM;
470+
/*[ELSE] JAVA_SPEC_VERSION >= 24 */
455471
return getContextHelper(false);
472+
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */
456473
}
457474

458475
/**

‎runtime/jcl/common/java_lang_Class.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1423,11 +1423,13 @@ Java_java_security_AccessController_getAccSnapshot(JNIEnv* env, jclass jsAccessC
14231423
if (NULL != vmThread->currentException) {
14241424
goto _walkStateUninitialized;
14251425
}
1426+
#if JAVA_SPEC_VERSION < 24
14261427
/* AccessControlContext is allocated in the same space as the thread, so no exception can occur */
14271428
contextObject = vmThread->threadObject;
14281429
if (NULL != contextObject) {
14291430
contextObject = J9VMJAVALANGTHREAD_INHERITEDACCESSCONTROLCONTEXT(vmThread, contextObject);
14301431
}
1432+
#endif /* JAVA_SPEC_VERSION < 24 */
14311433
/* Walk the stack, caching the constant pools of the frames. */
14321434
walkState.skipCount = startingFrame + 1; /* skip this JNI frame as well */
14331435
walkState.userData1 = STACK_WALK_STATE_MAGIC; /* set to NULL when a limited doPrivileged frame is discovered */

‎runtime/oti/vmconstantpool.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,7 @@ SPDX-License-Identifier: EPL-2.0 OR Apache-2.0 OR GPL-2.0-only WITH Classpath-ex
231231

232232
<!-- Common field references shared between OpenJ9 and OpenJDK Thread. -->
233233
<fieldref class="java/lang/Thread" name="contextClassLoader" signature="Ljava/lang/ClassLoader;"/>
234-
<fieldref class="java/lang/Thread" name="inheritedAccessControlContext" signature="Ljava/security/AccessControlContext;"/>
234+
<fieldref class="java/lang/Thread" name="inheritedAccessControlContext" signature="Ljava/security/AccessControlContext;" versions="8-23"/>
235235
<fieldref class="java/lang/Thread" name="name" signature="Ljava/lang/String;"/>
236236
<fieldref class="java/lang/Thread" name="parkBlocker" signature="Ljava/lang/Object;"/>
237237
<fieldref class="java/lang/Thread" name="tid" signature="J"/>

0 commit comments

Comments
 (0)