Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove security manager in Java 24 #30277

Open
wants to merge 2 commits into
base: integration
Choose a base branch
from
Open

Remove security manager in Java 24 #30277

wants to merge 2 commits into from

Conversation

gjwatts
Copy link
Member

@gjwatts gjwatts commented Nov 21, 2024 •
edited
Loading

This PR is to cover a branch rename of #30226 since I used a + sign and the CSI team said to avoid using that character.

In Java 24, they are permanently disabling the security manager. And in Java 24, build 24, they seemed to have introduced that code as almost none of our FATs passed.

[junit] Error occurred during initialization of VM
[junit] java.lang.Error: A command line option has attempted to allow or enable the Security Manager. Enabling a Security Manager is not supported.
[junit] at java.lang.System.initPhase3(java.base@24-ea/System.java:2070)

Added logic for our script variable use.java.security.manager to not allow it to be set to -Djava.security.manager=allow if we are running Java 24 or higher.

While this helped, there were still many build breaks that generate FFDC files with stack traces like:

Stack Dump = java.lang.SecurityException: attempt to add a Permission to a readonly Permissions object
	at java.base/java.security.Permissions.add(Permissions.java:129)
	at java.base/java.security.Policy$UnsupportedEmptyCollection.add(Policy.java:506)
	at com.ibm.ws.jsp.webcontainerext.AbstractJSPExtensionServletWrapper.createClassLoader(AbstractJSPExtensionServletWrapper.java:641)
	at com.ibm.ws.jsp.webcontainerext.AbstractJSPExtensionServletWrapper._checkForTranslation(AbstractJSPExtensionServletWrapper.java:527)
	at com.ibm.ws.jsp.webcontainerext.AbstractJSPExtensionServletWrapper.checkForTranslation(AbstractJSPExtensionServletWrapper.java:250)
	at com.ibm.ws.jsp.webcontainerext.AbstractJSPExtensionProcessor.findWrapper(AbstractJSPExtensionProcessor.java:494)
	at com.ibm.ws.jsp.webcontainerext.AbstractJSPExtensionProcessor.getServletWrapper(AbstractJSPExtensionProcessor.java:336)
	at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:5066)
	at com.ibm.ws.webcontainer.osgi.DynamicVirtualHost$2.handleRequest(DynamicVirtualHost.java:328)
	at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1047)
	at com.ibm.ws.webcontainer.osgi.DynamicVirtualHost$2.run(DynamicVirtualHost.java:293)
	at com.ibm.ws.http.dispatcher.internal.channel.HttpDispatcherLink$TaskWrapper.run(HttpDispatcherLink.java:1260)
	at com.ibm.ws.http.dispatcher.internal.channel.HttpDispatcherLink.wrapHandlerAndExecute(HttpDispatcherLink.java:476)
	at com.ibm.ws.http.dispatcher.internal.channel.HttpDispatcherLink.ready(HttpDispatcherLink.java:435)
	at com.ibm.ws.http.channel.internal.inbound.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:569)
	at com.ibm.ws.http.channel.internal.inbound.HttpInboundLink.handleNewRequest(HttpInboundLink.java:503)
	at com.ibm.ws.http.channel.internal.inbound.HttpInboundLink.processRequest(HttpInboundLink.java:363)
	at com.ibm.ws.http.channel.internal.inbound.HttpInboundLink.ready(HttpInboundLink.java:330)
	at com.ibm.ws.channel.ssl.internal.SSLConnectionLink.determineNextChannel(SSLConnectionLink.java:1135)
	at com.ibm.ws.channel.ssl.internal.SSLConnectionLink$MyReadCompletedCallback.complete(SSLConnectionLink.java:686)
	at com.ibm.ws.channel.ssl.internal.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1826)
	at com.ibm.ws.tcpchannel.internal.WorkQueueManager.requestComplete(WorkQueueManager.java:516)
	at com.ibm.ws.tcpchannel.internal.WorkQueueManager.attemptIO(WorkQueueManager.java:586)
	at com.ibm.ws.tcpchannel.internal.WorkQueueManager.workerRun(WorkQueueManager.java:970)
	at com.ibm.ws.tcpchannel.internal.WorkQueueManager$Worker.run(WorkQueueManager.java:1059)
	at com.ibm.ws.threading.internal.ExecutorServiceImpl$RunnableWrapper.run(ExecutorServiceImpl.java:298)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.lang.Thread.run(Thread.java:1447)

So @tjwatson was gracious to provide a fix for that to combine with my script changes.

@gjwatts gjwatts requested review from volosied and epj November 22, 2024 00:11
@LibbyBot
Copy link

Code analysis and actions

DO NOT DELETE THIS COMMENT.

  • 1 product code files were changed.

  • Please describe in a separate comment how you tested your changes.

  • 1 test infrastructure code files were changed.

  • Test failures/errors in the build could be due to these changes.

@gjwatts gjwatts force-pushed the remove-security-manager-in-java-24 branch from 7a40627 to 163bdf1 Compare November 22, 2024 20:54
volosied
volosied previously approved these changes Nov 22, 2024
View reviewed changes
Copy link
Member

@volosied volosied left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see any builds, but the change looks fine to me.

volosied
volosied reviewed Nov 22, 2024
View reviewed changes
Copy link
Member

@volosied volosied left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, update the copyright to 2024, if you can.

@tjwatson @gjwatts
Use AllPermissionCollection when there is no security manager.
5253fbf 
This avoids trying to add permissions to the collection from the
Policy.  That is no longer allowed on Java 24.  There is no need
to use the Policy if there is no security manager available.
@gjwatts gjwatts force-pushed the remove-security-manager-in-java-24 branch from 163bdf1 to 5253fbf Compare November 22, 2024 21:04
@gjwatts
Copy link
Member Author

gjwatts commented Nov 22, 2024

!build

@LibbyBot
Copy link

Your personal pipeline request is at https://libh-proxy1.fyre.ibm.com/cognitive/pipelineAnalysis.html?uuid=35c70ef5-5235-47c1-bc3f-988e025ef754

Target locations of links might be accessible only to IBM employees.

@LibbyBot
Copy link

Your personal pipeline request is at https://libh-proxy1.fyre.ibm.com/cognitive/pipelineAnalysis.html?uuid=432168fc-1481-4ddf-a19d-9db506c3b0df

Target locations of links might be accessible only to IBM employees.

@LibbyBot
Copy link

Code analysis and actions

DO NOT DELETE THIS COMMENT.

  • 1 test infrastructure code files were changed.

  • Test failures/errors in the build could be due to these changes.

  • 1 product code files were changed.

  • Please describe in a separate comment how you tested your changes.

1 similar comment
@LibbyBot
Copy link

Code analysis and actions

DO NOT DELETE THIS COMMENT.

  • 1 test infrastructure code files were changed.

  • Test failures/errors in the build could be due to these changes.

  • 1 product code files were changed.

  • Please describe in a separate comment how you tested your changes.

@LibbyBot
Copy link

https://libh-proxy1.fyre.ibm.com/cognitive/pipelineAnalysis.html?uuid=432168fc-1481-4ddf-a19d-9db506c3b0df has errors/failures.

@LibbyBot
Copy link

https://libh-proxy1.fyre.ibm.com/cognitive/pipelineAnalysis.html?uuid=35c70ef5-5235-47c1-bc3f-988e025ef754 has errors/failures.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tjwatson tjwatson tjwatson left review comments

@jhanders34 jhanders34 jhanders34 approved these changes

@volosied volosied volosied approved these changes

@epj epj Awaiting requested review from epj

Assignees

@tjwatson tjwatson

@gjwatts gjwatts

Labels
CLA Signed Java 24 team:Zombie Apocalypse
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@gjwatts @LibbyBot @tjwatson @volosied @jhanders34 @epj