Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove System.security field and getSecurityManager calls for JDK 24 #20851

Merged
merged 4 commits into from
Jan 8, 2025
Merged

Remove System.security field and getSecurityManager calls for JDK 24 #20851

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5dbaa8f
Remove System.security field for JDK 24+
theresa-m Dec 17, 2024
4f4c986
Enable System.security reflection test for JDK24
theresa-m Dec 17, 2024
4d80327
Remove uses of getSecurityManager from java.lang.System for JDK24+
theresa-m Dec 19, 2024
93fd41b
Fix java.lang.System formatting
theresa-m Jan 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 76 additions & 26 deletions jcl/src/java.base/share/classes/java/lang/System.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,10 +124,12 @@ public final class System {
*/
private static Properties systemProperties;

/*[IF JAVA_SPEC_VERSION < 24]*/
/**
* The System default SecurityManager.
*/
private static SecurityManager security;
/*[ENDIF] JAVA_SPEC_VERSION < 24 */

private static volatile Console console;
private static volatile boolean consoleInitialized;
Expand Down Expand Up @@ -594,12 +596,13 @@ static URL codeSource(Class<?> callerClass) {
* @param newIn the new value for in.
*/
public static void setIn(InputStream newIn) {
/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null) {
if (security != null) {
security.checkPermission(com.ibm.oti.util.RuntimePermissions.permissionSetIO);
}

/*[ENDIF] JAVA_SPEC_VERSION < 24 */
setFieldImpl("in", newIn); //$NON-NLS-1$
}

Expand All @@ -610,11 +613,13 @@ public static void setIn(InputStream newIn) {
* @param newOut the new value for out.
*/
public static void setOut(java.io.PrintStream newOut) {
/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null) {
if (security != null) {
security.checkPermission(com.ibm.oti.util.RuntimePermissions.permissionSetIO);
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
setFieldImpl("out", newOut); //$NON-NLS-1$
}

Expand All @@ -625,12 +630,13 @@ public static void setOut(java.io.PrintStream newOut) {
* @param newErr the new value for err.
*/
public static void setErr(java.io.PrintStream newErr) {
/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null) {
if (security != null) {
security.checkPermission(com.ibm.oti.util.RuntimePermissions.permissionSetIO);
}

/*[ENDIF] JAVA_SPEC_VERSION < 24 */
setFieldImpl("err", newErr); //$NON-NLS-1$
}

Expand Down Expand Up @@ -912,11 +918,13 @@ public static void gc() {
@SuppressWarnings("dep-ann")
public static String getenv(String var) {
if (var == null) throw new NullPointerException();
/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null)
if (security != null) {
security.checkPermission(new RuntimePermission("getenv." + var)); //$NON-NLS-1$

}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
return ProcessEnvironment.getenv(var);
}

Expand All @@ -925,19 +933,23 @@ public static String getenv(String var) {
* not a copy, so that changes made to the returned
* Properties object will be reflected in subsequent
* calls to {@code getProperty()} and {@code getProperties()}.
/*[IF JAVA_SPEC_VERSION < 24]
* <p>
* Security managers should restrict access to this
* API if possible.
/*[ENDIF] JAVA_SPEC_VERSION < 24
*
* @return the system properties
*/
public static Properties getProperties() {
if (!propertiesInitialized) throw new Error("bootstrap error, system property access before init"); //$NON-NLS-1$
/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null)
if (security != null) {
security.checkPropertiesAccess();

}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
return systemProperties;
}

Expand Down Expand Up @@ -998,10 +1010,13 @@ public static String getProperty(String prop) {
public static String getProperty(String prop, String defaultValue) {
if (prop.length() == 0) throw new IllegalArgumentException();

/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null)
if (security != null) {
security.checkPropertyAccess(prop);
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */

if (!propertiesInitialized
&& !prop.equals("com.ibm.IgnoreMalformedInput") //$NON-NLS-1$
Expand Down Expand Up @@ -1039,11 +1054,13 @@ public static String setProperty(String prop, String value) {
/*[PR CMVC 80288] should check for empty key */
if (prop.length() == 0) throw new IllegalArgumentException();

/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null)
security.checkPermission(
new PropertyPermission(prop, "write")); //$NON-NLS-1$
if (security != null) {
security.checkPermission(new PropertyPermission(prop, "write")); //$NON-NLS-1$
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */

return (String)systemProperties.setProperty(prop, value);
}
Expand Down Expand Up @@ -1085,7 +1102,11 @@ public static String setProperty(String prop, String value) {
@Deprecated(since="17", forRemoval=true)
/*[ENDIF] JAVA_SPEC_VERSION >= 17 */
public static SecurityManager getSecurityManager() {
/*[IF JAVA_SPEC_VERSION >= 24]*/
return null;
/*[ELSE] JAVA_SPEC_VERSION >= 24 */
return security;
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */
}

/**
Expand Down Expand Up @@ -1118,10 +1139,11 @@ public static int identityHashCode(Object anObject) {
* @param pathName the path of the file to be loaded
*
* @throws UnsatisfiedLinkError if the library could not be loaded
* @throws SecurityException if the library was not allowed to be loaded
* @throws NullPointerException if pathName is null
/*[IF JAVA_SPEC_VERSION >= 24]
* @throws IllegalCallerException if the caller belongs to a module where native access is not enabled
/*[ELSE] JAVA_SPEC_VERSION >= 24
* @throws SecurityException if the library was not allowed to be loaded
/*[ENDIF] JAVA_SPEC_VERSION >= 24
*/
@CallerSensitive
Expand All @@ -1132,14 +1154,14 @@ public static void load(String pathName) {
/*[IF JAVA_SPEC_VERSION >= 24]*/
Class<?> caller = Reflection.getCallerClass();
Reflection.ensureNativeAccess(caller, System.class, "load", false);
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */

/*[ELSE] JAVA_SPEC_VERSION >= 24 */
@SuppressWarnings("removal")
SecurityManager smngr = System.getSecurityManager();
if (smngr != null) {
smngr.checkLink(pathName);
}
/*[IF JAVA_SPEC_VERSION >= 15]*/
/*[ENDIF] JAVA_SPEC_VERSION >= 24 */
/*[IF JAVA_SPEC_VERSION >= 15]*/
/*[IF PLATFORM-mz31 | PLATFORM-mz64]*/
ClassLoader.loadZOSLibrary(getCallerClass(), pathName);
/*[ELSE] PLATFORM-mz31 | PLATFORM-mz64 */
Expand All @@ -1150,9 +1172,9 @@ public static void load(String pathName) {
}
ClassLoader.loadLibrary(getCallerClass(), fileName);
/*[ENDIF] PLATFORM-mz31 | PLATFORM-mz64 */
/*[ELSE] JAVA_SPEC_VERSION >= 15 */
/*[ELSE] JAVA_SPEC_VERSION >= 15 */
ClassLoader.loadLibraryWithPath(pathName, ClassLoader.callerClassLoader(), null);
/*[ENDIF] JAVA_SPEC_VERSION >= 15 */
/*[ENDIF] JAVA_SPEC_VERSION >= 15 */
}

/**
Expand All @@ -1161,10 +1183,11 @@ public static void load(String pathName) {
* @param libName the name of the library to load
*
* @throws UnsatisfiedLinkError if the library could not be loaded
* @throws SecurityException if the library was not allowed to be loaded
* @throws NullPointerException if libName is null
/*[IF JAVA_SPEC_VERSION >= 24]
* @throws IllegalCallerException if the caller belongs to a module where native access is not enabled
/*[ELSE] JAVA_SPEC_VERSION >= 24
* @throws SecurityException if the library was not allowed to be loaded
/*[ENDIF] JAVA_SPEC_VERSION >= 24
*/
@CallerSensitive
Expand All @@ -1187,12 +1210,13 @@ public static void loadLibrary(String libName) {
throw new UnsatisfiedLinkError(Msg.getString("K0B01", libName)); //$NON-NLS-1$
}
}

/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager smngr = System.getSecurityManager();
if (smngr != null) {
smngr.checkLink(libName);
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
/*[IF JAVA_SPEC_VERSION >= 15]*/
Class<?> callerClass = getCallerClass();
/*[ELSE]*/
Expand Down Expand Up @@ -1248,17 +1272,22 @@ public static void runFinalizersOnExit(boolean flag) {
* Sets the system properties. Note that the object which is passed in
* is not copied, so that subsequent changes made to it will be reflected
* in calls to {@code getProperty()} and {@code getProperties()}.
/*[IF JAVA_SPEC_VERSION < 24]
* <p>
* Security managers should restrict access to this
* API if possible.
/*[ENDIF] JAVA_SPEC_VERSION < 24
*
* @param p the properties to set
*/
public static void setProperties(Properties p) {
/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null)
if (security != null) {
security.checkPropertiesAccess();
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
if (p == null) {
ensureProperties(false);
} else {
Expand Down Expand Up @@ -1519,10 +1548,13 @@ public static String clearProperty(String prop) {
if (!propertiesInitialized) throw new Error("bootstrap error, system property access before init: " + prop); //$NON-NLS-1$

if (prop.length() == 0) throw new IllegalArgumentException();
/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null)
if (security != null) {
security.checkPermission(new PropertyPermission(prop, "write")); //$NON-NLS-1$
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
return (String)systemProperties.remove(prop);
}

Expand All @@ -1532,11 +1564,13 @@ public static String clearProperty(String prop) {
* @return an unmodifiable Map containing all of the system environment variables.
*/
public static Map<String, String> getenv() {
/*[IF JAVA_SPEC_VERSION < 24]*/
@SuppressWarnings("removal")
SecurityManager security = System.getSecurityManager();
if (security != null)
if (security != null) {
security.checkPermission(new RuntimePermission("getenv.*")); //$NON-NLS-1$

}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
return ProcessEnvironment.getenv();
}

Expand Down Expand Up @@ -1897,10 +1931,14 @@ public abstract static class LoggerFinder {
/**
* Checks needed runtime permissions
*
/*[IF JAVA_SPEC_VERSION < 24]
* @throws SecurityException if RuntimePermission("loggerFinder") is not allowed
/*[ENDIF] JAVA_SPEC_VERSION < 24
*/
protected LoggerFinder() {
/*[IF JAVA_SPEC_VERSION < 24]*/
verifyPermissions();
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
}

/**
Expand All @@ -1911,10 +1949,14 @@ protected LoggerFinder() {
* @param callerModule The module for which the logger is being requested
* @return an instance of Logger
* @throws NullPointerException if loggerName or callerModule is null
/*[IF JAVA_SPEC_VERSION < 24]
* @throws SecurityException if RuntimePermission("loggerFinder") is not allowed
/*[ENDIF] JAVA_SPEC_VERSION < 24
*/
public Logger getLocalizedLogger(String loggerName, ResourceBundle bundle, Module callerModule) {
/*[IF JAVA_SPEC_VERSION < 24]*/
verifyPermissions();
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
Objects.requireNonNull(loggerName);
Objects.requireNonNull(callerModule);
Logger logger = this.getLogger(loggerName, callerModule);
Expand All @@ -1929,18 +1971,24 @@ public Logger getLocalizedLogger(String loggerName, ResourceBundle bundle, Modul
* @param callerModule The module for which the logger is being requested
* @return a Logger suitable for use within the given module
* @throws NullPointerException if loggerName or callerModule is null
/*[IF JAVA_SPEC_VERSION < 24]
* @throws SecurityException if RuntimePermission("loggerFinder") is not allowed
/*[ENDIF] JAVA_SPEC_VERSION < 24
*/
public abstract Logger getLogger(String loggerName, Module callerModule);

/**
* Returns the LoggerFinder instance
*
* @return the LoggerFinder instance.
/*[IF JAVA_SPEC_VERSION < 24]
* @throws SecurityException if RuntimePermission("loggerFinder") is not allowed
/*[ENDIF] JAVA_SPEC_VERSION < 24
*/
public static LoggerFinder getLoggerFinder() {
/*[IF JAVA_SPEC_VERSION < 24]*/
verifyPermissions();
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
LoggerFinder localFinder = loggerFinder;
if (localFinder == null) {
localFinder = AccessController.doPrivileged(
Expand All @@ -1957,13 +2005,15 @@ public static LoggerFinder getLoggerFinder() {
return localFinder;
}

/*[IF JAVA_SPEC_VERSION < 24]*/
private static void verifyPermissions() {
@SuppressWarnings("removal")
SecurityManager securityManager = System.getSecurityManager();
if (securityManager != null) {
if (securityManager != null) {
securityManager.checkPermission(com.ibm.oti.util.RuntimePermissions.permissionLoggerFinder);
}
}
/*[ENDIF] JAVA_SPEC_VERSION < 24 */
}

/**
Expand Down
4 changes: 2 additions & 2 deletions runtime/oti/vm_api.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2920,8 +2920,7 @@ fieldIndexTableRemove(J9JavaVM* vm, J9Class *ramClass);


/* ---------------- resolvesupport.c ---------------- */
/*
*/
#if JAVA_SPEC_VERSION < 24
/**
* Perform a package access check from the ProtectionDomain to the targetClass
* No check is required if no SecurityManager is in place. If a check is required and the
Expand Down Expand Up @@ -2949,6 +2948,7 @@ packageAccessIsLegal(J9VMThread *currentThread, J9Class *targetClass, j9object_t
*/
BOOLEAN
requirePackageAccessCheck(J9JavaVM *vm, J9ClassLoader *srcClassLoader, J9Module *srcModule, J9Class *targetClass);
#endif /* JAVA_SPEC_VERSION < 24 */

/**
* @brief
Expand Down
2 changes: 1 addition & 1 deletion runtime/oti/vmconstantpool.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -502,7 +502,7 @@ SPDX-License-Identifier: EPL-2.0 OR Apache-2.0 OR GPL-2.0-only WITH Classpath-ex
<!-- Static method references needed to support VirtualThread/Continuation. -->
<staticmethodref class="jdk/internal/vm/Continuation" name="enter" signature="(Ljdk/internal/vm/Continuation;)V" versions="19-"/>
<!-- Security manager check -->
<staticfieldref class="java/lang/System" name="security" signature="Ljava/lang/SecurityManager;"/>
<staticfieldref class="java/lang/System" name="security" signature="Ljava/lang/SecurityManager;" versions="8-23"/>

<!-- VM constants in java -->
<staticfieldref class="com/ibm/oti/vm/VM" name="J9_GC_WRITE_BARRIER_TYPE" signature="I"/>
Expand Down
Loading