Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ForkJoinPool threads - enable Permission support for SM. #28

Closed
pfirmstone opened this issue Dec 4, 2024 · 3 comments
Closed

ForkJoinPool threads - enable Permission support for SM. #28

pfirmstone opened this issue Dec 4, 2024 · 3 comments

Comments

@pfirmstone
Copy link
Owner

ForkJoinPool's worker threads have no permissions when run with SecurityManager enabled, this would have made sense with the poor performance of the Policy provider implementation, however this means it's not possible to grant LoadClassPermission or SerialObjectPermission.

CombinerSecurityManager has a non blocking cache, storing the AccessControlContext permission result means that repeated permission checks don't occur.

@pfirmstone
Copy link
Owner Author

Note the common pool and default ForkJoinWorkerThreadFactory will remain unchanged, with no permissions, any worker tasks submitted to the common pool will be unable to load classes (from jar files that haven't yet loaded) or perform serialization etc.

@pfirmstone
Copy link
Owner Author

Working on solving test failures in jtreg:test/jdk/java/util/concurrent/tck/JSR166TestCase.java

I've found that relying on a provider for permission checks is not a good idea, as failure to resolve the provider can be difficult to diagnose, with missing permissions. ForkJoinPool worker threads are impacted by LoadClassPermission and SerialObjectPermission as these cannot obtain privileges by policy.

@pfirmstone
Copy link
Owner Author

Note this also includes fixes to ForkJoinPool tests that failed due to the introduction of LoadClassPermission and SerialObjectPermission.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant