Bug ID: JDK-6512054 SUBJECTDOMAINCOMBINER DOES NOT COMBINE CODE-BASED GRANTS IN JAAS MODE

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

Other	Other	JDK 6	JDK 7
1.4.2_17-revFixed	1.4.2_18Fixed	6u2Fixed	7 b07Fixed

This bug does not manifest itself with default settings as the bug is in SubjectDomainCombiner.combineJavaxPolicy (i.e. when JAAS policy provider is set).

The main issue is that when combineJavaxPolicy creates the new ProtectionDomains, it fails to take code-based grants into consideration. This was not an issue in JDK1.3 as SecureClassLoader sets static (code-based) Permissions at load time (thus ProtectionDomain.getPermissions() + javax.security.auth.Policy.getPolicy().getPermissions() would suffice), but with dynamic policy support in JDK1.4 we now have an issue as [1] ProtectionDomain.getPermissions() by default returns an empty PermisisonCollection instance and [2] javax.security.auth.Policy.getPolicy().getPermissions() only evaluates principal-based grants [3] combineJavaxPolicy constructs ProtectionDomain instances using the 2-arg argument(i.e. staticPermissions field would be set to true), so when AccessControlContext calls ProtectionDomain.implies (in AccessControlContext.checkPermission) the Policy is not consulted at all.

The net effect is that code-based grants (even 'universal grants' that apply to all code sources and principals) are ignored during the combination process.

  To reproduce this, simply set JAAS policy provider and then add a 'universal grant' to the effective java.policy, then in the test code perform a Subject.doAsPrivileged (or Subject.doAs) with a AccessController.checkPermission for the aforementioned 'universal grant'. The checkPermission call will pass by default (using Java2 provider) and fail when JAAS policy provider is set.