JDK-8269034 : AccessControlException for SunPKCS11 daemon threads
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.crypto:pkcs11
  • Affected Version: 17
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2021-06-18
  • Updated: 2021-12-24
  • Resolved: 2021-06-29
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 17 JDK 18 JDK 8
11.0.14-oracleFixed 17 b29Fixed 18Fixed 8u311Fixed
Related Reports
Relates :  
JDK-8240256 - Better resource cleaning for SunPKCS11 Provider
Description
New resource cleaner thread introduced via JDK-8240256 is lacking sufficient privilege when security manager is present.  

Exception in thread "main" java.security.ProviderException: Initialization failed
        at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:386)
        at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:117)
        at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:114)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:569)
        at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:114)
        at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:257)
        at java.base/sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:248)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
        at java.base/sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:248)
        at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:226)
        at java.base/sun.security.jca.ProviderList.loadAll(ProviderList.java:317)
        at java.base/sun.security.jca.ProviderList.removeInvalid(ProviderList.java:334)
        at java.base/sun.security.jca.Providers.getFullProviderList(Providers.java:175)
        at java.base/java.security.Security.getProviders(Security.java:458)
        at DefaultPKCS11.main(DefaultPKCS11.java:13)
Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "setContextClassLoader")
        at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:485)
        at java.base/java.security.AccessController.checkPermission(AccessController.java:1068)
        at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:416)
        at java.base/java.lang.Thread.setContextClassLoader(Thread.java:1525)
        at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$NativeResourceCleaner.<init>(SunPKCS11.java:982)
        at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.initToken(SunPKCS11.java:1193)
Comments
Fix Request (11u): Should get backported for parity with 11.0.14-oracle. Follow-up for JDK-8269034. Doesn't apply cleanly. Review: https://github.com/openjdk/jdk11u-dev/pull/358
16-09-2021
Changeset: 0d745ae8 Author: Sean Coffey <coffeys@openjdk.org> Date: 2021-06-29 22:52:45 +0000 URL: https://git.openjdk.java.net/jdk17/commit/0d745ae8fde5cab290dc8c695d2906f9a98c491c
29-06-2021
Turns out that the poller thread has always had this issue in SunPKCS11 also: Exception in thread "main" java.security.ProviderException: Initialization failed at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:386) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:117) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11$1.run(SunPKCS11.java:114) at java.base/java.security.AccessController.doPrivileged(AccessController.java:569) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.configure(SunPKCS11.java:114) at MultipleLogins.main(MultipleLogins.java:66) Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "setContextClassLoader") at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:485) at java.base/java.security.AccessController.checkPermission(AccessController.java:1068) at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:416) at java.base/java.lang.Thread.setContextClassLoader(Thread.java:1525) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.createPoller(SunPKCS11.java:947) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.initToken(SunPKCS11.java:1074) at jdk.crypto.cryptoki/sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:377) ... 5 more I reverted back the JDK-8240256 changes in TokenPoller and coaxed the thread to start via minor src edit (issue above seen)
22-06-2021
Thread should be reworked to use InnocuousThread
18-06-2021