| Other |
|---|
| jfx24 b16Fixed |
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
Blocks :
|
|
|
CSR :
|
|
|
Relates :
|
|
|
Relates :
|
|
|
Relates :
|
|
|
Relates :
|
|
|
Relates :
|
|
|
Relates :
|
|
JDK-8342628 :
|
Remove support for running JavaFX applications with a security manager.
The Java Security Manager was deprecated for removal in JDK 17 by JEP 411 [1]. It will be permanently disabled soon, possibly in JDK 24, as proposed by candidate JEP 486 [2]. Once this is done, System::getSecurityManager will unconditionally return null, System::setSecurityManager will unconditionally throw UnsupportedOperationException, and running "java -Dsecurity.manager" will cause the VM to exit with a fatal error.
Initial work needed to implement this:
* Fail fast at startup if the Security Manager is enabled
* Remove -Djava.security.manager and all security policy files
* Delete all tests that depend on the Security Manager; some might have value as functional tests, so could be reworked instead of removed.
* API spec change to remove mention of security manager (including mention of throwing SecurityException)
I will file additional JBS issues to track follow-up work to cleanup the remaining calls to the security manager methods that are deprecated for removal. The follow-up work can be done independently of the timing of the integration of JEP 486 into JDK 24.
Follow-on issues for JavaFX 24:
* Remove all calls to doPrivileged (there are 350 such calls in 168 files)
* Remove all other calls to AccessController (48 calls in 33 files)
* Remove all remaining calls to System::getSecurityManager (45 calls in 27 files)
* Remove calls to deprecated SM methods from PlatformUtil and MethodUtil in javafx.base (these are lightly modified copies of those classes in java.base so I will check how they are being handled)
* Remove all uses (either throw or catch) of the deprecated AccessControlException : : 4 occurrences in 4 files
* Remove all occurrences where we throw a SecurityException; check all place where we catch it (and consider whether it is needed)
* Check and remove any remaining usages of other SM methods that are deprecated for removal by JEP 411
* SecurityManager 2 files (in addition to the ones that call getSecurityManager)
* AccessControlContext: 169 occurrences in 65 files (many are associated with doPriviliged calls, so should be rechecked once doPriv is removed)
* Utility method for fail fast SM check (if we keep the check, else remove it)
NOTE: I had earlier thought that the "fail fast" could be temporary until all follow-up work is done, but I now think we should leave it in for JavaFX 24, possibly adding it to two other classes -- ReflectUtil and MethodUtil -- depending on the follow-up work needed for those classes. If we do end up leaving it, I'll create a utility method in javafx.base that will use reflection to check whether the security manager is enabled, so we don't leave in a call to a method (System::getSecurityManager) that is deprecated for removal.
We might also file additional follow-up issues, not necessarily targeted for JavaFX 24:
* Consider deprecating for removal the following security-related APIs in JavaFX
* FXPermission (this PR changes the spec to make it clear that it is no longer used to control access to resources)
* WebErrorEvent.USER_DATA_DIRECTORY_SECURITY_ERROR (if there is no other use than to report a SecurityException that can no longer happen after the security manager is removed)
[1] https://openjdk.org/jeps/411
[2] https://openjdk.org/jeps/486
|