|
 |
53c576 |
commit aaf92165ad1cbb1c9818eb60178c91293e13b053
|
|
|
53c576 |
Author: Andrew John Hughes <andrew@openjdk.org>
|
|
|
53c576 |
Date: Mon Jan 24 15:13:14 2022 +0000
|
|
|
53c576 |
|
|
|
53c576 |
RH2021263: Improve Security initialisation, now FIPS support no longer relies on crypto policy support
|
|
|
53c576 |
|
|
|
53c576 |
diff --git openjdk.orig/jdk/src/share/classes/java/security/Security.java openjdk/jdk/src/share/classes/java/security/Security.java
|
|
|
53c576 |
index fa494b680f..b5aa5c749d 100644
|
|
|
53c576 |
--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
|
|
|
53c576 |
+++ openjdk/jdk/src/share/classes/java/security/Security.java
|
|
|
53c576 |
@@ -57,10 +57,6 @@ public final class Security {
|
|
|
53c576 |
private static final Debug sdebug =
|
|
|
53c576 |
Debug.getInstance("properties");
|
|
|
53c576 |
|
|
|
53c576 |
- /* System property file*/
|
|
|
53c576 |
- private static final String SYSTEM_PROPERTIES =
|
|
|
53c576 |
- "/etc/crypto-policies/back-ends/java.config";
|
|
|
53c576 |
-
|
|
|
53c576 |
/* The java.security properties */
|
|
|
53c576 |
private static Properties props;
|
|
|
53c576 |
|
|
|
53c576 |
@@ -202,13 +198,6 @@ public final class Security {
|
|
|
53c576 |
}
|
|
|
53c576 |
}
|
|
|
53c576 |
|
|
|
53c576 |
- String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
|
|
|
53c576 |
- if (disableSystemProps == null &&
|
|
|
53c576 |
- "true".equalsIgnoreCase(props.getProperty
|
|
|
53c576 |
- ("security.useSystemPropertiesFile"))) {
|
|
|
53c576 |
- loadedProps = loadedProps && SystemConfigurator.configure(props);
|
|
|
53c576 |
- }
|
|
|
53c576 |
-
|
|
|
53c576 |
if (!loadedProps) {
|
|
|
53c576 |
initializeStatic();
|
|
|
53c576 |
if (sdebug != null) {
|
|
|
53c576 |
@@ -217,6 +206,28 @@ public final class Security {
|
|
|
53c576 |
}
|
|
|
53c576 |
}
|
|
|
53c576 |
|
|
|
53c576 |
+ String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
|
|
|
53c576 |
+ if ((disableSystemProps == null || "false".equalsIgnoreCase(disableSystemProps)) &&
|
|
|
53c576 |
+ "true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile"))) {
|
|
|
53c576 |
+ if (!SystemConfigurator.configureSysProps(props)) {
|
|
|
53c576 |
+ if (sdebug != null) {
|
|
|
53c576 |
+ sdebug.println("WARNING: System properties could not be loaded.");
|
|
|
53c576 |
+ }
|
|
|
53c576 |
+ }
|
|
|
53c576 |
+ }
|
|
|
53c576 |
+
|
|
|
53c576 |
+ // FIPS support depends on the contents of java.security so
|
|
|
53c576 |
+ // ensure it has loaded first
|
|
|
53c576 |
+ if (loadedProps) {
|
|
|
53c576 |
+ boolean fipsEnabled = SystemConfigurator.configureFIPS(props);
|
|
|
53c576 |
+ if (sdebug != null) {
|
|
|
53c576 |
+ if (fipsEnabled) {
|
|
|
53c576 |
+ sdebug.println("FIPS support enabled.");
|
|
|
53c576 |
+ } else {
|
|
|
53c576 |
+ sdebug.println("FIPS support disabled.");
|
|
|
53c576 |
+ }
|
|
|
53c576 |
+ }
|
|
|
53c576 |
+ }
|
|
|
53c576 |
}
|
|
|
53c576 |
|
|
|
53c576 |
/*
|
|
|
53c576 |
diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
|
|
|
53c576 |
index d1f677597d..7da65b1d2c 100644
|
|
|
53c576 |
--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
|
|
|
53c576 |
+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
|
|
|
53c576 |
@@ -76,7 +76,7 @@ final class SystemConfigurator {
|
|
|
53c576 |
* java.security.disableSystemPropertiesFile property is not set and
|
|
|
53c576 |
* security.useSystemPropertiesFile is true.
|
|
|
53c576 |
*/
|
|
|
53c576 |
- static boolean configure(Properties props) {
|
|
|
53c576 |
+ static boolean configureSysProps(Properties props) {
|
|
|
53c576 |
boolean loadedProps = false;
|
|
|
53c576 |
|
|
|
53c576 |
try (BufferedInputStream bis =
|
|
|
53c576 |
@@ -96,11 +96,19 @@ final class SystemConfigurator {
|
|
|
53c576 |
e.printStackTrace();
|
|
|
53c576 |
}
|
|
|
53c576 |
}
|
|
|
53c576 |
+ return loadedProps;
|
|
|
53c576 |
+ }
|
|
|
53c576 |
+
|
|
|
53c576 |
+ /*
|
|
|
53c576 |
+ * Invoked at the end of java.security.Security initialisation
|
|
|
53c576 |
+ * if java.security properties have been loaded
|
|
|
53c576 |
+ */
|
|
|
53c576 |
+ static boolean configureFIPS(Properties props) {
|
|
|
53c576 |
+ boolean loadedProps = false;
|
|
|
53c576 |
|
|
|
53c576 |
try {
|
|
|
53c576 |
if (enableFips()) {
|
|
|
53c576 |
if (sdebug != null) { sdebug.println("FIPS mode detected"); }
|
|
|
53c576 |
- loadedProps = false;
|
|
|
53c576 |
// Remove all security providers
|
|
|
53c576 |
Iterator<Entry<Object, Object>> i = props.entrySet().iterator();
|
|
|
53c576 |
while (i.hasNext()) {
|