Skip to content

Commit 032ea80

Browse files
Prevent 'sun.security.util.Debug' from being reachable.
Suppress deprecation warnings. Fix review feedback
1 parent 5fed797 commit 032ea80

File tree

8 files changed

+381
-209
lines changed

8 files changed

+381
-209
lines changed

sdk/src/org.graalvm.nativeimage/src/org/graalvm/nativeimage/impl/ProcessPropertiesSupport.java

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2021, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2020, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* The Universal Permissive License (UPL), Version 1.0
@@ -45,9 +45,7 @@
4545
import org.graalvm.nativeimage.c.function.CEntryPointLiteral;
4646

4747
public interface ProcessPropertiesSupport {
48-
default String getExecutableName() {
49-
return "java";
50-
}
48+
String getExecutableName();
5149

5250
long getProcessID();
5351

substratevm/src/com.oracle.svm.core/src/com/oracle/svm/core/hub/DynamicHub.java

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2012, 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2012, 2021, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -55,13 +55,16 @@
5555
import java.util.Set;
5656
import java.util.StringJoiner;
5757

58+
import com.oracle.svm.core.BaseProcessPropertiesSupport;
5859
import org.graalvm.compiler.core.common.NumUtil;
5960
import org.graalvm.compiler.core.common.SuppressFBWarnings;
6061
import org.graalvm.compiler.serviceprovider.JavaVersionUtil;
62+
import org.graalvm.nativeimage.ImageSingletons;
6163
import org.graalvm.nativeimage.Platform;
6264
import org.graalvm.nativeimage.Platforms;
6365
import org.graalvm.nativeimage.ProcessProperties;
6466
import org.graalvm.nativeimage.c.function.CFunctionPointer;
67+
import org.graalvm.nativeimage.impl.ProcessPropertiesSupport;
6568
import org.graalvm.util.DirectAnnotationAccess;
6669

6770
import com.oracle.svm.core.RuntimeAssertionsSupport;
@@ -327,23 +330,25 @@ public void setModule(Object module) {
327330
}
328331

329332
/**
330-
* Final fields in subsituted classes are treated as implicitly RecomputeFieldValue even when
333+
* Final fields in substituted classes are treated as implicitly RecomputeFieldValue even when
331334
* not annotated with @RecomputeFieldValue. Their name must not match a field in the original
332335
* class, i.e., allPermDomain.
333336
*/
334337
static final LazyFinalReference<java.security.ProtectionDomain> allPermDomainReference = new LazyFinalReference<>(() -> {
335338
java.security.Permissions perms = new java.security.Permissions();
336339
perms.add(SecurityConstants.ALL_PERMISSION);
337-
CodeSource cs;
338-
try {
340+
CodeSource cs = null;
341+
342+
if (ImageSingletons.lookup(ProcessPropertiesSupport.class) instanceof BaseProcessPropertiesSupport) {
339343
// Try to use executable image's name as code source for the class.
340344
// The file location can be used by Java code to determine its location on disk, similar
341345
// to argv[0].
342-
cs = new CodeSource(new File(ProcessProperties.getExecutableName()).toURI().toURL(), (Certificate[]) null);
343-
} catch (MalformedURLException ex) {
344-
// This should not really happen; the file is cannonicalized, absolute, so it should
345-
// always have file:// URL.
346-
cs = null;
346+
try {
347+
cs = new CodeSource(new File(ProcessProperties.getExecutableName()).toURI().toURL(), (Certificate[]) null);
348+
} catch (MalformedURLException e) {
349+
// This should not really happen; the file is cannonicalized, absolute, so it should
350+
// always have file:// URL.
351+
}
347352
}
348353
return new java.security.ProtectionDomain(cs, perms);
349354
});
Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
/*
2+
* Copyright (c) 2021, 2021, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
package com.oracle.svm.core.jdk;
26+
27+
import com.oracle.svm.core.threadlocal.FastThreadLocalFactory;
28+
import com.oracle.svm.core.threadlocal.FastThreadLocalObject;
29+
import com.oracle.svm.core.util.VMError;
30+
import com.oracle.svm.util.ReflectionUtil;
31+
import org.graalvm.compiler.serviceprovider.JavaVersionUtil;
32+
33+
import java.security.AccessControlContext;
34+
import java.security.PrivilegedActionException;
35+
import java.security.ProtectionDomain;
36+
import java.util.ArrayDeque;
37+
import java.util.Objects;
38+
39+
/**
40+
* Stack for storing AccessControlContexts. Used in conjunction with
41+
* {@code StackAccessControlContextVisitor}.
42+
*/
43+
class PrivilegedStack {
44+
45+
public static class StackElement {
46+
protected AccessControlContext context;
47+
protected Class<?> caller;
48+
49+
StackElement(AccessControlContext context, Class<?> caller) {
50+
this.context = context;
51+
this.caller = caller;
52+
}
53+
54+
public AccessControlContext getContext() {
55+
return context;
56+
}
57+
58+
public Class<?> getCaller() {
59+
return caller;
60+
}
61+
}
62+
63+
/* Local AccessControlContext stack */
64+
private static final FastThreadLocalObject<ArrayDeque<StackElement>> stack;
65+
66+
static {
67+
68+
@SuppressWarnings("unchecked")
69+
Class<ArrayDeque<StackElement>> cls = (Class<ArrayDeque<StackElement>>) (Object) ArrayDeque.class;
70+
stack = FastThreadLocalFactory.createObject(cls, "AccessControlContextStack");
71+
}
72+
73+
@SuppressWarnings("unchecked")
74+
private static ArrayDeque<StackElement> getStack() {
75+
ensureInitialized();
76+
return stack.get();
77+
}
78+
79+
private static void ensureInitialized() {
80+
if (stack.get() == null) {
81+
ArrayDeque<StackElement> tmp = new ArrayDeque<>();
82+
stack.set(tmp);
83+
}
84+
}
85+
86+
public static void push(AccessControlContext context, Class<?> caller) {
87+
getStack().push(new StackElement(context, caller));
88+
}
89+
90+
public static void pop() {
91+
getStack().pop();
92+
}
93+
94+
public static AccessControlContext peekContext() {
95+
return Objects.requireNonNull(getStack().peek()).getContext();
96+
}
97+
98+
public static Class<?> peekCaller() {
99+
return Objects.requireNonNull(getStack().peek()).getCaller();
100+
}
101+
102+
public static int length() {
103+
return getStack().size();
104+
}
105+
}
106+
107+
@InternalVMMethod
108+
@SuppressWarnings({"unused"})
109+
public class AccessControllerUtil {
110+
111+
/**
112+
* Instance that is used to mark contexts that were disallowed in
113+
* {@code AccessControlContextReplacerFeature.replaceAccessControlContext()} If this marker is
114+
* passed to {@code AccessController.doPrivileged()} a runtime error will be thrown.
115+
*/
116+
public static final AccessControlContext DISALLOWED_CONTEXT_MARKER;
117+
118+
static {
119+
try {
120+
DISALLOWED_CONTEXT_MARKER = ReflectionUtil.lookupConstructor(AccessControlContext.class, ProtectionDomain[].class, boolean.class).newInstance(new ProtectionDomain[0], true);
121+
} catch (ReflectiveOperationException ex) {
122+
throw VMError.shouldNotReachHere(ex);
123+
}
124+
}
125+
126+
static Throwable wrapCheckedException(Throwable ex) {
127+
if (ex instanceof Exception && !(ex instanceof RuntimeException)) {
128+
return new PrivilegedActionException((Exception) ex);
129+
} else {
130+
return ex;
131+
}
132+
}
133+
134+
static Throwable wrapCheckedExceptionForPrivilegedAction(Throwable ex) {
135+
if (JavaVersionUtil.JAVA_SPEC <= 11) {
136+
return wrapCheckedException(ex);
137+
}
138+
return ex;
139+
}
140+
}

0 commit comments

Comments
 (0)