From 9a3935f9ea14e3e53608c5e69e3461550a570bbf Mon Sep 17 00:00:00 2001
From: Andrew Hughes <gnu.andrew@redhat.com>
Date: Tue, 18 Jan 2022 02:21:22 +0000
Subject: [PATCH] Fix FIPS issues in native code and with initialisation of
 java.security.Security

---
 java-11-openjdk.spec                          | 10 ++++++-
 ...263-fips_ensure_security_initialised.patch | 28 +++++++++++++++++++
 rh2021263-fips_missing_native_returns.patch   | 24 ++++++++++++++++
 3 files changed, 61 insertions(+), 1 deletion(-)
 create mode 100644 rh2021263-fips_ensure_security_initialised.patch
 create mode 100644 rh2021263-fips_missing_native_returns.patch

diff --git a/java-11-openjdk.spec b/java-11-openjdk.spec
index 2fdb995..a346ef6 100644
--- a/java-11-openjdk.spec
+++ b/java-11-openjdk.spec
@@ -345,7 +345,7 @@
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
 %global buildver        8
-%global rpmrelease      1
+%global rpmrelease      2
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -1239,6 +1239,9 @@ Patch1008: rh1929465-improve_system_FIPS_detection.patch
 Patch1009: rh1996182-login_to_nss_software_token.patch
 # RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false
 Patch1011: rh1991003-enable_fips_keys_import.patch
+# RH2021263: Resolve outstanding FIPS issues
+Patch1014: rh2021263-fips_ensure_security_initialised.patch
+Patch1015: rh2021263-fips_missing_native_returns.patch
 
 #############################################
 #
@@ -1676,6 +1679,8 @@ popd # openjdk
 %patch1008
 %patch1009
 %patch1011
+%patch1014
+%patch1015
 
 # Extract systemtap tapsets
 %if %{with_systemtap}
@@ -2469,6 +2474,9 @@ end
 %endif
 
 %changelog
+* Tue Jan 18 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.2.ea
+- Fix FIPS issues in native code and with initialisation of java.security.Security
+
 * Mon Jan 17 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
 - Sync gdb test with java-1.8.0-openjdk and disable for now until gdb is fixed.
 
diff --git a/rh2021263-fips_ensure_security_initialised.patch b/rh2021263-fips_ensure_security_initialised.patch
new file mode 100644
index 0000000..9490624
--- /dev/null
+++ b/rh2021263-fips_ensure_security_initialised.patch
@@ -0,0 +1,28 @@
+commit 8a8452b9ae862755210a9a2f4e34b1aa3ec7343d
+Author: Andrew Hughes <gnu.andrew@redhat.com>
+Date:   Tue Jan 18 02:00:55 2022 +0000
+
+    RH2021263: Make sure java.security.Security is initialised when retrieving JavaSecuritySystemConfiguratorAccess instance
+
+diff --git openjdk.orig/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java openjdk/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java
+index 2ec51d57806..8489b940c43 100644
+--- openjdk.orig/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java
++++ openjdk/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java
+@@ -36,6 +36,7 @@ import java.io.FilePermission;
+ import java.io.ObjectInputStream;
+ import java.io.RandomAccessFile;
+ import java.security.ProtectionDomain;
++import java.security.Security;
+ import java.security.Signature;
+ 
+ /** A repository of "shared secrets", which are a mechanism for
+@@ -368,6 +369,9 @@ public class SharedSecrets {
+     }
+ 
+     public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
++        if (javaSecuritySystemConfiguratorAccess == null) {
++            unsafe.ensureClassInitialized(Security.class);
++        }
+         return javaSecuritySystemConfiguratorAccess;
+     }
+ }
diff --git a/rh2021263-fips_missing_native_returns.patch b/rh2021263-fips_missing_native_returns.patch
new file mode 100644
index 0000000..b8c8ba5
--- /dev/null
+++ b/rh2021263-fips_missing_native_returns.patch
@@ -0,0 +1,24 @@
+commit 1b5bd349bdfa7b9627ea58d819bc250a55112de2
+Author: Fridrich Strba <fstrba@suse.com>
+Date:   Mon Jan 17 19:44:03 2022 +0000
+
+    RH2021263: Return in C code after having generated Java exception
+
+diff --git openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
+index 6f4656bfcb6..34d0ff0ce91 100644
+--- openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c
++++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
+@@ -131,11 +131,13 @@ JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEn
+     dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
+     if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
+         throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
++        return JNI_FALSE;
+     }
+     fips_enabled = fgetc(fe);
+     fclose(fe);
+     if (fips_enabled == EOF) {
+         throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
++        return JNI_FALSE;
+     }
+     msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
+             " read character is '%c'", fips_enabled);