b267c4cf63
- Update to jdk-17+35, also known as jdk-17-ga. - Remove boot JDKs in favour of OpenJDK 17 build now in the buildroot. - Update buildjdkver to 17 so as to build with itself - Add possibility to disable system crypto policy - Add PR3695 to allow the system crypto policy to be turned off - Re-enable TestSecurityProperties after inclusion of PR3695 - Added gating.yaml - Fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics. - Remove restriction on disabling product build, as debug packages no longer have javadoc packages. - Update to jdk-17+33, including JDWP fix and July 2021 CPU - Support the FIPS mode crypto policy (RH1655466) - Update RH1655466 FIPS patch with changes in OpenJDK 8 version. - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. - No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable. - Disable FIPS mode support unless com.redhat.fips is set to "true". - Use appropriate keystore types when in FIPS mode (RH1818909) - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). - Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986) - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071) - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library. - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure. - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM. - Add patch to disable non-FIPS crypto in the SUN and SunEC security providers. - Add patch to login to the NSS software token when in FIPS mode. - Fix unused function compiler warning found in systemconf.c - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access. - Add JDK-8272332 fix so we actually link against HarfBuzz. - Update release notes to document the major changes between OpenJDK 11 & 17. - Add FIPS patch to allow plain key import. - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false - Patch syslookup.c so it actually has some code to be compiled into libsyslookup - alternatives creation moved to posttrans - Set LTS designator on RHEL, but not Fedora or EPEL. Related: RHEL-45216
118 lines
4.1 KiB
Diff
118 lines
4.1 KiB
Diff
diff --git openjdk.orig/make/modules/java.base/Launcher.gmk openjdk/make/modules/java.base/Launcher.gmk
|
|
index 700ddefda49..2882de68eb2 100644
|
|
--- openjdk.orig/make/modules/java.base/Launcher.gmk
|
|
+++ openjdk/make/modules/java.base/Launcher.gmk
|
|
@@ -41,6 +41,14 @@ $(eval $(call SetupBuildLauncher, java, \
|
|
OPTIMIZATION := HIGH, \
|
|
))
|
|
|
|
+#Wno-error=cpp is present to allow commented warning in ifdef part of main.c
|
|
+$(eval $(call SetupBuildLauncher, alt-java, \
|
|
+ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA -Wno-error=cpp, \
|
|
+ EXTRA_RCFLAGS := $(JAVA_RCFLAGS), \
|
|
+ VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \
|
|
+ OPTIMIZATION := HIGH, \
|
|
+))
|
|
+
|
|
ifeq ($(call isTargetOs, windows), true)
|
|
$(eval $(call SetupBuildLauncher, javaw, \
|
|
CFLAGS := -DJAVAW -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \
|
|
diff --git openjdk.orig/src/java.base/share/native/launcher/alt_main.h openjdk/src/java.base/share/native/launcher/alt_main.h
|
|
new file mode 100644
|
|
index 00000000000..697df2898ac
|
|
--- /dev/null
|
|
+++ openjdk/src/java.base/share/native/launcher/alt_main.h
|
|
@@ -0,0 +1,73 @@
|
|
+/*
|
|
+ * Copyright (c) 2019, Red Hat, Inc. All rights reserved.
|
|
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
+ *
|
|
+ * This code is free software; you can redistribute it and/or modify it
|
|
+ * under the terms of the GNU General Public License version 2 only, as
|
|
+ * published by the Free Software Foundation. Oracle designates this
|
|
+ * particular file as subject to the "Classpath" exception as provided
|
|
+ * by Oracle in the LICENSE file that accompanied this code.
|
|
+ *
|
|
+ * This code is distributed in the hope that it will be useful, but WITHOUT
|
|
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
+ * version 2 for more details (a copy is included in the LICENSE file that
|
|
+ * accompanied this code).
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License version
|
|
+ * 2 along with this work; if not, write to the Free Software Foundation,
|
|
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
+ *
|
|
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
+ * or visit www.oracle.com if you need additional information or have any
|
|
+ * questions.
|
|
+ */
|
|
+
|
|
+#ifdef REDHAT_ALT_JAVA
|
|
+
|
|
+#include <sys/prctl.h>
|
|
+
|
|
+
|
|
+/* Per task speculation control */
|
|
+#ifndef PR_GET_SPECULATION_CTRL
|
|
+# define PR_GET_SPECULATION_CTRL 52
|
|
+#endif
|
|
+#ifndef PR_SET_SPECULATION_CTRL
|
|
+# define PR_SET_SPECULATION_CTRL 53
|
|
+#endif
|
|
+/* Speculation control variants */
|
|
+#ifndef PR_SPEC_STORE_BYPASS
|
|
+# define PR_SPEC_STORE_BYPASS 0
|
|
+#endif
|
|
+/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
|
|
+
|
|
+#ifndef PR_SPEC_NOT_AFFECTED
|
|
+# define PR_SPEC_NOT_AFFECTED 0
|
|
+#endif
|
|
+#ifndef PR_SPEC_PRCTL
|
|
+# define PR_SPEC_PRCTL (1UL << 0)
|
|
+#endif
|
|
+#ifndef PR_SPEC_ENABLE
|
|
+# define PR_SPEC_ENABLE (1UL << 1)
|
|
+#endif
|
|
+#ifndef PR_SPEC_DISABLE
|
|
+# define PR_SPEC_DISABLE (1UL << 2)
|
|
+#endif
|
|
+#ifndef PR_SPEC_FORCE_DISABLE
|
|
+# define PR_SPEC_FORCE_DISABLE (1UL << 3)
|
|
+#endif
|
|
+#ifndef PR_SPEC_DISABLE_NOEXEC
|
|
+# define PR_SPEC_DISABLE_NOEXEC (1UL << 4)
|
|
+#endif
|
|
+
|
|
+static void set_speculation() __attribute__((constructor));
|
|
+static void set_speculation() {
|
|
+ if ( prctl(PR_SET_SPECULATION_CTRL,
|
|
+ PR_SPEC_STORE_BYPASS,
|
|
+ PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) {
|
|
+ return;
|
|
+ }
|
|
+ prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
|
|
+}
|
|
+
|
|
+#endif // REDHAT_ALT_JAVA
|
|
diff --git openjdk.orig/src/java.base/share/native/launcher/main.c openjdk/src/java.base/share/native/launcher/main.c
|
|
index b734fe2ba78..79dc8307650 100644
|
|
--- openjdk.orig/src/java.base/share/native/launcher/main.c
|
|
+++ openjdk/src/java.base/share/native/launcher/main.c
|
|
@@ -34,6 +34,14 @@
|
|
#include "jli_util.h"
|
|
#include "jni.h"
|
|
|
|
+#ifdef REDHAT_ALT_JAVA
|
|
+#if defined(__linux__) && defined(__x86_64__)
|
|
+#include "alt_main.h"
|
|
+#else
|
|
+#warning alt-java requested but SSB mitigation not available on this platform.
|
|
+#endif
|
|
+#endif
|
|
+
|
|
#ifdef _MSC_VER
|
|
#if _MSC_VER > 1400 && _MSC_VER < 1600
|
|
|