b267c4cf63
- Update to jdk-17+35, also known as jdk-17-ga. - Remove boot JDKs in favour of OpenJDK 17 build now in the buildroot. - Update buildjdkver to 17 so as to build with itself - Add possibility to disable system crypto policy - Add PR3695 to allow the system crypto policy to be turned off - Re-enable TestSecurityProperties after inclusion of PR3695 - Added gating.yaml - Fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics. - Remove restriction on disabling product build, as debug packages no longer have javadoc packages. - Update to jdk-17+33, including JDWP fix and July 2021 CPU - Support the FIPS mode crypto policy (RH1655466) - Update RH1655466 FIPS patch with changes in OpenJDK 8 version. - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. - No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable. - Disable FIPS mode support unless com.redhat.fips is set to "true". - Use appropriate keystore types when in FIPS mode (RH1818909) - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). - Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986) - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071) - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library. - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure. - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM. - Add patch to disable non-FIPS crypto in the SUN and SunEC security providers. - Add patch to login to the NSS software token when in FIPS mode. - Fix unused function compiler warning found in systemconf.c - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access. - Add JDK-8272332 fix so we actually link against HarfBuzz. - Update release notes to document the major changes between OpenJDK 11 & 17. - Add FIPS patch to allow plain key import. - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false - Patch syslookup.c so it actually has some code to be compiled into libsyslookup - alternatives creation moved to posttrans - Set LTS designator on RHEL, but not Fedora or EPEL. Related: RHEL-45216
71 lines
3.0 KiB
Diff
71 lines
3.0 KiB
Diff
diff --git openjdk/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java
|
|
index f1633afb627..ce32c939253 100644
|
|
--- openjdk/src/java.base/share/classes/java/security/Security.java
|
|
+++ openjdk/src/java.base/share/classes/java/security/Security.java
|
|
@@ -32,6 +32,7 @@ import java.net.URL;
|
|
|
|
import jdk.internal.event.EventHelper;
|
|
import jdk.internal.event.SecurityPropertyModificationEvent;
|
|
+import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
|
|
import jdk.internal.access.SharedSecrets;
|
|
import jdk.internal.util.StaticProperty;
|
|
import sun.security.util.Debug;
|
|
@@ -74,6 +75,15 @@ public final class Security {
|
|
}
|
|
|
|
static {
|
|
+ // Initialise here as used by code with system properties disabled
|
|
+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
|
|
+ new JavaSecuritySystemConfiguratorAccess() {
|
|
+ @Override
|
|
+ public boolean isSystemFipsEnabled() {
|
|
+ return SystemConfigurator.isSystemFipsEnabled();
|
|
+ }
|
|
+ });
|
|
+
|
|
// doPrivileged here because there are multiple
|
|
// things in initialize that might require privs.
|
|
// (the FileInputStream call and the File.exists call,
|
|
@@ -194,9 +204,8 @@ public final class Security {
|
|
}
|
|
|
|
String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
|
|
- if (disableSystemProps == null &&
|
|
- "true".equalsIgnoreCase(props.getProperty
|
|
- ("security.useSystemPropertiesFile"))) {
|
|
+ if ((disableSystemProps == null || "false".equalsIgnoreCase(disableSystemProps)) &&
|
|
+ "true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile"))) {
|
|
if (SystemConfigurator.configure(props)) {
|
|
loadedProps = true;
|
|
}
|
|
diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
|
|
index 60fa75cab45..10b54aa4ce4 100644
|
|
--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
|
|
+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
|
|
@@ -38,8 +38,6 @@ import java.util.Map.Entry;
|
|
import java.util.Properties;
|
|
import java.util.regex.Pattern;
|
|
|
|
-import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
|
|
-import jdk.internal.access.SharedSecrets;
|
|
import sun.security.util.Debug;
|
|
|
|
/**
|
|
@@ -65,16 +63,6 @@ final class SystemConfigurator {
|
|
|
|
private static boolean systemFipsEnabled = false;
|
|
|
|
- static {
|
|
- SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
|
|
- new JavaSecuritySystemConfiguratorAccess() {
|
|
- @Override
|
|
- public boolean isSystemFipsEnabled() {
|
|
- return SystemConfigurator.isSystemFipsEnabled();
|
|
- }
|
|
- });
|
|
- }
|
|
-
|
|
/*
|
|
* Invoked when java.security.Security class is initialized, if
|
|
* java.security.disableSystemPropertiesFile property is not set and
|