b267c4cf63
- Update to jdk-17+35, also known as jdk-17-ga. - Remove boot JDKs in favour of OpenJDK 17 build now in the buildroot. - Update buildjdkver to 17 so as to build with itself - Add possibility to disable system crypto policy - Add PR3695 to allow the system crypto policy to be turned off - Re-enable TestSecurityProperties after inclusion of PR3695 - Added gating.yaml - Fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics. - Remove restriction on disabling product build, as debug packages no longer have javadoc packages. - Update to jdk-17+33, including JDWP fix and July 2021 CPU - Support the FIPS mode crypto policy (RH1655466) - Update RH1655466 FIPS patch with changes in OpenJDK 8 version. - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. - No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable. - Disable FIPS mode support unless com.redhat.fips is set to "true". - Use appropriate keystore types when in FIPS mode (RH1818909) - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). - Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986) - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071) - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library. - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure. - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM. - Add patch to disable non-FIPS crypto in the SUN and SunEC security providers. - Add patch to login to the NSS software token when in FIPS mode. - Fix unused function compiler warning found in systemconf.c - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access. - Add JDK-8272332 fix so we actually link against HarfBuzz. - Update release notes to document the major changes between OpenJDK 11 & 17. - Add FIPS patch to allow plain key import. - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false - Patch syslookup.c so it actually has some code to be compiled into libsyslookup - alternatives creation moved to posttrans - Set LTS designator on RHEL, but not Fedora or EPEL. Related: RHEL-45216
89 lines
3.3 KiB
Diff
89 lines
3.3 KiB
Diff
|
|
# HG changeset patch
|
|
# User andrew
|
|
# Date 1478057514 0
|
|
# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c
|
|
# Parent 3d53f19b48384e5252f4ec8891f7a3a82d77af2a
|
|
PR3183: Support Fedora/RHEL system crypto policy
|
|
diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/classes/java/security/Security.java
|
|
--- a/src/java.base/share/classes/java/security/Security.java Wed Oct 26 03:51:39 2016 +0100
|
|
+++ b/src/java.base/share/classes/java/security/Security.java Wed Nov 02 03:31:54 2016 +0000
|
|
@@ -43,6 +43,9 @@
|
|
* implementation-specific location, which is typically the properties file
|
|
* {@code conf/security/java.security} in the Java installation directory.
|
|
*
|
|
+ * <p>Additional default values of security properties are read from a
|
|
+ * system-specific location, if available.</p>
|
|
+ *
|
|
* @author Benjamin Renaud
|
|
* @since 1.1
|
|
*/
|
|
@@ -52,6 +55,10 @@
|
|
private static final Debug sdebug =
|
|
Debug.getInstance("properties");
|
|
|
|
+ /* System property file*/
|
|
+ private static final String SYSTEM_PROPERTIES =
|
|
+ "/etc/crypto-policies/back-ends/java.config";
|
|
+
|
|
/* The java.security properties */
|
|
private static Properties props;
|
|
|
|
@@ -93,6 +100,7 @@
|
|
if (sdebug != null) {
|
|
sdebug.println("reading security properties file: " +
|
|
propFile);
|
|
+ sdebug.println(props.toString());
|
|
}
|
|
} catch (IOException e) {
|
|
if (sdebug != null) {
|
|
@@ -114,6 +122,31 @@
|
|
}
|
|
|
|
if ("true".equalsIgnoreCase(props.getProperty
|
|
+ ("security.useSystemPropertiesFile"))) {
|
|
+
|
|
+ // now load the system file, if it exists, so its values
|
|
+ // will win if they conflict with the earlier values
|
|
+ try (BufferedInputStream bis =
|
|
+ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
|
|
+ props.load(bis);
|
|
+ loadedProps = true;
|
|
+
|
|
+ if (sdebug != null) {
|
|
+ sdebug.println("reading system security properties file " +
|
|
+ SYSTEM_PROPERTIES);
|
|
+ sdebug.println(props.toString());
|
|
+ }
|
|
+ } catch (IOException e) {
|
|
+ if (sdebug != null) {
|
|
+ sdebug.println
|
|
+ ("unable to load security properties from " +
|
|
+ SYSTEM_PROPERTIES);
|
|
+ e.printStackTrace();
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+
|
|
+ if ("true".equalsIgnoreCase(props.getProperty
|
|
("security.overridePropertiesFile"))) {
|
|
|
|
String extraPropFile = System.getProperty
|
|
diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/conf/security/java.security
|
|
--- a/src/java.base/share/conf/security/java.security Wed Oct 26 03:51:39 2016 +0100
|
|
+++ b/src/java.base/share/conf/security/java.security Wed Nov 02 03:31:54 2016 +0000
|
|
@@ -276,6 +276,13 @@
|
|
security.overridePropertiesFile=true
|
|
|
|
#
|
|
+# Determines whether this properties file will be appended to
|
|
+# using the system properties file stored at
|
|
+# /etc/crypto-policies/back-ends/java.config
|
|
+#
|
|
+security.useSystemPropertiesFile=true
|
|
+
|
|
+#
|
|
# Determines the default key and trust manager factory algorithms for
|
|
# the javax.net.ssl package.
|
|
#
|