Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Mark setting of sun.nio.ch.bugLevel as privileged #5644

Closed
wants to merge 1 commit into from
Closed

Mark setting of sun.nio.ch.bugLevel as privileged #5644

wants to merge 1 commit into from

Conversation

jasontedor
Copy link
Contributor

Motivation:

Writing to a system property requires permissions. Yet the code for
setting sun.nio.ch.bugLevel is not marked as privileged. In a
restrictive environment (e.g., under a security policy that only grants
the requisite permissions the Netty transport jar but not to application
code triggering the Netty initialization), writing to this system
property will not succeed even if the security policy would otherwise
permit it.

Modifications:

This commt marks the necessary code block as privileged. This enables
writing to this system property. The idea is that we are saying the
Netty code is trusted, and as long as the Netty code has been granted
the necessary permissions, then we will allow the caller access to these
resources even though the caller itself might not have the requisite
permissions.

Result:

The system property sun.nio.ch.bugLevel can be written to in a
restrictive security environment.

@jasontedor
Mark setting of sun.nio.ch.bugLevel as privileged
8eb347a 
Motivation:

Writing to a system property requires permissions. Yet the code for
setting sun.nio.ch.bugLevel is not marked as privileged. In a
restrictive environment (e.g., under a security policy that only grants
the requisite permissions the Netty transport jar but not to application
code triggering the Netty initialization), writing to this system
property will not succeed even if the security policy would otherwise
permit it.

Modifications:

This commt marks the necessary code block as privileged. This enables
writing to this system property. The idea is that we are saying the
Netty code is trusted, and as long as the Netty code has been granted
the necessary permissions, then we will allow the caller access to these
resources even though the caller itself might not have the requisite
permissions.

Result:

The system property sun.nio.ch.bugLevel can be written to in a
restrictive security environment.
@jasontedor jasontedor mentioned this pull request Aug 5, 2016
Merged
@normanmaurer normanmaurer self-assigned this Aug 5, 2016
@normanmaurer normanmaurer added this to the 4.0.41.Final milestone Aug 5, 2016
@normanmaurer
Copy link
Member

Cherry-picked into 4.1 (3262907) and 4.0 (7456754)

@jasontedor jasontedor deleted the buglevel-securely branch August 5, 2016 17:01
@jasontedor
Copy link
Contributor Author

Thanks @normanmaurer!

@rdesgroppes rdesgroppes mentioned this pull request Nov 25, 2021
Merged
rdesgroppes added a commit to rdesgroppes/netty that referenced this pull request Nov 25, 2021
@rdesgroppes
Limit workaround on JDK-6427854 to Java <1.7
4e95d10 
Motivation:

The workaround introduced by netty#203 (completed by netty#5644) on bug
[JDK-6427854](https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6427854)
turns out to be no longer applicable since Java 1.7.

Only first few builds of JDK 7 were affected by the bug, which got
fixed in **build 8**. Since JDK 7 was feature complete in
[build 123](https://blogs.oracle.com/java/post/jdk-7-feature-complete),
there's no need to therefore apply the workaround since Java 1.7.

Modifications:

This commit makes sure the workaround (consisting in setting the system
property `sun.nio.ch.bugLevel` to an empty string unless defined)
doesn't get applied when the detected Java version is greater than or
equal to 1.7.

Result:

The workaround gets only applied for Java versions strictly prior to 1.7.

Conditioning the workaround to the Java version will incidentally help
get rid of it when bumping up the minimum JDK support as proposed in
various issues s.a. netty#8259 and netty#8540.
normanmaurer pushed a commit that referenced this pull request Nov 26, 2021
@rdesgroppes
Limit workaround on JDK-6427854 to Java <1.7 (#11863)
6860f32 
Motivation:

The workaround introduced by #203 (completed by #5644) on bug
[JDK-6427854](https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6427854)
turns out to be no longer applicable since Java 1.7.

Only first few builds of JDK 7 were affected by the bug, which got
fixed in **build 8**. Since JDK 7 was feature complete in
[build 123](https://blogs.oracle.com/java/post/jdk-7-feature-complete),
there's no need to therefore apply the workaround since Java 1.7.

Modifications:

This commit makes sure the workaround (consisting in setting the system
property `sun.nio.ch.bugLevel` to an empty string unless defined)
doesn't get applied when the detected Java version is greater than or
equal to 1.7.

Result:

The workaround gets only applied for Java versions strictly prior to 1.7.

Conditioning the workaround to the Java version will incidentally help
get rid of it when bumping up the minimum JDK support as proposed in
various issues s.a. #8259 and #8540.
laosijikaichele pushed a commit to laosijikaichele/netty that referenced this pull request Dec 16, 2021
@rdesgroppes @laosijikaichele
Limit workaround on JDK-6427854 to Java <1.7 (netty#11863)
ea68d3d 
Motivation:

The workaround introduced by netty#203 (completed by netty#5644) on bug
[JDK-6427854](https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6427854)
turns out to be no longer applicable since Java 1.7.

Only first few builds of JDK 7 were affected by the bug, which got
fixed in **build 8**. Since JDK 7 was feature complete in
[build 123](https://blogs.oracle.com/java/post/jdk-7-feature-complete),
there's no need to therefore apply the workaround since Java 1.7.

Modifications:

This commit makes sure the workaround (consisting in setting the system
property `sun.nio.ch.bugLevel` to an empty string unless defined)
doesn't get applied when the detected Java version is greater than or
equal to 1.7.

Result:

The workaround gets only applied for Java versions strictly prior to 1.7.

Conditioning the workaround to the Java version will incidentally help
get rid of it when bumping up the minimum JDK support as proposed in
various issues s.a. netty#8259 and netty#8540.
laosijikaichele pushed a commit to laosijikaichele/netty that referenced this pull request Dec 16, 2021
@rdesgroppes @laosijikaichele
Limit workaround on JDK-6427854 to Java <1.7 (netty#11863)
747a0f5 
Motivation:

The workaround introduced by netty#203 (completed by netty#5644) on bug
[JDK-6427854](https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6427854)
turns out to be no longer applicable since Java 1.7.

Only first few builds of JDK 7 were affected by the bug, which got
fixed in **build 8**. Since JDK 7 was feature complete in
[build 123](https://blogs.oracle.com/java/post/jdk-7-feature-complete),
there's no need to therefore apply the workaround since Java 1.7.

Modifications:

This commit makes sure the workaround (consisting in setting the system
property `sun.nio.ch.bugLevel` to an empty string unless defined)
doesn't get applied when the detected Java version is greater than or
equal to 1.7.

Result:

The workaround gets only applied for Java versions strictly prior to 1.7.

Conditioning the workaround to the Java version will incidentally help
get rid of it when bumping up the minimum JDK support as proposed in
various issues s.a. netty#8259 and netty#8540.
raidyue pushed a commit to raidyue/netty that referenced this pull request Jul 8, 2022
@rdesgroppes
Limit workaround on JDK-6427854 to Java <1.7 (netty#11863)
94f7455 
Motivation:

The workaround introduced by netty#203 (completed by netty#5644) on bug
[JDK-6427854](https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6427854)
turns out to be no longer applicable since Java 1.7.

Only first few builds of JDK 7 were affected by the bug, which got
fixed in **build 8**. Since JDK 7 was feature complete in
[build 123](https://blogs.oracle.com/java/post/jdk-7-feature-complete),
there's no need to therefore apply the workaround since Java 1.7.

Modifications:

This commit makes sure the workaround (consisting in setting the system
property `sun.nio.ch.bugLevel` to an empty string unless defined)
doesn't get applied when the detected Java version is greater than or
equal to 1.7.

Result:

The workaround gets only applied for Java versions strictly prior to 1.7.

Conditioning the workaround to the Java version will incidentally help
get rid of it when bumping up the minimum JDK support as proposed in
various issues s.a. netty#8259 and netty#8540.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@normanmaurer normanmaurer

Labels
improvement
Projects
None yet
Milestone
4.0.41.Final
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@jasontedor @normanmaurer