8261534: Test sun/security/pkcs11/KeyAgreement/IllegalPackageAccess.java fails on platforms where no nsslib artifacts are defined

[RealCLanger]

Fix exception in test sun/security/pkcs11/KeyAgreement/IllegalPackageAccess.java:

java.security.AccessControlException: access denied ("java.security.SecurityPermission" "removeProvider.SUN")
at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
at java.base/java.security.AccessController.checkPermission(AccessController.java:1036)
at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:408)
at java.base/java.lang.SecurityManager.checkSecurityAccess(SecurityManager.java:1521)
at java.base/java.security.Security.check(Security.java:832)
at java.base/java.security.Security.removeProvider(Security.java:444)
at IllegalPackageAccess.main(IllegalPackageAccess.java:81)
at PKCS11Test.premain(PKCS11Test.java:171)
at PKCS11Test.testNSS(PKCS11Test.java:568)
at PKCS11Test.main(PKCS11Test.java:207)
at IllegalPackageAccess.main(IllegalPackageAccess.java:69)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:78)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at com.sun.javatest.regtest.agent.MainWrapper$MainThread.run(MainWrapper.java:127)
at java.base/java.lang.Thread.run(Thread.java:831)

Root cause is that the test materializes and installs a policy by obtaining the current policy. At the time it tries to remove a provider, the materialized policy is used for an access check, due to some intricacies of the java.security.Policy implementation. This policy does not allow the removal of a provider.
On platforms where the test runs through PKCS11Test::fetchNssLib, the default policy is reset which makes the test work. But if we don't pass there, the test fails.

The fix is to unconditionally call Policy.setPolicy(null); in IllegalPackageAccess before installing MyPolicy.

---

Progress

• Change must not contain extraneous whitespace
• Commit message must refer to an issue
• Change must be properly reviewed

Issue

• JDK-8261534: Test sun/security/pkcs11/KeyAgreement/IllegalPackageAccess.java fails on platforms where no nsslib artifacts are defined

Reviewers

• Matthias Baesken (@MBaesken - Reviewer)

Download

$ git fetch https://git.openjdk.java.net/jdk pull/2518/head:pull/2518
$ git checkout pull/2518

[bridgekeeper]

👋 Welcome back clanger! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@RealCLanger The following label will be automatically applied to this pull request:

• security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

[mlbridge]

Webrevs

• 00: Full (e7da3f3)

[MBaesken]

LGTM

[openjdk]

@RealCLanger This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8261534: Test sun/security/pkcs11/KeyAgreement/IllegalPackageAccess.java fails on platforms where no nsslib artifacts are defined

Reviewed-by: mbaesken

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 27 new commits pushed to the master branch:

• 682e78e: 8261071: AArch64: Refactor interpreter native wrappers
• ebaa58d: 8261505: Test test/hotspot/jtreg/gc/parallel/TestDynShrinkHeap.java killed by Linux OOM Killer
• 3210095: 8261079: Fix support for @hidden in classes and interfaces
• 9c0ec8d: 8260941: Remove the conc_scan parameter for CardTable
• da9895a: 8261499: Simplify HTML for javadoc links
• 0779add: 8255059: Regressions >5% in all Javadoc benchmarks in 16-b19
• 6a84ec6: 8260044: Parallel GC: Concurrent allocation after heap expansion may cause unnecessary full gc
• 92ff891: 8261593: Do not use NULL pointer as write buffer parameter in jfrEmergencyDump.cpp write_repository_files
• 60a2072: 8260431: com/sun/jdi/JdbOptions.java failed with "RuntimeException: 'prop[boo] = >foo<' missing from stdout/stderr"
• bf47a47: 8261282: Lazy initialization of built-in ICC_Profile/ColorSpace classes is too lazy
• ... and 17 more: https://git.openjdk.java.net/jdk/compare/cc5691c69ed2e71f99001a660c71c9b57c803e60...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[martinuy]

I'm not a JDK main line reviewer but the proposed fix looks good to me as well.

[RealCLanger]

/integrate

[RealCLanger]

Thanks for the reviews!

[openjdk]

@RealCLanger Since your change was applied there have been 43 commits pushed to the master branch:

• f0d9829: 8261533: Java_sun_font_CFont_getCascadeList leaks memory according to Xcode
• 06170b7: 8261662: Rename compute_loader_lock_object
• 3dc6f52: 8261160: Add a deserialization JFR event
• a305743: 8261660: AArch64: Race condition in stub code generation for LSE Atomics
• 28163a9: 8261652: Remove some dead comments from os_bsd_x86
• 6675775: 8253702: BigSur version number reported as 10.16, should be 11.nn
• 33fcd32: 8261659: JDK-8261027 causes a Tier1 validate-source failure
• 3aa1b4c: 8261623: reference to javac internals in Extern class
• 350303d: 8260221: java.util.Formatter throws wrong exception for mismatched flags in %% conversion
• 6475d47: 8261655: [PPC64] Build broken after JDK-8260941
• ... and 33 more: https://git.openjdk.java.net/jdk/compare/cc5691c69ed2e71f99001a660c71c9b57c803e60...master

Your commit was automatically rebased without conflicts.

Pushed as commit dc46aa8.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.