8270199: Most SA tests are skipped on macosx-aarch64 because all executables are signed

test/hotspot/jtreg/ProblemList.txt

@@ -174,7 +174,7 @@ serviceability/sa/ClhsdbJdis.java 8193639 solaris-all
 serviceability/sa/ClhsdbJhisto.java 8193639,8211767 solaris-all,linux-ppc64le,linux-ppc64
 serviceability/sa/ClhsdbJstack.java 8193639 solaris-all
 serviceability/sa/ClhsdbLongConstant.java 8193639 solaris-all
-serviceability/sa/ClhsdbPmap.java 8294316,8193639,8211767,8267433 solaris-all,linux-ppc64le,linux-ppc64,macosx-x64
+serviceability/sa/ClhsdbPmap.java 8269982,8294316,8193639,8211767,8267433 solaris-all,linux-ppc64le,linux-ppc64,macosx-aarch64,macosx-x64
 serviceability/sa/ClhsdbPrintAll.java 8193639 solaris-all
 serviceability/sa/ClhsdbPrintAs.java 8193639 solaris-all
 serviceability/sa/ClhsdbPrintStatics.java 8193639 solaris-all
@@ -202,8 +202,8 @@ serviceability/sa/TestInstanceKlassSize.java 8193639 solaris-all
 serviceability/sa/TestInstanceKlassSizeForInterface.java 8193639 solaris-all
 serviceability/sa/TestIntConstant.java 8193639,8211767 solaris-all,linux-ppc64le,linux-ppc64
 serviceability/sa/TestJhsdbJstackLock.java 8193639 solaris-all
-serviceability/sa/TestJmapCore.java 8294316,8193639,8267433 solaris-all,macosx-x64
-serviceability/sa/TestJmapCoreMetaspace.java 8294316,8193639,8267433 solaris-all,macosx-x64
+serviceability/sa/TestJmapCore.java 8269982,8294316,8193639,8267433 solaris-all,macosx-aarch64,macosx-x64
+serviceability/sa/TestJmapCoreMetaspace.java 8269982,8294316,8193639,8267433 solaris-all,macosx-aarch64,macosx-x64
 serviceability/sa/TestPrintMdo.java 8193639 solaris-all
 serviceability/sa/TestRevPtrsForInvokeDynamic.java 8191270 generic-all
 serviceability/sa/TestType.java 8193639 solaris-all

test/hotspot/jtreg/testlibrary_tests/TestMutuallyExclusivePlatformPredicates.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2014, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -52,7 +52,7 @@ private static enum MethodGroup {
         MODE("isInt", "isMixed", "isComp"),
         IGNORED("isEmulatedClient", "isDebugBuild", "isFastDebugBuild", "isSlowDebugBuild",
                 "hasSA", "isRoot", "isTieredSupported", "areCustomLoadersSupportedForCDS",
-                "isSignedOSX");
+                "isHardenedOSX");
 
         public final List<String> methodNames;
 

test/lib/jdk/test/lib/Platform.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -23,8 +23,10 @@
 
 package jdk.test.lib;
 
+import java.io.BufferedReader;
 import java.io.FileNotFoundException;
 import java.io.IOException;
+import java.io.InputStreamReader;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
@@ -254,13 +256,13 @@ public static boolean hasSA() {
     }
 
     /**
-     * Return true if the test JDK is signed, otherwise false. Only valid on OSX.
+     * Return true if the test JDK is hardened, otherwise false. Only valid on OSX.
      */
-    public static boolean isSignedOSX() throws IOException {
-        // We only care about signed binaries for 10.14 and later (actually 10.14.5, but
+    public static boolean isHardenedOSX() throws IOException {
+        // We only care about hardened binaries for 10.14 and later (actually 10.14.5, but
         // for simplicity we'll also include earlier 10.14 versions).
         if (getOsVersionMajor() == 10 && getOsVersionMinor() < 14) {
-            return false; // assume not signed
+            return false; // assume not hardened
         }
 
         // Find the path to the java binary.
@@ -272,38 +274,44 @@ public static boolean isSignedOSX() throws IOException {
         }
 
         // Run codesign on the java binary.
-        ProcessBuilder pb = new ProcessBuilder("codesign", "-d", "-v", javaFileName);
-        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
-        pb.redirectOutput(ProcessBuilder.Redirect.DISCARD);
+        ProcessBuilder pb = new ProcessBuilder("codesign", "--display", "--verbose", javaFileName);
+        pb.redirectErrorStream(true); // redirect stderr to stdout
         Process codesignProcess = pb.start();
+        BufferedReader is = new BufferedReader(new InputStreamReader(codesignProcess.getInputStream()));
+        String line;
+        boolean isHardened = false;
+        boolean hardenedStatusConfirmed = false; // set true when we confirm whether or not hardened
+        while ((line = is.readLine()) != null) {
+            System.out.println("STDOUT: " + line);
+            if (line.indexOf("flags=0x10000(runtime)") != -1 ) {
+                hardenedStatusConfirmed = true;
+                isHardened = true;
+                System.out.println("Target JDK is hardened. Some tests may be skipped.");
+            } else if (line.indexOf("flags=0x20002(adhoc,linker-signed)") != -1 ) {
+                hardenedStatusConfirmed = true;
+                isHardened = false;
+                System.out.println("Target JDK is adhoc signed, but not hardened.");
+            } else if (line.indexOf("code object is not signed at all") != -1) {
+                hardenedStatusConfirmed = true;
+                isHardened = false;
+                System.out.println("Target JDK is not signed, therefore not hardened.");
+            }
+        }
+        if (!hardenedStatusConfirmed) {
+            System.out.println("Could not confirm if TargetJDK is hardened. Assuming not hardened.");
+            isHardened = false;
+        }
+
         try {
             if (codesignProcess.waitFor(10, TimeUnit.SECONDS) == false) {
-                System.err.println("Timed out waiting for the codesign process to complete. Assuming not signed.");
+                System.err.println("Timed out waiting for the codesign process to complete. Assuming not hardened.");
                 codesignProcess.destroyForcibly();
-                return false; // assume not signed
+                return false; // assume not hardened
             }
         } catch (InterruptedException e) {
             throw new RuntimeException(e);
         }
-
-        // Check codesign result to see if java binary is signed. Here are the
-        // exit code meanings:
-        //    0: signed
-        //    1: not signed
-        //    2: invalid arguments
-        //    3: only has meaning with the -R argument.
-        // So we should always get 0 or 1 as an exit value.
-        if (codesignProcess.exitValue() == 0) {
-            System.out.println("Target JDK is signed. Some tests may be skipped.");
-            return true; // signed
-        } else if (codesignProcess.exitValue() == 1) {
-            System.out.println("Target JDK is not signed.");
-            return false; // not signed
-        } else {
-            System.err.println("Executing codesign failed. Assuming unsigned: " +
-                               codesignProcess.exitValue());
-            return false; // not signed
-        }
+        return isHardened;
     }
 
     private static boolean isArch(String archnameRE) {

test/lib/jdk/test/lib/SA/SATestUtils.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2019, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -63,8 +63,8 @@ public static void skipIfCannotAttach() {
                     throw new SkippedException("SA Attach not expected to work. Ptrace attach not supported.");
                 }
             } else if (Platform.isOSX()) {
-                if (Platform.isSignedOSX()) {
-                    throw new SkippedException("SA Attach not expected to work. JDK is signed.");
+                if (Platform.isHardenedOSX()) {
+                    throw new SkippedException("SA Attach not expected to work. JDK is hardened.");
                 }
                 if (!Platform.isRoot() && !canAddPrivileges()) {
                     throw new SkippedException("SA Attach not expected to work. Insufficient privileges (not root and can't use sudo).");

test/lib/jdk/test/lib/util/CoreUtils.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2020, 2022, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -123,6 +123,14 @@ public static String getCoreFileLocation(String crashOutputString) throws IOExce
             if (!coresDir.canWrite()) {
                 throw new SkippedException("Directory \"" + coresDir + "\" is not writable");
             }
+            if (Platform.isHardenedOSX()) {
+                if (Platform.getOsVersionMajor() > 10 ||
+                        (Platform.getOsVersionMajor() == 10 && Platform.getOsVersionMinor() >= 15))
+                {
+                    // We can't generate cores files with hardened binaries on OSX 10.15 and later.
+                    throw new SkippedException("Cannot produce core file with hardened binary on OSX 10.15 and later");
+                }
+            }
         } else if (Platform.isLinux()) {
             // Check if a crash report tool is installed.
             File corePatternFile = new File(CORE_PATTERN_FILE_NAME);