Skip to content

Commit 8c40b7d

Browse files
coffeyscoffeys
committedOct 18, 2022
8292177: InitialSecurityProperty JFR event
Reviewed-by: mullan
·
JEP-429-branchpoint
1 parent e7a964b commit 8c40b7d

File tree

12 files changed

+393
-145
lines changed

12 files changed

+393
-145
lines changed
 

‎src/java.base/share/classes/java/security/Security.java

+19
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
import java.io.*;
3131
import java.net.URL;
3232

33+
import jdk.internal.access.JavaSecurityPropertiesAccess;
3334
import jdk.internal.event.EventHelper;
3435
import jdk.internal.event.SecurityPropertyModificationEvent;
3536
import jdk.internal.access.SharedSecrets;
@@ -63,6 +64,9 @@ public final class Security {
6364
/* The java.security properties */
6465
private static Properties props;
6566

67+
/* cache a copy for recording purposes */
68+
private static Properties initialSecurityProperties;
69+
6670
// An element in the cache
6771
private static class ProviderProperty {
6872
String className;
@@ -79,6 +83,13 @@ private static class ProviderProperty {
7983
initialize();
8084
return null;
8185
});
86+
// Set up JavaSecurityPropertiesAccess in SharedSecrets
87+
SharedSecrets.setJavaSecurityPropertiesAccess(new JavaSecurityPropertiesAccess() {
88+
@Override
89+
public Properties getInitialProperties() {
90+
return initialSecurityProperties;
91+
}
92+
});
8293
}
8394

8495
private static void initialize() {
@@ -104,6 +115,14 @@ private static void initialize() {
104115
}
105116
loadProps(null, extraPropFile, overrideAll);
106117
}
118+
initialSecurityProperties = (Properties) props.clone();
119+
if (sdebug != null) {
120+
for (String key : props.stringPropertyNames()) {
121+
sdebug.println("Initial security property: " + key + "=" +
122+
props.getProperty(key));
123+
}
124+
}
125+
107126
}
108127

109128
private static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) {

‎src/java.base/share/classes/jdk/internal/access/JavaSecurityPropertiesAccess.java

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/*
2+
* Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
26+
package jdk.internal.access;
27+
28+
import java.util.Properties;
29+
30+
public interface JavaSecurityPropertiesAccess {
31+
Properties getInitialProperties();
32+
}

‎src/java.base/share/classes/jdk/internal/access/SharedSecrets.java

+15
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
import java.io.ObjectInputFilter;
3131
import java.lang.invoke.MethodHandles;
3232
import java.lang.module.ModuleDescriptor;
33+
import java.security.Security;
3334
import java.security.spec.EncodedKeySpec;
3435
import java.util.ResourceBundle;
3536
import java.util.concurrent.ForkJoinPool;
@@ -83,6 +84,7 @@ public class SharedSecrets {
8384
private static JavaUtilZipFileAccess javaUtilZipFileAccess;
8485
private static JavaUtilResourceBundleAccess javaUtilResourceBundleAccess;
8586
private static JavaSecurityAccess javaSecurityAccess;
87+
private static JavaSecurityPropertiesAccess javaSecurityPropertiesAccess;
8688
private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
8789
private static JavaSecuritySpecAccess javaSecuritySpecAccess;
8890
private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
@@ -343,6 +345,19 @@ public static JavaSecurityAccess getJavaSecurityAccess() {
343345
return access;
344346
}
345347

348+
public static void setJavaSecurityPropertiesAccess(JavaSecurityPropertiesAccess jspa) {
349+
javaSecurityPropertiesAccess = jspa;
350+
}
351+
352+
public static JavaSecurityPropertiesAccess getJavaSecurityPropertiesAccess() {
353+
var access = javaSecurityPropertiesAccess;
354+
if (access == null) {
355+
ensureClassInitialized(Security.class);
356+
access = javaSecurityPropertiesAccess;
357+
}
358+
return access;
359+
}
360+
346361
public static JavaUtilZipFileAccess getJavaUtilZipFileAccess() {
347362
var access = javaUtilZipFileAccess;
348363
if (access == null) {

‎src/java.base/share/classes/module-info.java

+1
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,7 @@
165165
jdk.charsets,
166166
jdk.jartool,
167167
jdk.jlink,
168+
jdk.jfr,
168169
jdk.net;
169170
exports jdk.internal.foreign to
170171
jdk.incubator.vector;

‎src/jdk.jfr/share/classes/jdk/jfr/events/InitialSecurityPropertyEvent.java

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
/*
2+
* Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
26+
package jdk.jfr.events;
27+
28+
import jdk.jfr.Category;
29+
import jdk.jfr.Description;
30+
import jdk.jfr.Label;
31+
import jdk.jfr.Name;
32+
33+
@Category({"Java Development Kit", "Security"})
34+
@Label("Initial Security Property")
35+
@Name("jdk.InitialSecurityProperty")
36+
@Description("Initial Security Properties")
37+
public final class InitialSecurityPropertyEvent extends AbstractJDKEvent {
38+
@Label("Key")
39+
public String key;
40+
41+
@Label("Value")
42+
public String value;
43+
}

‎src/jdk.jfr/share/classes/jdk/jfr/internal/instrument/JDKEvents.java

+20-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,9 @@
2727

2828
import java.util.ArrayList;
2929
import java.util.List;
30+
import java.util.Properties;
3031

32+
import jdk.internal.access.SharedSecrets;
3133
import jdk.jfr.Event;
3234
import jdk.jfr.events.ActiveRecordingEvent;
3335
import jdk.jfr.events.ActiveSettingEvent;
@@ -44,6 +46,7 @@
4446
import jdk.jfr.events.FileReadEvent;
4547
import jdk.jfr.events.FileWriteEvent;
4648
import jdk.jfr.events.DeserializationEvent;
49+
import jdk.jfr.events.InitialSecurityPropertyEvent;
4750
import jdk.jfr.events.ProcessStartEvent;
4851
import jdk.jfr.events.SecurityPropertyModificationEvent;
4952
import jdk.jfr.events.SecurityProviderServiceEvent;
@@ -107,7 +110,8 @@ public final class JDKEvents {
107110
jdk.internal.event.X509CertificateEvent.class,
108111
jdk.internal.event.X509ValidationEvent.class,
109112

110-
DirectBufferStatisticsEvent.class
113+
DirectBufferStatisticsEvent.class,
114+
InitialSecurityPropertyEvent.class,
111115
};
112116

113117
// This is a list of the classes with instrumentation code that should be applied.
@@ -130,6 +134,7 @@ public final class JDKEvents {
130134
private static final Runnable emitContainerCPUThrottling = JDKEvents::emitContainerCPUThrottling;
131135
private static final Runnable emitContainerMemoryUsage = JDKEvents::emitContainerMemoryUsage;
132136
private static final Runnable emitContainerIOUsage = JDKEvents::emitContainerIOUsage;
137+
private static final Runnable emitInitialSecurityProperties = JDKEvents::emitInitialSecurityProperties;
133138
private static Metrics containerMetrics = null;
134139
private static boolean initializationTriggered;
135140

@@ -146,6 +151,7 @@ public static synchronized void initialize() {
146151

147152
RequestEngine.addTrustedJDKHook(ExceptionStatisticsEvent.class, emitExceptionStatistics);
148153
RequestEngine.addTrustedJDKHook(DirectBufferStatisticsEvent.class, emitDirectBufferStatistics);
154+
RequestEngine.addTrustedJDKHook(InitialSecurityPropertyEvent.class, emitInitialSecurityProperties);
149155

150156
initializeContainerEvents();
151157
initializationTriggered = true;
@@ -288,6 +294,7 @@ public static byte[] retransformCallback(Class<?> klass, byte[] oldBytes) throws
288294
public static void remove() {
289295
RequestEngine.removeHook(emitExceptionStatistics);
290296
RequestEngine.removeHook(emitDirectBufferStatistics);
297+
RequestEngine.removeHook(emitInitialSecurityProperties);
291298

292299
RequestEngine.removeHook(emitContainerConfiguration);
293300
RequestEngine.removeHook(emitContainerCPUUsage);
@@ -300,4 +307,16 @@ private static void emitDirectBufferStatistics() {
300307
DirectBufferStatisticsEvent e = new DirectBufferStatisticsEvent();
301308
e.commit();
302309
}
310+
311+
private static void emitInitialSecurityProperties() {
312+
Properties p = SharedSecrets.getJavaSecurityPropertiesAccess().getInitialProperties();
313+
if (p != null) {
314+
for (String key : p.stringPropertyNames()) {
315+
InitialSecurityPropertyEvent e = new InitialSecurityPropertyEvent();
316+
e.key = key;
317+
e.value = p.getProperty(key);
318+
e.commit();
319+
}
320+
}
321+
}
303322
}

‎src/jdk.jfr/share/conf/jfr/default.jfc

+5
Original file line numberDiff line numberDiff line change
@@ -709,6 +709,11 @@
709709
<setting name="stackTrace">true</setting>
710710
</event>
711711

712+
<event name="jdk.InitialSecurityProperty">
713+
<setting name="enabled">true</setting>
714+
<setting name="period">beginChunk</setting>
715+
</event>
716+
712717
<event name="jdk.SecurityPropertyModification">
713718
<setting name="enabled">false</setting>
714719
<setting name="stackTrace">true</setting>

‎src/jdk.jfr/share/conf/jfr/profile.jfc

+5
Original file line numberDiff line numberDiff line change
@@ -709,6 +709,11 @@
709709
<setting name="stackTrace">true</setting>
710710
</event>
711711

712+
<event name="jdk.InitialSecurityProperty">
713+
<setting name="enabled">true</setting>
714+
<setting name="period">beginChunk</setting>
715+
</event>
716+
712717
<event name="jdk.SecurityPropertyModification">
713718
<setting name="enabled">false</setting>
714719
<setting name="stackTrace">true</setting>

‎test/jdk/java/security/Security/ConfigFileTest.java

+30-2
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,20 @@
3636
/*
3737
* @test
3838
* @summary Throw error if default java.security file is missing
39-
* @bug 8155246 8292297
39+
* @bug 8155246 8292297 8292177
4040
* @library /test/lib
4141
* @run main ConfigFileTest
4242
*/
4343
public class ConfigFileTest {
4444

45+
private static final String EXPECTED_DEBUG_OUTPUT =
46+
"Initial security property: crypto.policy=unlimited";
47+
48+
private static final String UNEXPECTED_DEBUG_OUTPUT =
49+
"Initial security property: postInitTest=shouldNotRecord";
50+
51+
private static boolean overrideDetected = false;
52+
4553
public static void main(String[] args) throws Exception {
4654
Path copyJdkDir = Path.of("./jdk-8155246-tmpdir");
4755
Path copiedJava = Optional.of(
@@ -52,6 +60,7 @@ public static void main(String[] args) throws Exception {
5260
if (args.length == 1) {
5361
// set up is complete. Run code to exercise loading of java.security
5462
Provider[] provs = Security.getProviders();
63+
Security.setProperty("postInitTest", "shouldNotRecord");
5564
System.out.println(Arrays.toString(provs) + "NumProviders: " + provs.length);
5665
} else {
5766
Files.createDirectory(copyJdkDir);
@@ -99,13 +108,32 @@ public static void main(String[] args) throws Exception {
99108
copiedJava.toString(), "-cp", System.getProperty("test.classes"),
100109
"-Djava.security.debug=all", "-Djavax.net.debug=all",
101110
"-Djava.security.properties==file:///" + extraPropsFile, "ConfigFileTest", "runner");
111+
112+
if (!overrideDetected) {
113+
throw new RuntimeException("Override scenario not seen");
114+
}
102115
}
103116
}
104117

105118
private static void exerciseSecurity(int exitCode, String output, String... args) throws Exception {
106119
ProcessBuilder process = new ProcessBuilder(args);
107120
OutputAnalyzer oa = ProcessTools.executeProcess(process);
108-
oa.shouldHaveExitValue(exitCode).shouldContain(output);
121+
oa.shouldHaveExitValue(exitCode)
122+
.shouldContain(output);
123+
124+
// extra checks on debug output
125+
if (exitCode != 1) {
126+
if (oa.getStderr().contains("overriding other security properties files!")) {
127+
overrideDetected = true;
128+
// master file is not in use - only provider properties are set in custom file
129+
oa.shouldContain("security.provider.2=SunRsaSign")
130+
.shouldNotContain(EXPECTED_DEBUG_OUTPUT)
131+
.shouldNotContain(UNEXPECTED_DEBUG_OUTPUT);
132+
} else {
133+
oa.shouldContain(EXPECTED_DEBUG_OUTPUT)
134+
.shouldNotContain(UNEXPECTED_DEBUG_OUTPUT);
135+
}
136+
}
109137
}
110138

111139
private static void copyJDK(Path src, Path dst) throws Exception {

‎test/jdk/jdk/jfr/event/runtime/TestActiveSettingEvent.java

+1
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,7 @@ private static void testSettingConfiguration(String configurationName) throws Ex
252252
settingValues.put(EventNames.ActiveSetting + "#threshold", "0 ns");
253253
settingValues.put(EventNames.ActiveRecording + "#stackTrace", "false");
254254
settingValues.put(EventNames.ActiveRecording + "#threshold", "0 ns");
255+
settingValues.put(EventNames.InitialSecurityProperty + "#threshold", "0 ns");
255256
settingValues.put(EventNames.JavaExceptionThrow + "#threshold", "0 ns");
256257
settingValues.put(EventNames.JavaErrorThrow + "#threshold", "0 ns");
257258
settingValues.put(EventNames.SecurityProperty + "#threshold", "0 ns");

‎test/jdk/jdk/jfr/event/security/TestInitialSecurityPropertyEvent.java

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
/*
2+
* Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
package jdk.jfr.event.security;
25+
26+
import jdk.internal.access.SharedSecrets;
27+
import jdk.jfr.Recording;
28+
import jdk.jfr.consumer.RecordedEvent;
29+
import jdk.test.lib.Asserts;
30+
import jdk.test.lib.jfr.EventNames;
31+
import jdk.test.lib.jfr.Events;
32+
33+
import java.security.Security;
34+
import java.util.List;
35+
import java.util.Properties;
36+
37+
/*
38+
* @test
39+
* @bug 8292177
40+
* @summary InitialSecurityProperty JFR event
41+
* @key jfr
42+
* @requires vm.hasJFR
43+
* @library /test/lib
44+
* @modules java.base/jdk.internal.access
45+
* @run main/othervm jdk.jfr.event.security.TestInitialSecurityPropertyEvent
46+
*/
47+
public class TestInitialSecurityPropertyEvent {
48+
49+
private static final String SEC_KEY = "security.overridePropertiesFile";
50+
public static void main(String[] args) throws Exception {
51+
try (Recording recording = new Recording()) {
52+
recording.enable(EventNames.InitialSecurityProperty)
53+
.with("period", "beginChunk");
54+
recording.start();
55+
// this property edit should not be recorded
56+
Security.setProperty(SEC_KEY, "false");
57+
recording.stop();
58+
59+
Properties p = SharedSecrets.getJavaSecurityPropertiesAccess().getInitialProperties();
60+
List<RecordedEvent> events = Events.fromRecording(recording);
61+
if (events.size() == 0) {
62+
throw new Exception("No security properties - Security class may not have loaded ?");
63+
}
64+
Asserts.assertEquals(events.size(), p.size(), "Incorrect number of events");
65+
assertEvent(events, SEC_KEY, "true");
66+
}
67+
}
68+
69+
private static void assertEvent(List<RecordedEvent> events, String key, String origValue) throws Exception {
70+
for (RecordedEvent e : events) {
71+
if (e.getString("key").equals(key)) {
72+
Events.assertField(e, "value").equal(origValue);
73+
return;
74+
}
75+
}
76+
System.out.println(events);
77+
throw new Exception("Incorrect value for " + key + " property recorded");
78+
}
79+
}

‎test/lib/jdk/test/lib/jfr/EventNames.java

+143-142
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)
Please sign in to comment.