diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 82265a36d5c..845c9462020 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ on: jobs: build: - name: build (${{ matrix.os }}) + name: build (${{ matrix.os }}, jdk ${{ matrix.java }}) permissions: contents: read @@ -36,29 +36,46 @@ jobs: fail-fast: false matrix: os: [ ubuntu-24.04, windows-latest, macos-latest ] + java: [ '21' ] + # Include an additional matrix entry for main branch with Ubuntu 26.04, JDK 25, and Maven 3.10.0 + include: ${{ github.ref == 'refs/heads/main' && fromJSON('[{"os":"ubuntu-26.04","java":"25","maven":"3.10.0"}]') || fromJSON('[]') }} runs-on: ${{ matrix.os }} steps: - name: Checkout uses: actions/checkout@v7 - - name: Set up JDK 17 + - name: Set up JDK ${{ matrix.java }} uses: actions/setup-java@v6 with: - java-version: '17' + java-version: ${{ matrix.java }} distribution: 'temurin' cache: 'maven' + - name: Set up Maven ${{ matrix.maven }} + if: matrix.maven + env: + MAVEN_VERSION: ${{ matrix.maven }} + run: | + url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" + curl -fsSL -o "${RUNNER_TEMP}/maven.tar.gz" "${url}" + echo "$(curl -fsSL "${url}.sha512") ${RUNNER_TEMP}/maven.tar.gz" | sha512sum -c - + tar -xzf "${RUNNER_TEMP}/maven.tar.gz" -C "${RUNNER_TEMP}" + # fails the step if the layout is not what we expect, rather than silently keeping Maven 3 + "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin/mvn" -v + echo "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin" >> "${GITHUB_PATH}" - name: Build - run: mvn -U -B -e clean install -Prat -DskipTests "-Dinvoker.skip=true" + run: | + mvn --version + mvn -U -B -e clean install -Prat -DskipTests "-Dinvoker.skip=true" - name: Save Maven Local Repository uses: actions/upload-artifact@v7 with: - name: maven-local-repo-${{ matrix.os }} + name: maven-local-repo-${{ matrix.os }}-jdk${{ matrix.java }} path: ~/.m2/repository retention-days: 1 test: - name: test (${{ matrix.os }}) + name: test (${{ matrix.os }}, jdk ${{ matrix.java }}) needs: build permissions: @@ -68,34 +85,51 @@ jobs: fail-fast: false matrix: os: [ ubuntu-24.04, windows-latest, macos-latest ] + java: [ '21' ] + # Include an additional matrix entry for main branch with Ubuntu 26.04, JDK 25, and Maven 3.10.0 + include: ${{ github.ref == 'refs/heads/main' && fromJSON('[{"os":"ubuntu-26.04","java":"25","maven":"3.10.0"}]') || fromJSON('[]') }} runs-on: ${{ matrix.os }} steps: - name: Checkout uses: actions/checkout@v7 - - name: Set up JDK 17 + - name: Set up JDK ${{ matrix.java }} uses: actions/setup-java@v6 with: - java-version: '17' + java-version: ${{ matrix.java }} distribution: 'temurin' cache: 'maven' - name: Restore Maven Local Repository uses: actions/download-artifact@v8 with: - name: maven-local-repo-${{ matrix.os }} + name: maven-local-repo-${{ matrix.os }}-jdk${{ matrix.java }} path: ~/.m2/repository + - name: Set up Maven ${{ matrix.maven }} + if: matrix.maven + env: + MAVEN_VERSION: ${{ matrix.maven }} + run: | + url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" + curl -fsSL -o "${RUNNER_TEMP}/maven.tar.gz" "${url}" + echo "$(curl -fsSL "${url}.sha512") ${RUNNER_TEMP}/maven.tar.gz" | sha512sum -c - + tar -xzf "${RUNNER_TEMP}/maven.tar.gz" -C "${RUNNER_TEMP}" + # fails the step if the layout is not what we expect, rather than silently keeping Maven 3 + "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin/mvn" -v + echo "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin" >> "${GITHUB_PATH}" - name: Test - run: mvn -B -e install -Ptest + run: | + mvn --version + mvn -B -e install -Ptest timeout-minutes: 180 - name: Upload Test Results if: always() uses: actions/upload-artifact@v7 with: - name: test-results-${{ matrix.os }} + name: test-results-${{ matrix.os }}-jdk${{ matrix.java }} path: '**/target/surefire-reports/*.xml' - name: Upload Event File - if: always() + if: always() && matrix.java == '21' uses: actions/upload-artifact@v7 with: name: event-file-${{ matrix.os }} diff --git a/BUILDING.md b/BUILDING.md index 4286805b25a..408efd5fe9b 100644 --- a/BUILDING.md +++ b/BUILDING.md @@ -21,13 +21,13 @@ ## Initial Setup -1. Install J2SE 11 SDK (or later) +1. Install J2SE 21 SDK (or later) 2. Make sure that your JAVA_HOME environment variable is set to the newly installed JDK location, and that your PATH includes `%JAVA_HOME%\bin` (windows) or `$JAVA_HOME$/bin` (unix). -3. Install Maven 3.8.0 (or later), which can be downloaded from +3. Install Maven 3.8.8 (or later), which can be downloaded from http://maven.apache.org/download.html. Make sure that your PATH includes the `$MVN_HOME/bin` directory. diff --git a/archetypes/assembly/src/main/resources/archetype-resources/pom.xml b/archetypes/assembly/src/main/resources/archetype-resources/pom.xml index 4bd78a8db18..c0fff59c068 100644 --- a/archetypes/assembly/src/main/resources/archetype-resources/pom.xml +++ b/archetypes/assembly/src/main/resources/archetype-resources/pom.xml @@ -174,7 +174,7 @@ - 17 + ^javaVersion^ diff --git a/archetypes/blueprint/src/main/resources/archetype-resources/pom.xml b/archetypes/blueprint/src/main/resources/archetype-resources/pom.xml index d442fecc346..cd322ff1458 100644 --- a/archetypes/blueprint/src/main/resources/archetype-resources/pom.xml +++ b/archetypes/blueprint/src/main/resources/archetype-resources/pom.xml @@ -63,8 +63,9 @@ maven-compiler-plugin 3.15.0 - 1.8 - 1.8 + 21 + 21 + 21 256M diff --git a/archetypes/bundle/pom.xml b/archetypes/bundle/pom.xml index 3bbc2cecbac..7d4ecef397e 100644 --- a/archetypes/bundle/pom.xml +++ b/archetypes/bundle/pom.xml @@ -57,8 +57,9 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 + ${javaVersion} + ${javaVersion} + ${javaVersion} 256M diff --git a/archetypes/bundle/src/main/resources/archetype-resources/pom.xml b/archetypes/bundle/src/main/resources/archetype-resources/pom.xml index 798beaeab16..83654cd8942 100644 --- a/archetypes/bundle/src/main/resources/archetype-resources/pom.xml +++ b/archetypes/bundle/src/main/resources/archetype-resources/pom.xml @@ -82,8 +82,9 @@ maven-compiler-plugin 3.15.0 - 1.8 - 1.8 + 21 + 21 + 21 256M diff --git a/archetypes/command/src/main/resources/archetype-resources/pom.xml b/archetypes/command/src/main/resources/archetype-resources/pom.xml index 73ab71c704b..6a579d1cc27 100644 --- a/archetypes/command/src/main/resources/archetype-resources/pom.xml +++ b/archetypes/command/src/main/resources/archetype-resources/pom.xml @@ -67,8 +67,9 @@ true 3.15.0 - 1.8 - 1.8 + 21 + 21 + 21 diff --git a/assemblies/apache-karaf-light/pom.xml b/assemblies/apache-karaf-light/pom.xml index 8f70f27a265..6d06313629f 100644 --- a/assemblies/apache-karaf-light/pom.xml +++ b/assemblies/apache-karaf-light/pom.xml @@ -178,7 +178,7 @@ - 17 + ${javaVersion} ${project.build.directory} Apache Karaf Light diff --git a/assemblies/apache-karaf-minimal/pom.xml b/assemblies/apache-karaf-minimal/pom.xml index 072afd67715..dff15d80164 100644 --- a/assemblies/apache-karaf-minimal/pom.xml +++ b/assemblies/apache-karaf-minimal/pom.xml @@ -145,7 +145,7 @@ !org.apache.karaf.command.acl.*, * - 17 + ${javaVersion} diff --git a/assemblies/apache-karaf-mix/pom.xml b/assemblies/apache-karaf-mix/pom.xml index e07eec0e8bf..4c4039b623c 100644 --- a/assemblies/apache-karaf-mix/pom.xml +++ b/assemblies/apache-karaf-mix/pom.xml @@ -187,7 +187,7 @@ - 17 + ${javaVersion} ${project.build.directory} Apache Karaf Mix diff --git a/assemblies/apache-karaf/pom.xml b/assemblies/apache-karaf/pom.xml index 9c05670f68f..2a263eca686 100644 --- a/assemblies/apache-karaf/pom.xml +++ b/assemblies/apache-karaf/pom.xml @@ -178,7 +178,7 @@ - 17 + ${javaVersion} ${project.build.directory} Apache Karaf (full) diff --git a/assemblies/features/base/src/main/filtered-resources/resources/bin/inc b/assemblies/features/base/src/main/filtered-resources/resources/bin/inc index 2809e8be7cf..d95ac412733 100644 --- a/assemblies/features/base/src/main/filtered-resources/resources/bin/inc +++ b/assemblies/features/base/src/main/filtered-resources/resources/bin/inc @@ -190,7 +190,7 @@ locateJava() { fi if [ "x${JAVA_HOME}" = "x" ] && [ "${darwin}" = "true" ]; then - JAVA_HOME="`/usr/libexec/java_home -v 1.8`" + JAVA_HOME="`/usr/libexec/java_home -v 21+`" fi if [ "x${JAVA_HOME}" = "x" ] && [ -r /etc/gentoo-release ] ; then JAVA_HOME=`java-config --jre-home` @@ -243,9 +243,9 @@ checkJvmVersion() { VERSION=`"${JAVA}" -version 2>&1 | ${AWK} -F '"' '/version/ {print $2}' | sed -e 's/_.*//g; s/^1\.//g; s/\..*//g; s/-.*//g;s/-.*//g; s/^[A-Za-z].*//'` - # java must be at least version 11 - if [ "${VERSION}" -lt "11" ]; then - die "JVM must be version 11 or greater" + # java must be at least version 21 + if [ "${VERSION}" -lt "21" ]; then + die "JVM must be version 21 or greater" fi } @@ -282,12 +282,6 @@ setupVendorSepcifics() { setupDefaults() { DEFAULT_JAVA_OPTS="-XX:+UnlockDiagnosticVMOptions " - if [ "${VERSION}" -gt "11" ]; then - # TODO revisit EventAdminImpl to avoid use of Subject.getSubject(AccessController.getContext()); - # -Djava.security.manager=allow is a workaround for SecurityController deprecation in JDK23+ - DEFAULT_JAVA_OPTS="$DEFAULT_JAVA_OPTS -Djava.security.manager=allow " - fi - setupVendorSepcifics DEFAULT_JAVA_OPTS="${DEFAULT_JAVA_OPTS} ${JAVA_VENDOR_OPTS}" diff --git a/assemblies/features/base/src/main/filtered-resources/resources/bin/karaf b/assemblies/features/base/src/main/filtered-resources/resources/bin/karaf index 65ecd5312c0..26c4b615d6f 100644 --- a/assemblies/features/base/src/main/filtered-resources/resources/bin/karaf +++ b/assemblies/features/base/src/main/filtered-resources/resources/bin/karaf @@ -94,16 +94,14 @@ setupClassPath() { CLASSPATH="${CLASSPATH}:${file}" fi done - if [ "${VERSION}" -gt "8" ] ; then - for file in "${KARAF_HOME}"/lib/jdk9plus/*.jar - do - if [ -z "${CLASSPATH}" ]; then - CLASSPATH="${file}" - else - CLASSPATH="${CLASSPATH}:${file}" - fi - done - fi + for file in "${KARAF_HOME}"/lib/jdk9plus/*.jar + do + if [ -z "${CLASSPATH}" ]; then + CLASSPATH="${file}" + else + CLASSPATH="${CLASSPATH}:${file}" + fi + done } checkRootInstance() { @@ -183,12 +181,8 @@ run() { if [ "x$CHECK_ROOT_INSTANCE_RUNNING" = "x" ]; then CHECK_ROOT_INSTANCE_RUNNING=true fi - JAVA_ENDORSED_DIRS="${JAVA_HOME}/jre/lib/endorsed:${JAVA_HOME}/lib/endorsed:${KARAF_HOME}/lib/endorsed" - JAVA_EXT_DIRS="${JAVA_HOME}/jre/lib/ext:${JAVA_HOME}/lib/ext:${KARAF_HOME}/lib/ext" if ${cygwin}; then JAVA_HOME=`cygpath --path --windows "${JAVA_HOME}"` - JAVA_ENDORSED_DIRS=`cygpath --path --windows "${JAVA_ENDORSED_DIRS}"` - JAVA_EXT_DIRS=`cygpath --path --windows "${JAVA_EXT_DIRS}"` fi convertPaths cd "${KARAF_BASE}" || exit 2 diff --git a/assemblies/features/base/src/main/filtered-resources/resources/bin/karaf.bat b/assemblies/features/base/src/main/filtered-resources/resources/bin/karaf.bat index b3893b53873..981cd4fb9a1 100644 --- a/assemblies/features/base/src/main/filtered-resources/resources/bin/karaf.bat +++ b/assemblies/features/base/src/main/filtered-resources/resources/bin/karaf.bat @@ -234,12 +234,16 @@ for /f tokens^=2-5^ delims^=.-_+^" %%j in ('"%JAVA%" -fullversion 2^>^&1') do ( if %%j==1 (set JAVA_VERSION=%%k) else (set JAVA_VERSION=%%j) ) -if %JAVA_VERSION% GTR 8 ( - pushd "%KARAF_HOME%\lib\jdk9plus" - for %%G in (*.jar) do call:APPEND_TO_JDK9PLUS_CLASSPATH %%G - popd +rem java must be at least version 21 +if %JAVA_VERSION% LSS 21 ( + call :warn JVM must be version 21 or greater + goto END ) +pushd "%KARAF_HOME%\lib\jdk9plus" + for %%G in (*.jar) do call:APPEND_TO_JDK9PLUS_CLASSPATH %%G +popd + :CheckRootInstance set ROOT_INSTANCE_RUNNING=false if exist "%KARAF_HOME%\instances\instance.properties" ( @@ -267,10 +271,6 @@ if not exist "%JAVA_HOME%\bin\server\jvm.dll" ( ) set DEFAULT_JAVA_OPTS=-XX:+UnlockDiagnosticVMOptions -if %JAVA_VERSION% GTR 11 ( - set DEFAULT_JAVA_OPTS=%DEFAULT_JAVA_OPTS% -Djava.security.manager=allow -) - if "%JAVA_OPTS%" == "" set JAVA_OPTS=%DEFAULT_JAVA_OPTS% if "%EXTRA_JAVA_OPTS%" == "" goto :KARAF_EXTRA_JAVA_OPTS_END diff --git a/assemblies/features/enterprise/pom.xml b/assemblies/features/enterprise/pom.xml index 5ff00a0b820..d8cc722ba0d 100644 --- a/assemblies/features/enterprise/pom.xml +++ b/assemblies/features/enterprise/pom.xml @@ -214,7 +214,7 @@ file:${project.build.directory}/feature/feature.xml org.apache.karaf.features:framework - 17 + ${javaVersion} framework diff --git a/assemblies/features/integration/pom.xml b/assemblies/features/integration/pom.xml index 54faea9360a..0e4d7c326a5 100644 --- a/assemblies/features/integration/pom.xml +++ b/assemblies/features/integration/pom.xml @@ -105,7 +105,7 @@ file:${project.build.directory}/feature/feature.xml org.apache.karaf.features:framework - 17 + ${javaVersion} framework diff --git a/assemblies/features/specs/pom.xml b/assemblies/features/specs/pom.xml index 5944e6081b3..1558c26aeec 100644 --- a/assemblies/features/specs/pom.xml +++ b/assemblies/features/specs/pom.xml @@ -96,7 +96,7 @@ file:${project.build.directory}/feature/feature.xml org.apache.karaf.features:framework - 17 + ${javaVersion} framework @@ -149,4 +149,4 @@ - \ No newline at end of file + diff --git a/assemblies/features/spring/pom.xml b/assemblies/features/spring/pom.xml index b5abe0e26ad..8658b716938 100644 --- a/assemblies/features/spring/pom.xml +++ b/assemblies/features/spring/pom.xml @@ -158,7 +158,7 @@ file:${project.build.directory}/feature/feature.xml org.apache.karaf.features:framework - 17 + ${javaVersion} framework diff --git a/assemblies/features/standard/pom.xml b/assemblies/features/standard/pom.xml index 540a5919c4d..ed6a8b92ac2 100644 --- a/assemblies/features/standard/pom.xml +++ b/assemblies/features/standard/pom.xml @@ -476,7 +476,7 @@ file:${project.build.directory}/feature/feature.xml org.apache.karaf.features:framework - 17 + ${javaVersion} framework @@ -503,7 +503,7 @@ target/feature/feature.xml - features + features xml diff --git a/examples/karaf-docker-example/karaf-docker-example-dynamic-dist/pom.xml b/examples/karaf-docker-example/karaf-docker-example-dynamic-dist/pom.xml index 737f04e70c6..634aaab1618 100644 --- a/examples/karaf-docker-example/karaf-docker-example-dynamic-dist/pom.xml +++ b/examples/karaf-docker-example/karaf-docker-example-dynamic-dist/pom.xml @@ -139,7 +139,7 @@ - 17 + ${javaVersion} @@ -195,4 +195,4 @@ - \ No newline at end of file + diff --git a/examples/karaf-docker-example/karaf-docker-example-static-dist/pom.xml b/examples/karaf-docker-example/karaf-docker-example-static-dist/pom.xml index 962cb65914f..91a3fe1d3e7 100644 --- a/examples/karaf-docker-example/karaf-docker-example-static-dist/pom.xml +++ b/examples/karaf-docker-example/karaf-docker-example-static-dist/pom.xml @@ -111,7 +111,7 @@ static true static - 17 + ${javaVersion} diff --git a/examples/karaf-graphql-example/karaf-graphql-example-websocket/pom.xml b/examples/karaf-graphql-example/karaf-graphql-example-websocket/pom.xml index c684882f738..61817c99136 100644 --- a/examples/karaf-graphql-example/karaf-graphql-example-websocket/pom.xml +++ b/examples/karaf-graphql-example/karaf-graphql-example-websocket/pom.xml @@ -70,8 +70,8 @@ org.apache.maven.plugins maven-compiler-plugin - 11 - 11 + 21 + 21 diff --git a/instance/src/main/java/org/apache/karaf/instance/core/internal/InstanceServiceImpl.java b/instance/src/main/java/org/apache/karaf/instance/core/internal/InstanceServiceImpl.java index e8537e9e157..c28c48779b3 100644 --- a/instance/src/main/java/org/apache/karaf/instance/core/internal/InstanceServiceImpl.java +++ b/instance/src/main/java/org/apache/karaf/instance/core/internal/InstanceServiceImpl.java @@ -523,37 +523,29 @@ private static void doStart(InstanceState instance, String name, String javaOpts classpath.append(childClasspath); } - String jdkOpts; - if (!System.getProperty("java.version").startsWith("1.")) { - StringBuilder jdk9Classpath = classpathFromLibDir(new File(new File(System.getProperty("karaf.home"), "lib"), "jdk9plus")); - if (jdk9Classpath.length() > 0) { - classpath.append(System.getProperty("path.separator")); - classpath.append(jdk9Classpath); - } - jdkOpts = " --add-opens java.base/java.security=ALL-UNNAMED" + - " --add-opens java.base/java.net=ALL-UNNAMED" + - " --add-opens java.base/java.lang=ALL-UNNAMED" + - " --add-opens java.base/java.util=ALL-UNNAMED" + - " --add-opens java.naming/javax.naming.spi=ALL-UNNAMED" + - " --add-opens java.rmi/sun.rmi.transport.tcp=ALL-UNNAMED" + - " --add-exports=java.base/sun.net.www.protocol.file=ALL-UNNAMED" + - " --add-exports=java.base/sun.net.www.protocol.ftp=ALL-UNNAMED" + - " --add-exports=java.base/sun.net.www.protocol.http=ALL-UNNAMED" + - " --add-exports=java.base/sun.net.www.protocol.https=ALL-UNNAMED" + - " --add-exports=java.base/sun.net.www.protocol.jar=ALL-UNNAMED" + - " --add-exports=java.base/sun.net.www.content.text=ALL-UNNAMED" + - " --add-exports=jdk.xml.dom/org.w3c.dom.html=ALL-UNNAMED" + - " --add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED" + - " --add-exports=jdk.naming.rmi/com.sun.jndi.url.rmi=ALL-UNNAMED" + - " --add-exports=java.security.sasl/com.sun.security.sasl=ALL-UNNAMED" + - " --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED"; - if (!System.getProperty("java.version").startsWith("11")) { - jdkOpts += " -Djava.security.manager=allow"; - } - } else { - jdkOpts = " -Djava.endorsed.dirs=\"" + new File(new File(new File(System.getProperty("java.home"), "jre"), "lib"), "endorsed") + System.getProperty("path.separator") + new File(new File(System.getProperty("java.home"), "lib"), "endorsed") + "\"" - + " -Djava.ext.dirs=\"" + new File(new File(new File(System.getProperty("java.home"), "jre"), "lib"), "ext") + System.getProperty("path.separator") + new File(new File(System.getProperty("java.home"), "lib"), "ext") + System.getProperty("path.separator") + new File(libDir, "ext").getCanonicalPath() + "\""; + StringBuilder jdk9Classpath = classpathFromLibDir(new File(new File(System.getProperty("karaf.home"), "lib"), "jdk9plus")); + if (!jdk9Classpath.isEmpty()) { + classpath.append(File.pathSeparator); + classpath.append(jdk9Classpath); } + String jdkOpts = " --add-opens java.base/java.security=ALL-UNNAMED" + + " --add-opens java.base/java.net=ALL-UNNAMED" + + " --add-opens java.base/java.lang=ALL-UNNAMED" + + " --add-opens java.base/java.util=ALL-UNNAMED" + + " --add-opens java.naming/javax.naming.spi=ALL-UNNAMED" + + " --add-opens java.rmi/sun.rmi.transport.tcp=ALL-UNNAMED" + + " --add-exports=java.base/sun.net.www.protocol.file=ALL-UNNAMED" + + " --add-exports=java.base/sun.net.www.protocol.ftp=ALL-UNNAMED" + + " --add-exports=java.base/sun.net.www.protocol.http=ALL-UNNAMED" + + " --add-exports=java.base/sun.net.www.protocol.https=ALL-UNNAMED" + + " --add-exports=java.base/sun.net.www.protocol.jar=ALL-UNNAMED" + + " --add-exports=java.base/sun.net.www.content.text=ALL-UNNAMED" + + " --add-exports=jdk.xml.dom/org.w3c.dom.html=ALL-UNNAMED" + + " --add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED" + + " --add-exports=jdk.naming.rmi/com.sun.jndi.url.rmi=ALL-UNNAMED" + + " --add-exports=java.security.sasl/com.sun.security.sasl=ALL-UNNAMED" + + " --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED"; + String command = "\"" + new File(System.getProperty("java.home"), ScriptUtils.isWindows() ? "bin\\java.exe" : "bin/java").getCanonicalPath() + "\" " + opts diff --git a/itests/common/src/main/java/org/apache/karaf/itests/KarafTestSupport.java b/itests/common/src/main/java/org/apache/karaf/itests/KarafTestSupport.java index 0f6971c2315..d1ba36f5c39 100644 --- a/itests/common/src/main/java/org/apache/karaf/itests/KarafTestSupport.java +++ b/itests/common/src/main/java/org/apache/karaf/itests/KarafTestSupport.java @@ -25,7 +25,6 @@ import java.nio.file.Path; import java.nio.file.Paths; import java.security.Principal; -import java.security.PrivilegedExceptionAction; import java.util.Arrays; import java.util.Collection; import java.util.Collections; @@ -36,6 +35,7 @@ import java.util.Hashtable; import java.util.Set; import java.util.concurrent.Callable; +import java.util.concurrent.CompletionException; import java.util.concurrent.ExecutionException; import java.util.concurrent.ExecutorService; import java.util.concurrent.Executors; @@ -417,11 +417,20 @@ private String executeCommand(final String command, final Long timeout, final Lo if (principals.length == 0) { commandFuture = new FutureTask<>(commandCallable); } else { - // If principals are defined, run the command callable via Subject.doAs() + // If principals are defined, run the command callable via Subject.callAs(). + // Gogo dispatches the actual command execution on its own executor thread, which + // does not inherit the ScopedValue binding set up by Subject.callAs() on JDK 25, + // so also store the subject on the session for SecuredCommand to pick back up. commandFuture = new FutureTask<>(() -> { Subject subject = new Subject(); subject.getPrincipals().addAll(Arrays.asList(principals)); - return Subject.doAs(subject, (PrivilegedExceptionAction) commandCallable::call); + session.put(Subject.class.getName(), subject); + try { + return Subject.callAs(subject, (Callable) commandCallable::call); + } catch (CompletionException e) { + // unwrap like doAs did + throw e.getCause() instanceof RuntimeException runtimeException ? runtimeException : e; + } }); } diff --git a/itests/test/src/test/java/org/apache/karaf/itests/JavaSecurityTest.java b/itests/test/src/test/java/org/apache/karaf/itests/JavaSecurityTest.java index 009a9e436d3..d2cfa7a59e1 100644 --- a/itests/test/src/test/java/org/apache/karaf/itests/JavaSecurityTest.java +++ b/itests/test/src/test/java/org/apache/karaf/itests/JavaSecurityTest.java @@ -34,7 +34,6 @@ import java.nio.file.StandardCopyOption; import java.util.*; -import static org.junit.Assert.assertNotNull; import static org.junit.Assert.fail; import static org.ops4j.pax.exam.CoreOptions.maven; import static org.ops4j.pax.exam.karaf.options.KarafDistributionOption.*; @@ -63,7 +62,8 @@ public Option[] config() { // Add some extra options used by this test... options.addAll(Arrays.asList( editConfigurationFilePut("etc/system.properties", "java.security.policy", "${karaf.etc}/all.policy"), - editConfigurationFilePut("etc/system.properties", "org.osgi.framework.security", "osgi"), + // This is no longer allowed as felix framework 7.0.5 calls System.getSecurityManager() in case it is there, see Felix.java + // editConfigurationFilePut("etc/system.properties", "org.osgi.framework.security", "osgi"), editConfigurationFilePut("etc/system.properties", "org.osgi.framework.trust.repositories", "${karaf.etc}/trustStore.ks"), editConfigurationFilePut("etc/startup.properties", "mvn:org.apache.felix/org.apache.felix.framework.security/" + version, "1"), replaceConfigurationFile("system/org/apache/felix/org.apache.felix.framework.security/" + version + "/org.apache.felix.framework.security-" + version + ".jar", temp.toFile()))); @@ -72,8 +72,6 @@ public Option[] config() { @Test public void testJavaSecurity() throws Exception { - assertNotNull("Karaf should run under a security manager", System.getSecurityManager()); - BundleService service = getOsgiService(BundleService.class); long tried = 0; while (true) { diff --git a/itests/test/src/test/java/org/apache/karaf/itests/JtaTest.java b/itests/test/src/test/java/org/apache/karaf/itests/JtaTest.java index 7a8dbc80490..04f7d3a5232 100644 --- a/itests/test/src/test/java/org/apache/karaf/itests/JtaTest.java +++ b/itests/test/src/test/java/org/apache/karaf/itests/JtaTest.java @@ -69,25 +69,17 @@ public Option[] config() { public void noSpecialFeatures() throws Exception { ClassLoader cl = FrameworkUtil.getBundle(this.getClass()).adapt(BundleWiring.class).getClassLoader(); - if (isJDK8OrEarlier()) { - // these classes should be boot delegated because they should be part of JDK8, all used ONLY - // in com.sun.corba.se.impl.javax.rmi.CORBA.Util.mapSystemException() - ensureLoadedFromSystem(cl, "jakarta.transaction.InvalidTransactionException"); - ensureLoadedFromSystem(cl, "jakarta.transaction.TransactionRequiredException"); - ensureLoadedFromSystem(cl, "jakarta.transaction.TransactionRolledbackException"); - } else { - // JDK9+ doesn't provide jakarta.transaction package at all - ensureNotFound(cl, "jakarta.transaction.InvalidTransactionException"); - ensureNotFound(cl, "jakarta.transaction.TransactionRequiredException"); - ensureNotFound(cl, "jakarta.transaction.TransactionRolledbackException"); - } + // JDK9+ doesn't provide jakarta.transaction package at all + ensureNotFound(cl, "jakarta.transaction.InvalidTransactionException"); + ensureNotFound(cl, "jakarta.transaction.TransactionRequiredException"); + ensureNotFound(cl, "jakarta.transaction.TransactionRolledbackException"); - // whatever the JDK, these classes should be available + // these classes should be available ensureLoadedFromSystem(cl, "javax.transaction.xa.XAException"); ensureLoadedFromSystem(cl, "javax.transaction.xa.XAResource"); ensureLoadedFromSystem(cl, "javax.transaction.xa.Xid"); - // whatever the JDK, these classes should NOT be available + // these classes should NOT be available ensureNotFound(cl, "jakarta.transaction.UserTransaction"); ensureNotFound(cl, "jakarta.transaction.TransactionManager"); } @@ -101,19 +93,12 @@ public void jakartaTransaction2_0() throws Exception { ClassLoader myCl = FrameworkUtil.getBundle(this.getClass()).adapt(BundleWiring.class).getClassLoader(); ClassLoader jtaCl = FrameworkUtil.getBundle(myCl.loadClass("jakarta.transaction.UserTransaction")).adapt(BundleWiring.class).getClassLoader(); - if (isJDK8OrEarlier()) { - // these classes should be boot delegated - ensureLoadedFromSystem(myCl, "jakarta.transaction.InvalidTransactionException"); - ensureLoadedFromSystem(myCl, "jakarta.transaction.TransactionRequiredException"); - ensureLoadedFromSystem(myCl, "jakarta.transaction.TransactionRolledbackException"); - } else { - // these classes ARE boot delegated, but can't be found in JDK, so they're loaded from the API bundle - ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.InvalidTransactionException"); - ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRequiredException"); - ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRolledbackException"); - } + // these classes are boot delegated, but can't be found in JDK, so they're loaded from the API bundle + ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.InvalidTransactionException"); + ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRequiredException"); + ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRolledbackException"); - // whatever the JDK, these classes should be available from system CL, even if jakarta.transaction-api/2.0.1 + // these classes should be available from system CL, even if jakarta.transaction-api/2.0.1 // exports javax.transaction.xa package ensureLoadedFromSystem(myCl, "javax.transaction.xa.XAException"); ensureLoadedFromSystem(myCl, "javax.transaction.xa.XAResource"); @@ -151,15 +136,9 @@ public void jakartaTransaction2_0AndDBCP2() throws Exception { ClassLoader myCl = FrameworkUtil.getBundle(this.getClass()).adapt(BundleWiring.class).getClassLoader(); ClassLoader jtaCl = FrameworkUtil.getBundle(myCl.loadClass("jakarta.transaction.UserTransaction")).adapt(BundleWiring.class).getClassLoader(); - if (isJDK8OrEarlier()) { - ensureLoadedFromSystem(myCl, "jakarta.transaction.InvalidTransactionException"); - ensureLoadedFromSystem(myCl, "jakarta.transaction.TransactionRequiredException"); - ensureLoadedFromSystem(myCl, "jakarta.transaction.TransactionRolledbackException"); - } else { - ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.InvalidTransactionException"); - ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRequiredException"); - ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRolledbackException"); - } + ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.InvalidTransactionException"); + ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRequiredException"); + ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRolledbackException"); ensureLoadedFromSystem(myCl, "javax.transaction.xa.Xid"); ensureLoadedFromSystem(jtaCl, "javax.transaction.xa.Xid"); @@ -190,15 +169,9 @@ public void jakartaTransaction2_0_1AndDBCP2() throws Exception { ClassLoader myCl = FrameworkUtil.getBundle(this.getClass()).adapt(BundleWiring.class).getClassLoader(); ClassLoader jtaCl = FrameworkUtil.getBundle(myCl.loadClass("jakarta.transaction.UserTransaction")).adapt(BundleWiring.class).getClassLoader(); - if (isJDK8OrEarlier()) { - ensureLoadedFromSystem(myCl, "jakarta.transaction.InvalidTransactionException"); - ensureLoadedFromSystem(myCl, "jakarta.transaction.TransactionRequiredException"); - ensureLoadedFromSystem(myCl, "jakarta.transaction.TransactionRolledbackException"); - } else { - ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.InvalidTransactionException"); - ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRequiredException"); - ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRolledbackException"); - } + ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.InvalidTransactionException"); + ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRequiredException"); + ensureLoadedFromCl(myCl, jtaCl, "jakarta.transaction.TransactionRolledbackException"); ensureLoadedFromSystem(jtaCl, "javax.transaction.xa.Xid"); ensureLoadedFromSystem(myCl, "javax.transaction.xa.Xid"); @@ -235,19 +208,4 @@ private void ensureNotFound(ClassLoader cl, String className) { } } - private boolean isJDK8OrEarlier() { - String v = System.getProperty("java.specification.version"); - try { - if (v.contains(".")) { - float f = Float.parseFloat(v); - return f < 1.9F; - } else { - int i = Integer.parseInt(v); - return i < 9; - } - } catch (NumberFormatException ignored) { - return true; - } - } - } diff --git a/itests/test/src/test/java/org/apache/karaf/itests/features/EnterpriseFeaturesTest.java b/itests/test/src/test/java/org/apache/karaf/itests/features/EnterpriseFeaturesTest.java index 5e1253f8cda..852a11cbac4 100644 --- a/itests/test/src/test/java/org/apache/karaf/itests/features/EnterpriseFeaturesTest.java +++ b/itests/test/src/test/java/org/apache/karaf/itests/features/EnterpriseFeaturesTest.java @@ -14,7 +14,6 @@ package org.apache.karaf.itests.features; import org.apache.karaf.itests.BaseTest; -import org.apache.karaf.itests.util.RunIfRules.RunIfNotOnJdk8; import org.apache.karaf.itests.util.RunIfRule; import org.junit.Ignore; diff --git a/itests/test/src/test/java/org/apache/karaf/itests/util/RunIfRules.java b/itests/test/src/test/java/org/apache/karaf/itests/util/RunIfRules.java deleted file mode 100644 index 35c253b5134..00000000000 --- a/itests/test/src/test/java/org/apache/karaf/itests/util/RunIfRules.java +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.apache.karaf.itests.util; - -import java.lang.annotation.Inherited; -import java.lang.annotation.Retention; -import java.lang.annotation.RetentionPolicy; - -import org.apache.karaf.itests.util.RunIfRule.RunIf; -import org.apache.karaf.itests.util.RunIfRule.RunIfCondition; - -public class RunIfRules { - - @RunIf(condition = RunIfNotOnJdk8Condition.class) - @Retention(RetentionPolicy.RUNTIME) - @Inherited - public @interface RunIfNotOnJdk8 { - - } - - public static class RunIfNotOnJdk8Condition implements RunIfCondition { - @Override - public boolean isSatisfied() { - String jdk = System.getProperty("java.specification.version"); - return jdk.equals("1.5") || jdk.equals("1.6") || jdk.equals("1.7"); - } - } - -} diff --git a/jaas/command/src/main/java/org/apache/karaf/jaas/command/SudoCommand.java b/jaas/command/src/main/java/org/apache/karaf/jaas/command/SudoCommand.java index 18e57e56fba..11d26b9c3c9 100644 --- a/jaas/command/src/main/java/org/apache/karaf/jaas/command/SudoCommand.java +++ b/jaas/command/src/main/java/org/apache/karaf/jaas/command/SudoCommand.java @@ -74,7 +74,15 @@ public Object execute() throws Exception { } sb.append(s); } - JaasHelper.doAs(subject, (PrivilegedExceptionAction) () -> session.execute(sb)); + // Gogo runs the command on pool threads that do not inherit the doAs binding; + // SecuredCommand falls back to the session's subject there, so switch it too. + Object previous = session.get(Subject.class.getName()); + session.put(Subject.class.getName(), subject); + try { + JaasHelper.doAs(subject, (PrivilegedExceptionAction) () -> session.execute(sb)); + } finally { + session.put(Subject.class.getName(), previous); + } loginContext.logout(); return null; diff --git a/jaas/command/src/main/java/org/apache/karaf/jaas/command/WhoamiCommand.java b/jaas/command/src/main/java/org/apache/karaf/jaas/command/WhoamiCommand.java index 3ce1e5dc6df..f2cbfdbfb55 100644 --- a/jaas/command/src/main/java/org/apache/karaf/jaas/command/WhoamiCommand.java +++ b/jaas/command/src/main/java/org/apache/karaf/jaas/command/WhoamiCommand.java @@ -16,8 +16,6 @@ package org.apache.karaf.jaas.command; -import java.security.AccessControlContext; -import java.security.AccessController; import java.security.Principal; import java.util.Set; @@ -55,8 +53,7 @@ public Object execute() throws Exception { ShellTable table = new ShellTable(); // Get the currently-active JAAS Subject. - AccessControlContext acc = AccessController.getContext(); - Subject subj = Subject.getSubject(acc); + Subject subj = Subject.current(); String classString = USER_CLASS; if (groups) { diff --git a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/ldap/GSSAPILdapLoginModule.java b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/ldap/GSSAPILdapLoginModule.java index 2c911765529..06634c4c98a 100644 --- a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/ldap/GSSAPILdapLoginModule.java +++ b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/ldap/GSSAPILdapLoginModule.java @@ -29,11 +29,11 @@ import javax.security.auth.login.LoginContext; import javax.security.auth.login.LoginException; import java.io.IOException; -import java.security.PrivilegedActionException; -import java.security.PrivilegedExceptionAction; import java.util.HashMap; import java.util.HashSet; import java.util.Map; +import java.util.concurrent.Callable; +import java.util.concurrent.CompletionException; /** * Specific LDAPLoginModule to be used with GSSAPI. Uses the specified realm as login context. @@ -62,9 +62,13 @@ public boolean login() throws LoginException { context.login(); try { - succeeded = Subject.doAs(context.getSubject(), (PrivilegedExceptionAction) this::doLogin); + succeeded = Subject.callAs(context.getSubject(), (Callable) this::doLogin); return succeeded; - } catch (PrivilegedActionException pExcp) { + } catch (CompletionException pExcp) { + // callAs wraps unchecked exceptions too; rethrow them like doAs did instead of reporting a failed login + if (pExcp.getCause() instanceof RuntimeException runtimeException) { + throw runtimeException; + } logger.error("error with delegated authentication", pExcp); throw new LoginException(pExcp.getMessage()); } diff --git a/main/src/test/java/org/apache/karaf/main/MainLockingTest.java b/main/src/test/java/org/apache/karaf/main/MainLockingTest.java index ac01543343c..d1beb601343 100644 --- a/main/src/test/java/org/apache/karaf/main/MainLockingTest.java +++ b/main/src/test/java/org/apache/karaf/main/MainLockingTest.java @@ -38,6 +38,16 @@ public class MainLockingTest { private File data; private File log; + private Bundle installTimeoutShutdownBundle(Framework framework) throws Exception { + return framework.getBundleContext().installBundle("foo", + TinyBundles.bundle() + .addClass(TimeoutShutdownActivator.class) + .setHeader(Constants.BUNDLE_ACTIVATOR, TimeoutShutdownActivator.class.getName()) + .setHeader(Constants.IMPORT_PACKAGE, "org.osgi.framework") + .build(TinyBundles.bndBuilder()) + ); + } + @Before public void setUp() throws IOException { File basedir = new File(getClass().getClassLoader().getResource("foo").getPath()).getParentFile(); @@ -82,12 +92,7 @@ public void testLostMasterLock() throws Exception { Main main = new Main(args); main.launch(); Framework framework = main.getFramework(); - Bundle bundle = framework.getBundleContext().installBundle("foo", - TinyBundles.bundle() - .addClass(TimeoutShutdownActivator.class) - .setHeader(Constants.BUNDLE_ACTIVATOR, TimeoutShutdownActivator.class.getName()) - .build(TinyBundles.bndBuilder()) - ); + Bundle bundle = installTimeoutShutdownBundle(framework); bundle.start(); @@ -127,12 +132,7 @@ public void testRetainsMasterLockOverFluctuation() throws Exception { Main main = new Main(args); main.launch(); Framework framework = main.getFramework(); - Bundle bundle = framework.getBundleContext().installBundle("foo", - TinyBundles.bundle() - .setHeader(Constants.BUNDLE_ACTIVATOR, TimeoutShutdownActivator.class.getName()) - .addClass(TimeoutShutdownActivator.class) - .build(TinyBundles.bndBuilder()) - ); + Bundle bundle = installTimeoutShutdownBundle(framework); bundle.start(); @@ -172,11 +172,7 @@ public void testLostMasterLockAfterThreshold() throws Exception { Main main = new Main(args); main.launch(); Framework framework = main.getFramework(); - Bundle bundle = framework.getBundleContext().installBundle("foo", - TinyBundles.bundle() - .setHeader(Constants.BUNDLE_ACTIVATOR, TimeoutShutdownActivator.class.getName()) - .addClass(TimeoutShutdownActivator.class) - .build(TinyBundles.bndBuilder())); + Bundle bundle = installTimeoutShutdownBundle(framework); bundle.start(); diff --git a/management/server/src/main/java/org/apache/karaf/management/internal/BulkRequestContext.java b/management/server/src/main/java/org/apache/karaf/management/internal/BulkRequestContext.java index 7d1e0641e80..410ebb6dd93 100644 --- a/management/server/src/main/java/org/apache/karaf/management/internal/BulkRequestContext.java +++ b/management/server/src/main/java/org/apache/karaf/management/internal/BulkRequestContext.java @@ -17,8 +17,6 @@ package org.apache.karaf.management.internal; import java.io.IOException; -import java.security.AccessControlContext; -import java.security.AccessController; import java.security.Principal; import java.util.ArrayList; import java.util.Dictionary; @@ -48,7 +46,7 @@ public class BulkRequestContext { private ConfigurationAdmin configAdmin; - // if there's AccessControlContext or subject, we can fail fast + // if there's no subject, we can fail fast private boolean anonymous = false; // otherwise we can cache current subject's principals for faster access private Set principals = new HashSet<>(); @@ -63,16 +61,11 @@ public static BulkRequestContext newContext(ConfigurationAdmin configAdmin) thro context.configAdmin = configAdmin; try { // check JAAS subject here - AccessControlContext acc = AccessController.getContext(); - if (acc == null) { + Subject subject = Subject.current(); + if (subject == null) { context.anonymous = true; } else { - Subject subject = Subject.getSubject(acc); - if (subject == null) { - context.anonymous = true; - } else { - context.principals.addAll(subject.getPrincipals()); - } + context.principals.addAll(subject.getPrincipals()); } // list available ACL configs - valid for this instance only for (Configuration config : configAdmin.listConfigurations("(service.pid=jmx.acl*)")) { diff --git a/management/server/src/test/java/org/apache/karaf/management/KarafMBeanServerGuardTest.java b/management/server/src/test/java/org/apache/karaf/management/KarafMBeanServerGuardTest.java index dbaa404fcae..e8d481c9665 100644 --- a/management/server/src/test/java/org/apache/karaf/management/KarafMBeanServerGuardTest.java +++ b/management/server/src/test/java/org/apache/karaf/management/KarafMBeanServerGuardTest.java @@ -33,8 +33,8 @@ import java.io.IOException; import java.lang.reflect.Method; import java.security.Principal; -import java.security.PrivilegedAction; import java.util.*; +import java.util.concurrent.Callable; public class KarafMBeanServerGuardTest extends TestCase { @@ -462,7 +462,7 @@ private static ConfigurationAdmin getMockConfigAdmin2(Dictionary public void testCurrentUserHasRole() throws Exception { Subject subject = loginWithTestRoles("test"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { assertTrue(JaasHelper.currentUserHasRole("test")); assertFalse(JaasHelper.currentUserHasRole("toast")); return null; @@ -476,7 +476,7 @@ public void testCurrentUserHasCustomRole() throws Exception { lm.login(); lm.commit(); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { assertTrue(JaasHelper.currentUserHasRole(TestRolePrincipal.class.getCanonicalName() + ":foo")); assertFalse(JaasHelper.currentUserHasRole("foo")); return null; @@ -493,7 +493,7 @@ public void testInvoke() throws Throwable { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("editor", "admin"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { Method im = MBeanServer.class.getMethod("invoke", ObjectName.class, String.class, Object[].class, String[].class); @@ -539,7 +539,7 @@ public void testCreateRegisterUnregisterMBeanRequireRole() throws Throwable { final ObjectName on = ObjectName.getInstance("foo.bar:type=Test"); Subject viewer = loginWithTestRoles("viewer"); - Subject.doAs(viewer, (PrivilegedAction) () -> { + Subject.callAs(viewer, (Callable) () -> { try { guard.invoke(null, createMBean, new Object[]{"javax.management.loading.MLet", on}); fail("createMBean should be blocked for a non-admin user"); @@ -568,7 +568,7 @@ public void testCreateRegisterUnregisterMBeanRequireRole() throws Throwable { }); Subject admin = loginWithTestRoles("admin"); - Subject.doAs(admin, (PrivilegedAction) () -> { + Subject.callAs(admin, (Callable) () -> { try { // none of these should throw for an admin user guard.invoke(null, createMBean, new Object[]{"javax.management.loading.MLet", on}); @@ -594,7 +594,7 @@ public void testCreateMBeanWithNullObjectName() throws Throwable { final Method createMBean = MBeanServer.class.getMethod("createMBean", String.class, ObjectName.class); Subject viewer = loginWithTestRoles("viewer"); - Subject.doAs(viewer, (PrivilegedAction) () -> { + Subject.callAs(viewer, (Callable) () -> { try { // a null ObjectName falls back to the generic jmx.acl configuration guard.invoke(null, createMBean, new Object[]{"javax.management.loading.MLet", null}); @@ -608,7 +608,7 @@ public void testCreateMBeanWithNullObjectName() throws Throwable { }); Subject admin = loginWithTestRoles("admin"); - Subject.doAs(admin, (PrivilegedAction) () -> { + Subject.callAs(admin, (Callable) () -> { try { guard.invoke(null, createMBean, new Object[]{"javax.management.loading.MLet", null}); return null; @@ -631,7 +631,7 @@ public void testCreateMBeanClassNameMatch() throws Throwable { final ObjectName on = ObjectName.getInstance("foo.bar:type=Test"); Subject viewer = loginWithTestRoles("viewer"); - Subject.doAs(viewer, (PrivilegedAction) () -> { + Subject.callAs(viewer, (Callable) () -> { try { // a "regular" class only requires the viewer role guard.invoke(null, createMBean, new Object[]{"com.example.Foo", on}); @@ -676,7 +676,7 @@ public void testGetAttributeIs() throws Throwable { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("editor", "admin"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { Method im = MBeanServer.class.getMethod("getAttribute", ObjectName.class, String.class); @@ -722,7 +722,7 @@ public void testGetAttributes() throws Throwable { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("editor", "admin"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { Method im = MBeanServer.class.getMethod("getAttributes", ObjectName.class, String[].class); @@ -770,7 +770,7 @@ public void testGetAttributes2() throws Throwable { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("editor", "admin"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { Method im = MBeanServer.class.getMethod("getAttributes", ObjectName.class, String[].class); @@ -817,7 +817,7 @@ public void testSetAttribute() throws Throwable { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("editor", "admin"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { Method im = MBeanServer.class.getMethod("setAttribute", ObjectName.class, Attribute.class); @@ -871,7 +871,7 @@ public void testSetAttributes() throws Throwable { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("editor", "admin"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { Method im = MBeanServer.class.getMethod("setAttributes", ObjectName.class, AttributeList.class); @@ -939,7 +939,7 @@ public void testCanInvokeMBean() throws Exception { Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(mbs, on)); assertFalse(guard.canInvoke(mbs, on2)); @@ -980,7 +980,7 @@ public void testCanInvokeMBean2() throws Exception { Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertFalse(guard.canInvoke(mbs, on)); @@ -1018,7 +1018,7 @@ public void testCanInvokeAnyOverload() throws Exception { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(mbs, on, "doit")); @@ -1057,7 +1057,7 @@ public void testCanInvokeAnyOverload2() throws Exception { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertFalse(guard.canInvoke(mbs, on, "doit")); @@ -1089,7 +1089,7 @@ public void testCanInvokeAnyOverload3() throws Exception { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertFalse(guard.canInvoke(mbs, on, "doit")); @@ -1123,7 +1123,7 @@ public void testCanGetAttributeAnyOverload() throws Exception { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(mbs, on, "getFoo")); @@ -1157,7 +1157,7 @@ public void testCanGetAttributeAnyOverload2() throws Exception { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertFalse(guard.canInvoke(mbs, on, "getFoo")); @@ -1192,7 +1192,7 @@ public void testCanGetAttributeAnyOverload3() throws Exception { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(mbs, on, "isFoo")); @@ -1227,7 +1227,7 @@ public void testCanGetAttributeAnyOverload4() throws Exception { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertFalse(guard.canInvoke(mbs, on, "isFoo")); @@ -1261,7 +1261,7 @@ public void testCanSetAttributeAnyOverload() throws Exception { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(mbs, on, "setFoo")); @@ -1295,7 +1295,7 @@ public void testCanSetAttributeAnyOverload2() throws Exception { guard.setConfigAdmin(ca); Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertFalse(guard.canInvoke(mbs, on, "setFoo")); @@ -1331,7 +1331,7 @@ public void testCanInvokeMBeanGetter() throws Exception { Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(mbs, on)); @@ -1367,7 +1367,7 @@ public void testCanInvokeMBeanGetter2() throws Exception { Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertFalse(guard.canInvoke(mbs, on)); @@ -1403,7 +1403,7 @@ public void testCanInvokeMBeanGetter3() throws Exception { Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(mbs, on)); @@ -1439,7 +1439,7 @@ public void testCanInvokeMBeanSetter() throws Exception { Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(mbs, on)); @@ -1475,7 +1475,7 @@ public void testCanInvokeMBeanSetter2() throws Exception { Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertFalse(guard.canInvoke(mbs, on)); @@ -1503,7 +1503,7 @@ public void testCanInvokeMethod() throws Exception { Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(null, on, "dodo", new String[]{"java.lang.String"})); assertTrue(guard.canInvoke(null, on, "doit", new String[]{"java.lang.String", "java.lang.String"})); @@ -1536,7 +1536,7 @@ public void testCanInvokeMethod2() throws Exception { Subject subject = loginWithTestRoles("viewer"); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { assertTrue(guard.canInvoke(null, on, "doit", new String[]{"java.lang.String"})); assertTrue(guard.canInvoke(null, on, "doit", new String[]{})); diff --git a/pom.xml b/pom.xml index fe69a69f30b..95311efdfae 100644 --- a/pom.xml +++ b/pom.xml @@ -150,7 +150,9 @@ 1695310533 - 11 + 21 + ${javaVersion} + ${javaVersion} scm:git:https://gitbox.apache.org/repos/asf/karaf.git scm:git:https://gitbox.apache.org/repos/asf/karaf.git @@ -451,6 +453,15 @@ + + org.apache.maven.plugins + maven-compiler-plugin + + + -Xlint:deprecation + + + org.apache.maven.plugins maven-eclipse-plugin @@ -639,7 +650,8 @@ [3.8.8,4) - [17,) + + [${javaVersion},) @@ -907,7 +919,7 @@ org.apache.maven.plugins maven-javadoc-plugin - 1.8 + ${javaVersion} diff --git a/service/guard/src/test/java/org/apache/karaf/service/guard/impl/GuardProxyCatalogTest.java b/service/guard/src/test/java/org/apache/karaf/service/guard/impl/GuardProxyCatalogTest.java index 21bb8f993f1..54bb4b737d3 100644 --- a/service/guard/src/test/java/org/apache/karaf/service/guard/impl/GuardProxyCatalogTest.java +++ b/service/guard/src/test/java/org/apache/karaf/service/guard/impl/GuardProxyCatalogTest.java @@ -28,9 +28,9 @@ import java.io.IOException; import java.security.Principal; -import java.security.PrivilegedAction; import java.util.ArrayList; import java.util.Arrays; +import java.util.concurrent.Callable; import java.util.Collection; import java.util.Collections; import java.util.Dictionary; @@ -338,7 +338,7 @@ public void testInvocationBlocking1() throws Exception { // Run with the right credentials so we can test the expected roles Subject subject = new Subject(); subject.getPrincipals().add(new RolePrincipal("b")); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { assertEquals("Doing it", ((TestServiceAPI) proxy).doit()); if (!runningUnderCoverage) { try { @@ -369,7 +369,7 @@ public void testInvocationBlocking2() throws Exception { // Run with the right credentials so we can test the expected roles Subject subject = new Subject(); subject.getPrincipals().add(new RolePrincipal("b")); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { if (!runningUnderCoverage) { assertEquals(-42L, ((TestObjectWithoutInterface) proxy).compute(42L)); try { @@ -414,7 +414,7 @@ public String doit() { // Run with the right credentials so we can test the expected roles Subject subject = new Subject(); subject.getPrincipals().add(new RolePrincipal("c")); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { assertEquals("Doing it", ((TestServiceAPI) proxy).doit()); return null; }); @@ -422,7 +422,7 @@ public String doit() { Subject subject2 = new Subject(); subject2.getPrincipals().add(new RolePrincipal("b")); subject2.getPrincipals().add(new RolePrincipal("f")); - Subject.doAs(subject2, (PrivilegedAction) () -> { + Subject.callAs(subject2, (Callable) () -> { try { assertEquals("Doing it", ((TestServiceAPI) proxy).doit()); fail("Should have been blocked"); @@ -450,7 +450,7 @@ public void testInvocationBlocking4() throws Exception { // Run with the right credentials so we can test the expected roles Subject subject = new Subject(); subject.getPrincipals().add(new RolePrincipal("b")); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { assertEquals("Doing it", ((TestServiceAPI) proxy).doit()); if (!runningUnderCoverage) { assertEquals(42L, ((TestObjectWithoutInterface) proxy).compute(-42L)); @@ -478,7 +478,7 @@ public void testInvocationBlocking5() throws Exception { // Invoke the service with role 'c'. Subject subject = new Subject(); subject.getPrincipals().add(new RolePrincipal("c")); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { assertEquals("The invocation under role 'c' should be ok, as there are no rules specified " + "for this service at all.", "HELLO", ((TestServiceAPI2) proxy).doit("hello")); return null; @@ -507,7 +507,7 @@ public void testInvocationBlocking6() throws Exception { subject.getPrincipals().add(new RolePrincipal("a")); subject.getPrincipals().add(new RolePrincipal("b")); subject.getPrincipals().add(new RolePrincipal("c")); - Subject.doAs(subject, (PrivilegedAction) () -> { + Subject.callAs(subject, (Callable) () -> { try { ((TestServiceAPI2) proxy).doit("hello"); fail("The invocation should not process as the 'doit' operation has no roles associated with it"); @@ -533,7 +533,7 @@ public void testInvocationBlocking7() throws Exception { final Object proxy = testCreateProxy(bc, new Class [] {TestServiceAPI3.class}, new TestService3()); Subject s1 = new Subject(); - Subject.doAs(s1, (PrivilegedAction) () -> { + Subject.callAs(s1, (Callable) () -> { TestServiceAPI3 obj = (TestServiceAPI3) proxy; assertEquals("Should have allowed this invocation for any (or no) role", -7, obj.foo(7)); try { @@ -556,7 +556,7 @@ public void testInvocationBlocking7() throws Exception { s2.getPrincipals().add(new RolePrincipal("a")); s2.getPrincipals().add(new RolePrincipal("b")); s2.getPrincipals().add(new RolePrincipal("d")); - Subject.doAs(s2, (PrivilegedAction) () -> { + Subject.callAs(s2, (Callable) () -> { TestServiceAPI3 obj = (TestServiceAPI3) proxy; assertEquals(42, obj.foo()); assertEquals(99, obj.bar()); @@ -585,7 +585,7 @@ public String getName() { Subject s1 = new Subject(); s1.getPrincipals().add(new RolePrincipal("role1")); - Subject.doAs(s1, (PrivilegedAction) () -> { + Subject.callAs(s1, (Callable) () -> { try { ((TestServiceAPI) proxy).doit(); fail("Should have prevented this invocation as the custom role is required"); @@ -598,7 +598,7 @@ public String getName() { Subject s2 = new Subject(); s2.getPrincipals().add(new MyRolePrincipal()); - Subject.doAs(s2, (PrivilegedAction) () -> { + Subject.callAs(s2, (Callable) () -> { ((TestServiceAPI) proxy).doit(); // Should work, the custom role is there return null; }); @@ -606,7 +606,7 @@ public String getName() { Subject s3 = new Subject(); s3.getPrincipals().add(new MyRolePrincipal()); s3.getPrincipals().add(new RolePrincipal("role1")); - Subject.doAs(s3, (PrivilegedAction) () -> { + Subject.callAs(s3, (Callable) () -> { ((TestServiceAPI) proxy).doit(); // Should work, the custom role is there return null; }); diff --git a/services/eventadmin/src/main/java/org/apache/felix/eventadmin/impl/handler/EventAdminImpl.java b/services/eventadmin/src/main/java/org/apache/felix/eventadmin/impl/handler/EventAdminImpl.java index 5491865dd9a..b44c66b6267 100644 --- a/services/eventadmin/src/main/java/org/apache/felix/eventadmin/impl/handler/EventAdminImpl.java +++ b/services/eventadmin/src/main/java/org/apache/felix/eventadmin/impl/handler/EventAdminImpl.java @@ -18,7 +18,6 @@ */ package org.apache.felix.eventadmin.impl.handler; -import java.security.AccessController; import java.util.HashMap; import javax.security.auth.Subject; @@ -143,7 +142,7 @@ private Event prepareEvent(Event event) { boolean needSubject = addSubject && !event.containsProperty(SUBJECT); Subject subject = null; if (needSubject) { - subject = Subject.getSubject(AccessController.getContext()); + subject = Subject.current(); needSubject = (subject != null); } if (needTimeStamp || needSubject) { diff --git a/shell/console/src/main/java/org/apache/karaf/shell/security/impl/SecuredCommandProcessorImpl.java b/shell/console/src/main/java/org/apache/karaf/shell/security/impl/SecuredCommandProcessorImpl.java index 8ae524c936d..2602b54ac75 100644 --- a/shell/console/src/main/java/org/apache/karaf/shell/security/impl/SecuredCommandProcessorImpl.java +++ b/shell/console/src/main/java/org/apache/karaf/shell/security/impl/SecuredCommandProcessorImpl.java @@ -34,8 +34,6 @@ import javax.security.auth.Subject; -import java.security.AccessControlContext; -import java.security.AccessController; import java.util.ArrayList; import java.util.List; import java.util.Set; @@ -58,8 +56,7 @@ private SecuredCommandProcessorImpl(BundleContext bc, ServiceReference bundleContext = bc; threadIOServiceReference = sr; - AccessControlContext acc = AccessController.getContext(); - Subject sub = Subject.getSubject(acc); + Subject sub = Subject.current(); if (sub == null) throw new SecurityException("No current Subject in the Access Control Context"); diff --git a/shell/console/src/main/java/org/apache/karaf/shell/util/ShellUtil.java b/shell/console/src/main/java/org/apache/karaf/shell/util/ShellUtil.java index 5942a890df8..1cafec8eb36 100644 --- a/shell/console/src/main/java/org/apache/karaf/shell/util/ShellUtil.java +++ b/shell/console/src/main/java/org/apache/karaf/shell/util/ShellUtil.java @@ -23,8 +23,6 @@ import static org.apache.karaf.shell.commands.ansi.SimpleAnsi.INTENSITY_BOLD; import static org.apache.karaf.shell.commands.ansi.SimpleAnsi.INTENSITY_NORMAL; -import java.security.AccessControlContext; -import java.security.AccessController; import java.util.Arrays; import javax.security.auth.Subject; @@ -170,8 +168,7 @@ public static void logException(CommandSession session, Throwable t) { } public static String getCurrentUserName() { - AccessControlContext acc = AccessController.getContext(); - final Subject subject = Subject.getSubject(acc); + final Subject subject = Subject.current(); if (subject != null && subject.getPrincipals(UserPrincipal.class).iterator().hasNext()) { return subject.getPrincipals(UserPrincipal.class).iterator().next().getName(); } else { diff --git a/shell/core/src/main/java/org/apache/karaf/shell/impl/console/ConsoleSessionImpl.java b/shell/core/src/main/java/org/apache/karaf/shell/impl/console/ConsoleSessionImpl.java index 32e2cb65061..e9a4fdd9a7a 100644 --- a/shell/core/src/main/java/org/apache/karaf/shell/impl/console/ConsoleSessionImpl.java +++ b/shell/core/src/main/java/org/apache/karaf/shell/impl/console/ConsoleSessionImpl.java @@ -39,6 +39,8 @@ import java.util.regex.Pattern; import java.util.stream.Collectors; +import javax.security.auth.Subject; + import org.apache.felix.gogo.jline.ParsedLineImpl; import org.apache.felix.gogo.jline.Shell; import org.apache.felix.gogo.runtime.CommandSessionImpl; @@ -64,6 +66,7 @@ import org.apache.karaf.shell.support.completers.FileOrUriCompleter; import org.apache.karaf.shell.support.completers.UriCompleter; import org.apache.karaf.util.filesstream.FilesStream; +import org.apache.karaf.util.jaas.JaasHelper; import org.jline.builtins.Completers; import org.jline.reader.*; import org.jline.terminal.Size; @@ -219,6 +222,12 @@ public ConsoleSessionImpl(SessionFactory factory, session.put(Session.COMPLETION_MODE, loadCompletionMode()); session.put(Session.DISABLE_EOF_EXIT, loadDisableEofExit()); session.put("USER", ShellUtil.getCurrentUserName()); + // Remember the creator's subject: Subject.callAs() bindings are not inherited by the + // session thread or Gogo's pool threads, see run() and SecuredCommand. + Subject subject = Subject.current(); + if (subject != null) { + session.put(Subject.class.getName(), subject); + } session.put("TERM", terminal.getType()); session.put("APPLICATION", System.getProperty("karaf.name", "root")); session.put("#LINES", (Function) (session, arguments) -> Integer.toString(terminal.getHeight())); @@ -368,6 +377,15 @@ public void close() { } public void run() { + Subject subject = (Subject) session.get(Subject.class.getName()); + if (subject != null) { + JaasHelper.runAs(subject, this::doRun); + } else { + doRun(); + } + } + + private void doRun() { try { threadIO.setStreams(session.getKeyboard(), out, err); thread = Thread.currentThread(); diff --git a/shell/core/src/main/java/org/apache/karaf/shell/impl/console/osgi/secured/SecuredCommand.java b/shell/core/src/main/java/org/apache/karaf/shell/impl/console/osgi/secured/SecuredCommand.java index 2df6e097fd7..4e304c31306 100644 --- a/shell/core/src/main/java/org/apache/karaf/shell/impl/console/osgi/secured/SecuredCommand.java +++ b/shell/core/src/main/java/org/apache/karaf/shell/impl/console/osgi/secured/SecuredCommand.java @@ -18,8 +18,12 @@ */ package org.apache.karaf.shell.impl.console.osgi.secured; +import java.security.PrivilegedActionException; +import java.security.PrivilegedExceptionAction; import java.util.List; +import javax.security.auth.Subject; + import org.apache.felix.gogo.runtime.Closure; import org.apache.felix.gogo.runtime.Token; import org.apache.felix.service.command.CommandSession; @@ -28,6 +32,7 @@ import org.apache.karaf.shell.api.console.Completer; import org.apache.karaf.shell.api.console.Parser; import org.apache.karaf.shell.api.console.Session; +import org.apache.karaf.util.jaas.JaasHelper; public class SecuredCommand implements Command, Function { @@ -64,8 +69,24 @@ public Parser getParser() { @Override public Object execute(Session session, List arguments) throws Exception { - factory.checkSecurity(getScope(), getName(), arguments); - return command.execute(session, arguments); + // Gogo runs commands on its session's pool threads. Those threads either have no + // subject bound (JDK 24+: Subject.callAs() uses a ScopedValue, which does not cross + // an ExecutorService task boundary) or one inherited from whatever thread created + // them (JDK 21: AccessControlContext inheritance, possibly from an earlier + // jaas:sudo). So the session's subject is authoritative; jaas:sudo switches it while + // its command runs. Subject.current() is only a fallback for sessions without one. + Subject subject = (Subject) session.get(Subject.class.getName()); + if (subject == null) { + subject = Subject.current(); + } + try { + return JaasHelper.doAs(subject, (PrivilegedExceptionAction) () -> { + factory.checkSecurity(getScope(), getName(), arguments); + return command.execute(session, arguments); + }); + } catch (PrivilegedActionException e) { + throw e.getException(); + } } @Override diff --git a/shell/core/src/main/java/org/apache/karaf/shell/impl/console/osgi/secured/SecuredSessionFactoryImpl.java b/shell/core/src/main/java/org/apache/karaf/shell/impl/console/osgi/secured/SecuredSessionFactoryImpl.java index e9544265ea6..e43b26c8bf0 100644 --- a/shell/core/src/main/java/org/apache/karaf/shell/impl/console/osgi/secured/SecuredSessionFactoryImpl.java +++ b/shell/core/src/main/java/org/apache/karaf/shell/impl/console/osgi/secured/SecuredSessionFactoryImpl.java @@ -19,8 +19,6 @@ package org.apache.karaf.shell.impl.console.osgi.secured; import java.nio.file.Path; -import java.security.AccessControlContext; -import java.security.AccessController; import java.security.Principal; import java.util.ArrayList; import java.util.Arrays; @@ -278,11 +276,7 @@ static boolean currentUserHasRole(String requestedRole) { role = requestedRole; } - AccessControlContext acc = AccessController.getContext(); - if (acc == null) { - return false; - } - Subject subject = Subject.getSubject(acc); + Subject subject = Subject.current(); if (subject == null) { return false; diff --git a/shell/core/src/main/java/org/apache/karaf/shell/support/ShellUtil.java b/shell/core/src/main/java/org/apache/karaf/shell/support/ShellUtil.java index 862a895c8e4..fc64f37a8da 100644 --- a/shell/core/src/main/java/org/apache/karaf/shell/support/ShellUtil.java +++ b/shell/core/src/main/java/org/apache/karaf/shell/support/ShellUtil.java @@ -23,8 +23,6 @@ import java.io.PrintWriter; import java.io.StringWriter; import java.nio.file.Paths; -import java.security.AccessControlContext; -import java.security.AccessController; import java.util.Arrays; import java.util.Collection; import java.util.Map; @@ -212,8 +210,7 @@ private static String getPrintStackTraces(Session session) { } public static String getCurrentUserName() { - AccessControlContext acc = AccessController.getContext(); - final Subject subject = Subject.getSubject(acc); + final Subject subject = Subject.current(); if (subject != null && subject.getPrincipals(UserPrincipal.class).iterator().hasNext()) { return subject.getPrincipals(UserPrincipal.class).iterator().next().getName(); } else { diff --git a/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/ShellCommand.java b/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/ShellCommand.java index 67fa7f43a15..69f8553176d 100644 --- a/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/ShellCommand.java +++ b/shell/ssh/src/main/java/org/apache/karaf/shell/ssh/ShellCommand.java @@ -51,12 +51,6 @@ public class ShellCommand implements Command { private static final Logger LOGGER = LoggerFactory.getLogger(ShellCommand.class); - private static final Class[] SECURITY_BUGFIX = { - JaasHelper.class, - JaasHelper.OsgiSubjectDomainCombiner.class, - JaasHelper.DelegatingProtectionDomain.class, - }; - private String command; private InputStream in; private OutputStream out; diff --git a/tooling/karaf-maven-plugin/pom.xml b/tooling/karaf-maven-plugin/pom.xml index 1532c95444c..c6dc8233219 100644 --- a/tooling/karaf-maven-plugin/pom.xml +++ b/tooling/karaf-maven-plugin/pom.xml @@ -382,8 +382,7 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 + 21 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-aggregate-features/pom.xml b/tooling/karaf-maven-plugin/src/it/test-aggregate-features/pom.xml index f0009ac396c..efc3d39e8fa 100644 --- a/tooling/karaf-maven-plugin/src/it/test-aggregate-features/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-aggregate-features/pom.xml @@ -47,8 +47,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-basic-generation/pom.xml b/tooling/karaf-maven-plugin/src/it/test-basic-generation/pom.xml index 45122f8b064..54ca3b8a673 100644 --- a/tooling/karaf-maven-plugin/src/it/test-basic-generation/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-basic-generation/pom.xml @@ -36,8 +36,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-check-dependencies-failure/pom.xml b/tooling/karaf-maven-plugin/src/it/test-check-dependencies-failure/pom.xml index f4b22b2f53f..29fc8781486 100644 --- a/tooling/karaf-maven-plugin/src/it/test-check-dependencies-failure/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-check-dependencies-failure/pom.xml @@ -43,8 +43,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-check-dependencies/pom.xml b/tooling/karaf-maven-plugin/src/it/test-check-dependencies/pom.xml index fb2e03ac23e..a83ec2b9078 100644 --- a/tooling/karaf-maven-plugin/src/it/test-check-dependencies/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-check-dependencies/pom.xml @@ -44,8 +44,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-feature-dependencies/pom.xml b/tooling/karaf-maven-plugin/src/it/test-feature-dependencies/pom.xml index b60f6502281..643ae0fddb3 100644 --- a/tooling/karaf-maven-plugin/src/it/test-feature-dependencies/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-feature-dependencies/pom.xml @@ -47,8 +47,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-feature-use-version-range-transfer-properties/transitive/pom.xml b/tooling/karaf-maven-plugin/src/it/test-feature-use-version-range-transfer-properties/transitive/pom.xml index 42ec7de9b4a..538bbe6fe48 100644 --- a/tooling/karaf-maven-plugin/src/it/test-feature-use-version-range-transfer-properties/transitive/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-feature-use-version-range-transfer-properties/transitive/pom.xml @@ -34,8 +34,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-include-project-artifact/pom.xml b/tooling/karaf-maven-plugin/src/it/test-include-project-artifact/pom.xml index 925f726230f..ef3459b0804 100644 --- a/tooling/karaf-maven-plugin/src/it/test-include-project-artifact/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-include-project-artifact/pom.xml @@ -36,8 +36,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-input-file/pom.xml b/tooling/karaf-maven-plugin/src/it/test-input-file/pom.xml index a135fb1b30e..b3d5c9a0600 100644 --- a/tooling/karaf-maven-plugin/src/it/test-input-file/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-input-file/pom.xml @@ -42,8 +42,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-recursive/pom.xml b/tooling/karaf-maven-plugin/src/it/test-recursive/pom.xml index 46e8ac969b4..d5d4d951bcc 100644 --- a/tooling/karaf-maven-plugin/src/it/test-recursive/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-recursive/pom.xml @@ -43,8 +43,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-rename-main-feature/pom.xml b/tooling/karaf-maven-plugin/src/it/test-rename-main-feature/pom.xml index d81411df4ee..eb704fb2da2 100644 --- a/tooling/karaf-maven-plugin/src/it/test-rename-main-feature/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-rename-main-feature/pom.xml @@ -36,8 +36,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-repository-dependencies/pom.xml b/tooling/karaf-maven-plugin/src/it/test-repository-dependencies/pom.xml index 063e4ff3750..9bf5dfbec4e 100644 --- a/tooling/karaf-maven-plugin/src/it/test-repository-dependencies/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-repository-dependencies/pom.xml @@ -45,8 +45,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-run-bundle/pom.xml b/tooling/karaf-maven-plugin/src/it/test-run-bundle/pom.xml index ec2d2342cf3..eb20c8100d8 100644 --- a/tooling/karaf-maven-plugin/src/it/test-run-bundle/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-run-bundle/pom.xml @@ -32,8 +32,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-simplify-bundles/pom.xml b/tooling/karaf-maven-plugin/src/it/test-simplify-bundles/pom.xml index 6eebb6565e8..b0b8dd7aa8e 100644 --- a/tooling/karaf-maven-plugin/src/it/test-simplify-bundles/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-simplify-bundles/pom.xml @@ -56,8 +56,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-transitive-as-dependency/pom.xml b/tooling/karaf-maven-plugin/src/it/test-transitive-as-dependency/pom.xml index 3dde7c68be5..1c7d73eb019 100644 --- a/tooling/karaf-maven-plugin/src/it/test-transitive-as-dependency/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-transitive-as-dependency/pom.xml @@ -45,8 +45,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/tooling/karaf-maven-plugin/src/it/test-type-classifier/pom.xml b/tooling/karaf-maven-plugin/src/it/test-type-classifier/pom.xml index 3fc5a796d12..57b5fe95565 100644 --- a/tooling/karaf-maven-plugin/src/it/test-type-classifier/pom.xml +++ b/tooling/karaf-maven-plugin/src/it/test-type-classifier/pom.xml @@ -37,8 +37,6 @@ org.apache.maven.plugins maven-compiler-plugin - 1.8 - 1.8 256M ${compiler.fork} diff --git a/util/src/main/java/org/apache/karaf/util/ThreadUtils.java b/util/src/main/java/org/apache/karaf/util/ThreadUtils.java index 9ea69e3ac0e..ad2a764972f 100644 --- a/util/src/main/java/org/apache/karaf/util/ThreadUtils.java +++ b/util/src/main/java/org/apache/karaf/util/ThreadUtils.java @@ -38,8 +38,7 @@ private static class NamedThreadFactory implements ThreadFactory { private final String namePrefix; public NamedThreadFactory(String prefix) { - SecurityManager s = System.getSecurityManager(); - group = (s != null) ? s.getThreadGroup() : Thread.currentThread().getThreadGroup(); + group = Thread.currentThread().getThreadGroup(); namePrefix = prefix + "-" + poolNumber.getAndIncrement() + "-thread-"; } diff --git a/util/src/main/java/org/apache/karaf/util/jaas/JaasHelper.java b/util/src/main/java/org/apache/karaf/util/jaas/JaasHelper.java index e9df8242daf..f2b53169a5a 100644 --- a/util/src/main/java/org/apache/karaf/util/jaas/JaasHelper.java +++ b/util/src/main/java/org/apache/karaf/util/jaas/JaasHelper.java @@ -14,18 +14,14 @@ */ package org.apache.karaf.util.jaas; -import java.security.AccessControlContext; -import java.security.AccessController; -import java.security.Permission; import java.security.Principal; import java.security.PrivilegedAction; import java.security.PrivilegedActionException; import java.security.PrivilegedExceptionAction; -import java.security.ProtectionDomain; import java.util.Set; +import java.util.concurrent.CompletionException; import javax.security.auth.Subject; -import javax.security.auth.SubjectDomainCombiner; import org.apache.karaf.jaas.boot.principal.RolePrincipal; @@ -38,11 +34,7 @@ public static boolean currentUserHasRole(String requestedRole) { return true; } - AccessControlContext acc = AccessController.getContext(); - if (acc == null) { - return false; - } - Subject subject = Subject.getSubject(acc); + Subject subject = Subject.current(); if (subject == null) { return false; } @@ -93,13 +85,11 @@ public static T doAs(final Subject subject, if (action == null) { throw new NullPointerException(); } - // set up the new Subject-based AccessControlContext for doPrivileged - final AccessControlContext currentAcc = AccessController.getContext(); - final AccessControlContext newAcc = AccessController.doPrivileged - ((PrivilegedAction) () -> new AccessControlContext(currentAcc, - subject != null ? new OsgiSubjectDomainCombiner(subject) : null)); - // call doPrivileged and push this new context on the stack - return AccessController.doPrivileged(action, newAcc); + try { + return Subject.callAs(subject, action::run); + } catch (CompletionException e) { + throw unwrapUnchecked(e); + } } public static T doAs(final Subject subject, @@ -107,79 +97,25 @@ public static T doAs(final Subject subject, if (action == null) { throw new NullPointerException(); } - // set up the new Subject-based AccessControlContext for doPrivileged - final AccessControlContext currentAcc = AccessController.getContext(); - final AccessControlContext newAcc = AccessController.doPrivileged - ((PrivilegedAction) () -> new AccessControlContext(currentAcc, - subject != null ? new OsgiSubjectDomainCombiner(subject) : null)); - // call doPrivileged and push this new context on the stack - return AccessController.doPrivileged(action, newAcc); - } - - public static class OsgiSubjectDomainCombiner extends SubjectDomainCombiner { - - private final Subject subject; - - public OsgiSubjectDomainCombiner(Subject subject) { - super(subject); - this.subject = subject; - } - - public ProtectionDomain[] combine(ProtectionDomain[] currentDomains, - ProtectionDomain[] assignedDomains) { - int cLen = (currentDomains == null ? 0 : currentDomains.length); - int aLen = (assignedDomains == null ? 0 : assignedDomains.length); - ProtectionDomain[] newDomains = new ProtectionDomain[cLen + aLen]; - Principal[] principals = subject.getPrincipals().toArray(new Principal[0]); - for (int i = 0; i < cLen; i++) { - newDomains[i] = new DelegatingProtectionDomain(currentDomains[i], principals); - } - if (assignedDomains != null) { - System.arraycopy(assignedDomains, 0, newDomains, cLen, aLen); - } - return optimize(newDomains); - } - - private ProtectionDomain[] optimize(ProtectionDomain[] domains) { - if (domains == null || domains.length == 0) { - return null; - } - ProtectionDomain[] optimized = new ProtectionDomain[domains.length]; - ProtectionDomain pd; - int num = 0; - for (ProtectionDomain domain : domains) { - if ((pd = domain) != null) { - boolean found = false; - for (int j = 0; j < num && !found; j++) { - found = (optimized[j] == pd); - } - if (!found) { - optimized[num++] = pd; - } - } + try { + return Subject.callAs(subject, action::run); + } catch (CompletionException e) { + Throwable cause = e.getCause(); + if (cause instanceof Exception && !(cause instanceof RuntimeException)) { + throw new PrivilegedActionException((Exception) cause); } - if (num > 0 && num < domains.length) { - ProtectionDomain[] downSize = new ProtectionDomain[num]; - System.arraycopy(optimized, 0, downSize, 0, downSize.length); - optimized = downSize; - } - return ((num == 0 || optimized.length == 0) ? null : optimized); + throw unwrapUnchecked(e); } } - public static class DelegatingProtectionDomain extends ProtectionDomain { - - private final ProtectionDomain delegate; - - DelegatingProtectionDomain(ProtectionDomain delegate, Principal[] principals) { - super(delegate.getCodeSource(), delegate.getPermissions(), delegate.getClassLoader(), principals); - this.delegate = delegate; + private static RuntimeException unwrapUnchecked(CompletionException e) { + Throwable cause = e.getCause(); + if (cause instanceof RuntimeException) { + return (RuntimeException) cause; } - - @Override - public boolean implies(Permission permission) { - return delegate.implies(permission); + if (cause instanceof Error) { + throw (Error) cause; } - + return e; } } diff --git a/util/src/main/java/org/apache/karaf/util/tracker/BaseActivator.java b/util/src/main/java/org/apache/karaf/util/tracker/BaseActivator.java index 484e78a3cbe..d01441df9a0 100644 --- a/util/src/main/java/org/apache/karaf/util/tracker/BaseActivator.java +++ b/util/src/main/java/org/apache/karaf/util/tracker/BaseActivator.java @@ -72,8 +72,7 @@ public class BaseActivator implements BundleActivator, Runnable, ThreadFactory { private final String namePrefix; public BaseActivator() { - SecurityManager s = System.getSecurityManager(); - group = (s != null) ? s.getThreadGroup() : Thread.currentThread().getThreadGroup(); + group = Thread.currentThread().getThreadGroup(); namePrefix = "activator-" + poolNumber.getAndIncrement() + "-thread-"; } diff --git a/webconsole/console/src/main/java/org/apache/felix/webconsole/internal/servlet/KarafOsgiManager.java b/webconsole/console/src/main/java/org/apache/felix/webconsole/internal/servlet/KarafOsgiManager.java index 39e420ccf3d..1eaeae4541a 100644 --- a/webconsole/console/src/main/java/org/apache/felix/webconsole/internal/servlet/KarafOsgiManager.java +++ b/webconsole/console/src/main/java/org/apache/felix/webconsole/internal/servlet/KarafOsgiManager.java @@ -36,12 +36,6 @@ public class KarafOsgiManager extends OsgiManager { private static final long serialVersionUID = 1090035807469459598L; - private static final Class[] SECURITY_BUGFIX = { - JaasHelper.class, - JaasHelper.OsgiSubjectDomainCombiner.class, - JaasHelper.DelegatingProtectionDomain.class, - }; - public static final String SUBJECT_RUN_AS = "karaf.subject.runas"; public KarafOsgiManager(BundleContext bundleContext) { diff --git a/webconsole/gogo/src/main/java/org/apache/karaf/webconsole/gogo/GogoPlugin.java b/webconsole/gogo/src/main/java/org/apache/karaf/webconsole/gogo/GogoPlugin.java index 0c1a1300c95..535df9f93bb 100644 --- a/webconsole/gogo/src/main/java/org/apache/karaf/webconsole/gogo/GogoPlugin.java +++ b/webconsole/gogo/src/main/java/org/apache/karaf/webconsole/gogo/GogoPlugin.java @@ -33,8 +33,6 @@ import java.io.PrintWriter; import java.net.URI; import java.net.URL; -import java.security.AccessControlContext; -import java.security.AccessController; import java.util.zip.GZIPOutputStream; import javax.security.auth.Subject; @@ -202,9 +200,8 @@ public SessionTerminal() throws IOException { } private String getCurrentUserName() { - AccessControlContext acc = AccessController.getContext(); - final Subject subject = Subject.getSubject(acc); - if (subject != null && subject.getPrincipals().iterator().hasNext()) { + final Subject subject = Subject.current(); + if (subject != null && subject.getPrincipals(UserPrincipal.class).iterator().hasNext()) { return subject.getPrincipals(UserPrincipal.class).iterator().next().getName(); } else { return null;