Hello folks, I have a little project on github, feel free to join in, fork etc if you find it interesting.
https://github.com/pfirmstone/jdk-with-authorization
It's a fork of OpenJDK master, that will remain compatible but preserve and improve support for Authorization / Access Controls.
Features:
- Principle of Least Privilege Policy generation tool: -Djava.security.manager=polpAudit This significantly simplifies deployment and management of security policy files.
- Non blocking cache SecurityManager (to avoid repeated checks in Executor tasks) and high scaling policy provider. -Djava.security.manager=default This eliminates the security performance penalty.
- Restrict class loading to Signed jar files, or generate a whitelist of allowable jar files using policy, to prevent loading of untrusted code.
- Generate a whitelist of allowable URL's
- Generate a whitelist of allowable Serializable objects.
- Reduced the trusted codebase to java.base module and native platform code, all modules can be controlled and their class loading prevented, should you wish to disable unwanted features in OpenJDK. It also allows you to restrict features to Authenticated users should you wish to do so.
- Removed static permissions - for example, static permissions were granted to enable applets to contact their originating URL, however static permissions create the potential for URL injection attacks in software utilising URLClassLoader. Eg JNDI LDAP URL injection attacks, although this feature has options to disable it in the JVM, or removed it in Java 24, it's possible to allow it safely using signed jar files and URL whitelists. Removing static permissions simplifies the security model, permissions previously granted by code are now granted by policy.
Related Videos
Securing the JVM • Nicolas Frankel • GOTO 2019
A Journey From JNDI/LDAP Manipulation to Remote Code Execution Dream Land
Compatibility across all Java Platforms:
We can no longer call System::getSecurityManager or System::setSecurityManager, many permission checks call System::getSecurityManager, but don't have to:
("removal")
SecurityManager security = System.getSecurityManager();
if (security != null) {
security.checkPermission(new RuntimePermission("closeClassLoader"));
}
Use checkGuard instead:
new RuntimePermission("closeClassLoader").checkGuard(null);
Alternatively save the new permission to a static field:
private static Guard CLOSE_CLASS_LOADER = new RuntimePermission("closeClassLoader");
Then call:
CLOSE_CLASS_LOADER.checkGuard(null);
The advantage of the static field is it will be cached by CombinerSecurityManager and comparision will be made by reference instead of Object equals.
Continue using AccessController::doPrivileged and Subject::doAs methods.
Use -Djava.security.manager=default to set a SecurityManager on supported platforms.
This will allow your software to support all Java platforms.