Add a restricted security policy for CRIU - #592
Conversation
Signed-off-by: Tao Liu <tao.liu@ibm.com>
| /*[IF CRIU_SUPPORT]*/ | ||
| // If CRIU checkpoint mode is enabled, use the 2nd restricted security policy. | ||
| if (InternalCRIUSupport.isCheckpointAllowed()) { | ||
| securitySetting = "2"; |
There was a problem hiding this comment.
Does this mean the fips mode is not compatible w/ CRIU?
Signed-off-by: Zainab Fatmi <zainab@ibm.com>
cbee774 to
1fb2d90
Compare
| * providers are added back. | ||
| */ | ||
| public final class CRIUSECProvider extends Provider { | ||
| public final class CRIUSEC extends Provider { |
There was a problem hiding this comment.
FYI: The provider name needs to be the same as the class name, since the class name is used by the restrictive mode configurator to determine if a provider is allowed or not.
| RestrictedSecurity2.javax.net.ssl.keyStore = | ||
|
|
||
| RestrictedSecurity2.securerandom.provider = CRIUSEC | ||
| RestrictedSecurity2.securerandom.algorithm = SHA1PRNG |
There was a problem hiding this comment.
@taoliult SecureRandom is still iterating through the provider list, instead of only instantiating this specified provider.
|
@ZainabF92 @JasonFengJ9 From Zainab's checkpoint log file, if you see the following output, saying The provider XXXXX is not allowed in the restricted security mode, and then the stack output. That works as design, if the provider XXXXX is not listed in the java.security by using property "RestrictedSecurityN.jce.provider.N=", when in the restricted security mode. And as Zainab mentioned, these stacks may usually from the SecureRandom.java, "at java.security.SecureRandom.getDefaultPRNG(SecureRandom.java:276)". That is because, in the SecureRandom.java, if in the restricted security mode, we will check the secure random provider. If the loaded secure random provider equals to the secure random provider specified in the java.security by property "RestrictedSecurityN.securerandom.provider" and "RestrictedSecurityN.securerandom.algorithm", then we will use it. And in the SecureRandom.java, the loaded providers will return in a list by calling "Providers.getProviderList().providers()". And in this method, it will get all the non-java.base providers by using the class loader in the ServiceLoader.java. And in the ServiceLoader.java, before the provider is loaded, we add a check to check if the provider is allowed in the restricted security mode. If it is not allowed, then we won't loaded it and print out the calling stacks. That is why, from the log file when enable the restricted security log output, the stack trace always print out after the check "The provider XXXXX is not allowed in the restricted security mode". And from Zainab's checkpoint log file, I see a "NoSuchMethodError" from the CRIU's code. @JasonFengJ9 This "NoSuchMethodError" may need to take a look. |
This is a known issue. The API name |
|
@JasonFengJ9 |
3 participants
Corresponding PR: eclipse-openj9/openj9#16314
This (the second commit) will enable the security restriction policy for InstantOn, it needs to be merged after openj9-openjdk-jdk11#586.
These changes still need to be tested, I only did preliminary testing. For the WAS workload that loads SunEC during checkpoint which causes a crash during restore, this change should output a trace to help locate the code that loads SunEC and disable it (@taoliult can help with that if needed).
Signed-off-by: Zainab Fatmi zainab@ibm.com