Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8182137

Missing permissions in deprivileged java.xml.bind and java.xml.ws modules

    Details

    • Subcomponent:
    • Resolved In Build:
      b175
    • Verification:
      Verified

      Backports

        Description

        java.xml.bind and java.xml.ws modules are deprivileged and granted with specific permissions.

        JAXB and JAX-WS tests were ran and found no regressions when security manager is enabled. It is recently uncovered (2+ years after JDK-8057645 was resolved in jdk-9+51) that FilePermission is missing from JAXB and RuntimePermission("createClassLoader") is missing from JAX-WS. The test policy file used by JAXB and JAX-WS tests grant permissions to the default code source that masks this problem.

        One important task is to run JAXB and JAX-WS tests with the fixed test policy file to identify the missing permissions.

        At this late stage in JDK 9, we propose to grant java.xml.bind and java.xml.bind with AllPermissions which is same as JDK 8. These modules are still deprivileged and defined to the platform class loader.

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  mchung Mandy Chung
                  Reporter:
                  mchung Mandy Chung
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  4 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: