[
https://issues.apache.org/jira/browse/CASSANDRA-21670?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113463#comment-18113463
]
Jeremiah Jordan commented on CASSANDRA-21670:
---------------------------------------------
I have a trunk version here: https://github.com/apache/cassandra/pull/5139
Not sure what versions we want to back port this to if any?
> Add the ability to run without using a JDK Security Manager
> -----------------------------------------------------------
>
> Key: CASSANDRA-21670
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21670
> Project: Apache Cassandra
> Issue Type: Improvement
> Components: Feature/UDF
> Reporter: Jeremiah Jordan
> Assignee: Jeremiah Jordan
> Priority: Normal
> Fix For: 7.x
>
>
> As of [JEP 411|https://openjdk.org/jeps/411] (JDK 17) the use of a security
> manager was deprecated, and it was removed in JDK 24 See [Oracle's security
> manager
> documentation|https://docs.oracle.com/en/java/javase/25/security/security-manager-is-permanently-disabled.html]
> In order to prepare for being able to run under JDK 25 we need to remove use
> of a security manager from the server code. The main place one is used is in
> the UDF sandboxing code.
> In order to remove the use of the security manager, replace its functionality
> with a byte code checking sandbox and extended class loader restrictions.
> The new implementation will be behind a feature flag and it will keep the
> existing implementation as the default for backwards compatibility and use on
> older JVMs.
> With the security manager removal, use of AccessControlContext is also
> removed. A shared helper will be added to get the authenticated {{Subject}}
> for authorization and audit logging. It will use {{Subject.current()}} on JDK
> 24 and later. Keeping the existing lookup on older versions.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
