[
https://issues.apache.org/jira/browse/CASSANDRA-21670?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113521#comment-18113521
]
Josh McKenzie commented on CASSANDRA-21670:
-------------------------------------------
I'm thinking we'll need this for all GA branches (optional, opt-in, etc) so we
can backport JDK25 runtime support to each of them and then drop older JDK
support on trunk so we can bump up our language level. wdyt?
> Add the ability to run without using a JDK Security Manager
> -----------------------------------------------------------
>
> Key: CASSANDRA-21670
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21670
> Project: Apache Cassandra
> Issue Type: Improvement
> Components: Feature/UDF
> Reporter: Jeremiah Jordan
> Assignee: Jeremiah Jordan
> Priority: Normal
> Fix For: 7.x
>
>
> As of [JEP 411|https://openjdk.org/jeps/411] (JDK 17) the use of a security
> manager was deprecated, and it was removed in JDK 24 See [Oracle's security
> manager
> documentation|https://docs.oracle.com/en/java/javase/25/security/security-manager-is-permanently-disabled.html]
> In order to prepare for being able to run under JDK 25 we need to remove use
> of a security manager from the server code. The main place one is used is in
> the UDF sandboxing code.
> In order to remove the use of the security manager, replace its functionality
> with a byte code checking sandbox and extended class loader restrictions.
> The new implementation will be behind a feature flag and it will keep the
> existing implementation as the default for backwards compatibility and use on
> older JVMs.
> With the security manager removal, use of AccessControlContext is also
> removed. A shared helper will be added to get the authenticated {{Subject}}
> for authorization and audit logging. It will use {{Subject.current()}} on JDK
> 24 and later. Keeping the existing lookup on older versions.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
