This is an automated email from the ASF dual-hosted git repository. chesnay pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/master by this push: new 7295c3bcf92 [FLINK-33309] Set `-Djava.security.manager=allow` on JDK 18+ 7295c3bcf92 is described below commit 7295c3bcf92c0e106d3e91c57b6492030c760a25 Author: Sergey Nuyanzin <snuyan...@gmail.com> AuthorDate: Fri Nov 3 12:51:42 2023 +0100 [FLINK-33309] Set `-Djava.security.manager=allow` on JDK 18+ --- flink-core/pom.xml | 21 ++++++++++++++++++++- flink-dist/src/main/flink-bin/bin/config.sh | 6 ++++++ flink-runtime/pom.xml | 21 ++++++++++++++++++++- flink-streaming-java/pom.xml | 21 ++++++++++++++++++++- 4 files changed, 66 insertions(+), 3 deletions(-) diff --git a/flink-core/pom.xml b/flink-core/pom.xml index ce90b2a1e6d..aee94432815 100644 --- a/flink-core/pom.xml +++ b/flink-core/pom.xml @@ -34,7 +34,14 @@ under the License. <packaging>jar</packaging> <properties> - <surefire.module.config> <!-- + <!-- + Two properties below should be merged once support for jdk8 and jdk11 is dropped. + The reason of extraction into a separate property with profile is that + specifying -Djava.security.manager=allow within ${surefire.module.config} leads to + hanging of surefire for jdk8 and jdk11 + --> + <surefire.module.config.jdk21></surefire.module.config.jdk21> + <surefire.module.config> ${surefire.module.config.jdk21} <!-- required by JmxServer -->--add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED <!-- PluginConfigTest (CommonTestUtils#setEnv) @@ -240,5 +247,17 @@ under the License. </plugins> </build> </profile> + <profile> + <id>java21</id> + <activation> + <jdk>[21,)</jdk> + </activation> + + <properties> + <surefire.module.config.jdk21> <!-- + required by FlinkSecurityManagerTest--> + -Djava.security.manager=allow</surefire.module.config.jdk21> + </properties> + </profile> </profiles> </project> diff --git a/flink-dist/src/main/flink-bin/bin/config.sh b/flink-dist/src/main/flink-bin/bin/config.sh index f09c68d493f..dcd48a256f7 100755 --- a/flink-dist/src/main/flink-bin/bin/config.sh +++ b/flink-dist/src/main/flink-bin/bin/config.sh @@ -334,6 +334,12 @@ if [ -z "${FLINK_ENV_JAVA_OPTS}" ]; then # Remove leading and ending double quotes (if present) of value FLINK_ENV_JAVA_OPTS="-XX:+IgnoreUnrecognizedVMOptions $( echo "${FLINK_ENV_JAVA_OPTS}" | sed -e 's/^"//' -e 's/"$//' )" + + JAVA_SPEC_VERSION=`${JAVA_HOME}/bin/java -XshowSettings:properties 2>&1 | grep "java.specification.version" | cut -d "=" -f 2 | tr -d '[:space:]' | rev | cut -d "." -f 1 | rev` + if [[ $(( $JAVA_SPEC_VERSION > 17 )) == 1 ]]; then + # set security manager property to allow calls to System.setSecurityManager() at runtime + FLINK_ENV_JAVA_OPTS="$FLINK_ENV_JAVA_OPTS -Djava.security.manager=allow" + fi fi if [ -z "${FLINK_ENV_JAVA_OPTS_JM}" ]; then diff --git a/flink-runtime/pom.xml b/flink-runtime/pom.xml index 359a0e181cb..c6bd2e90964 100644 --- a/flink-runtime/pom.xml +++ b/flink-runtime/pom.xml @@ -34,7 +34,14 @@ under the License. <packaging>jar</packaging> <properties> - <surefire.module.config><!-- + <!-- + Two properties below should be merged once support for jdk8 and jdk11 is dropped. + The reason of extraction into a separate property with profile is that + specifying -Djava.security.manager=allow within ${surefire.module.config} leads to + hanging of surefire for jdk8 and jdk11 + --> + <surefire.module.config.jdk21></surefire.module.config.jdk21> + <surefire.module.config> ${surefire.module.config.jdk21} <!-- JobManagerProcessUtilsTest -->--add-opens=java.base/java.util=ALL-UNNAMED <!-- ConnectionUtilsTest @@ -472,5 +479,17 @@ under the License. </plugins> </build> </profile> + <profile> + <id>java21</id> + <activation> + <jdk>[21,)</jdk> + </activation> + + <properties> + <surefire.module.config.jdk21> <!-- + required by DeclarativeSlotManagerTest--> + -Djava.security.manager=allow</surefire.module.config.jdk21> + </properties> + </profile> </profiles> </project> diff --git a/flink-streaming-java/pom.xml b/flink-streaming-java/pom.xml index f66ed3b48b8..4a7644dfb45 100644 --- a/flink-streaming-java/pom.xml +++ b/flink-streaming-java/pom.xml @@ -34,7 +34,14 @@ under the License. <packaging>jar</packaging> <properties> - <surefire.module.config><!-- + <!-- + Two properties below should be merged once support for jdk8 and jdk11 is dropped. + The reason of extraction into a separate property with profile is that + specifying -Djava.security.manager=allow within ${surefire.module.config} leads to + hanging of surefire for jdk8 and jdk11 + --> + <surefire.module.config.jdk21></surefire.module.config.jdk21> + <surefire.module.config> ${surefire.module.config.jdk21} <!-- FromElementsFunctionTest -->--add-opens=java.base/java.lang=ALL-UNNAMED <!-- chill ArraysAsListSerializer @@ -170,5 +177,17 @@ under the License. </plugins> </build> </profile> + <profile> + <id>java21</id> + <activation> + <jdk>[21,)</jdk> + </activation> + + <properties> + <surefire.module.config.jdk21> <!-- + required by StreamTaskSystemExitTest--> + -Djava.security.manager=allow</surefire.module.config.jdk21> + </properties> + </profile> </profiles> </project>