This is an automated email from the ASF dual-hosted git repository.
chesnay pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/master by this push:
new 7295c3bcf92 [FLINK-33309] Set `-Djava.security.manager=allow` on JDK
18+
7295c3bcf92 is described below
commit 7295c3bcf92c0e106d3e91c57b6492030c760a25
Author: Sergey Nuyanzin <[email protected]>
AuthorDate: Fri Nov 3 12:51:42 2023 +0100
[FLINK-33309] Set `-Djava.security.manager=allow` on JDK 18+
---
flink-core/pom.xml | 21 ++++++++++++++++++++-
flink-dist/src/main/flink-bin/bin/config.sh | 6 ++++++
flink-runtime/pom.xml | 21 ++++++++++++++++++++-
flink-streaming-java/pom.xml | 21 ++++++++++++++++++++-
4 files changed, 66 insertions(+), 3 deletions(-)
diff --git a/flink-core/pom.xml b/flink-core/pom.xml
index ce90b2a1e6d..aee94432815 100644
--- a/flink-core/pom.xml
+++ b/flink-core/pom.xml
@@ -34,7 +34,14 @@ under the License.
<packaging>jar</packaging>
<properties>
- <surefire.module.config> <!--
+ <!--
+ Two properties below should be merged once support for jdk8 and
jdk11 is dropped.
+ The reason of extraction into a separate property with profile
is that
+ specifying -Djava.security.manager=allow within
${surefire.module.config} leads to
+ hanging of surefire for jdk8 and jdk11
+ -->
+ <surefire.module.config.jdk21></surefire.module.config.jdk21>
+ <surefire.module.config> ${surefire.module.config.jdk21} <!--
required by JmxServer
-->--add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED
<!--
PluginConfigTest (CommonTestUtils#setEnv)
@@ -240,5 +247,17 @@ under the License.
</plugins>
</build>
</profile>
+ <profile>
+ <id>java21</id>
+ <activation>
+ <jdk>[21,)</jdk>
+ </activation>
+
+ <properties>
+ <surefire.module.config.jdk21> <!--
+ required by FlinkSecurityManagerTest-->
+
-Djava.security.manager=allow</surefire.module.config.jdk21>
+ </properties>
+ </profile>
</profiles>
</project>
diff --git a/flink-dist/src/main/flink-bin/bin/config.sh
b/flink-dist/src/main/flink-bin/bin/config.sh
index f09c68d493f..dcd48a256f7 100755
--- a/flink-dist/src/main/flink-bin/bin/config.sh
+++ b/flink-dist/src/main/flink-bin/bin/config.sh
@@ -334,6 +334,12 @@ if [ -z "${FLINK_ENV_JAVA_OPTS}" ]; then
# Remove leading and ending double quotes (if present) of value
FLINK_ENV_JAVA_OPTS="-XX:+IgnoreUnrecognizedVMOptions $( echo
"${FLINK_ENV_JAVA_OPTS}" | sed -e 's/^"//' -e 's/"$//' )"
+
+ JAVA_SPEC_VERSION=`${JAVA_HOME}/bin/java -XshowSettings:properties 2>&1 |
grep "java.specification.version" | cut -d "=" -f 2 | tr -d '[:space:]' | rev |
cut -d "." -f 1 | rev`
+ if [[ $(( $JAVA_SPEC_VERSION > 17 )) == 1 ]]; then
+ # set security manager property to allow calls to
System.setSecurityManager() at runtime
+ FLINK_ENV_JAVA_OPTS="$FLINK_ENV_JAVA_OPTS -Djava.security.manager=allow"
+ fi
fi
if [ -z "${FLINK_ENV_JAVA_OPTS_JM}" ]; then
diff --git a/flink-runtime/pom.xml b/flink-runtime/pom.xml
index 359a0e181cb..c6bd2e90964 100644
--- a/flink-runtime/pom.xml
+++ b/flink-runtime/pom.xml
@@ -34,7 +34,14 @@ under the License.
<packaging>jar</packaging>
<properties>
- <surefire.module.config><!--
+ <!--
+ Two properties below should be merged once support for jdk8 and
jdk11 is dropped.
+ The reason of extraction into a separate property with profile
is that
+ specifying -Djava.security.manager=allow within
${surefire.module.config} leads to
+ hanging of surefire for jdk8 and jdk11
+ -->
+ <surefire.module.config.jdk21></surefire.module.config.jdk21>
+ <surefire.module.config> ${surefire.module.config.jdk21} <!--
JobManagerProcessUtilsTest
-->--add-opens=java.base/java.util=ALL-UNNAMED <!--
ConnectionUtilsTest
@@ -472,5 +479,17 @@ under the License.
</plugins>
</build>
</profile>
+ <profile>
+ <id>java21</id>
+ <activation>
+ <jdk>[21,)</jdk>
+ </activation>
+
+ <properties>
+ <surefire.module.config.jdk21> <!--
+ required by DeclarativeSlotManagerTest-->
+
-Djava.security.manager=allow</surefire.module.config.jdk21>
+ </properties>
+ </profile>
</profiles>
</project>
diff --git a/flink-streaming-java/pom.xml b/flink-streaming-java/pom.xml
index f66ed3b48b8..4a7644dfb45 100644
--- a/flink-streaming-java/pom.xml
+++ b/flink-streaming-java/pom.xml
@@ -34,7 +34,14 @@ under the License.
<packaging>jar</packaging>
<properties>
- <surefire.module.config><!--
+ <!--
+ Two properties below should be merged once support for jdk8 and
jdk11 is dropped.
+ The reason of extraction into a separate property with profile
is that
+ specifying -Djava.security.manager=allow within
${surefire.module.config} leads to
+ hanging of surefire for jdk8 and jdk11
+ -->
+ <surefire.module.config.jdk21></surefire.module.config.jdk21>
+ <surefire.module.config> ${surefire.module.config.jdk21} <!--
FromElementsFunctionTest
-->--add-opens=java.base/java.lang=ALL-UNNAMED <!--
chill ArraysAsListSerializer
@@ -170,5 +177,17 @@ under the License.
</plugins>
</build>
</profile>
+ <profile>
+ <id>java21</id>
+ <activation>
+ <jdk>[21,)</jdk>
+ </activation>
+
+ <properties>
+ <surefire.module.config.jdk21> <!--
+ required by StreamTaskSystemExitTest-->
+
-Djava.security.manager=allow</surefire.module.config.jdk21>
+ </properties>
+ </profile>
</profiles>
</project>
