ServiceLoader loading services from platform modules (was Re: RFR 8159528: Deprivilege java.security.jgss, jdk.security.jgss and jdk.security.auth)

2016-07-12 Thread Weijun Wang
I wasn't running all tests before and today I noticed a new failure of java/net/httpclient/security/Security.java. I think it's because Krb5KeyExchangeService in java.security.jgss provides ClientKeyExchangeService, and when ServiceLoader is iterating through all its providers and touching Krb

Re: RFR 8159528: Deprivilege java.security.jgss, jdk.security.jgss and jdk.security.auth

2016-07-12 Thread Weijun Wang
On 7/12/2016 22:31, Sean Mullan wrote: Did you try to grant less than AllPermission to these modules? Ah yes, below is the exact permissions needed to run the sun/security/krb5/auto/BasicProc.java test. Some of them will need to be applied to the application also. The SocketPermission, FilePe

Re: RFR 8159528: Deprivilege java.security.jgss, jdk.security.jgss and jdk.security.auth

2016-07-12 Thread Sean Mullan
Did you try to grant less than AllPermission to these modules? In PrincipalName.java, you can use diamond on line 206: return AccessController.doPrivileged(new PrivilegedAction<>() { Looks ok otherwise. --Sean On 07/11/2016 04:15 AM, Weijun Wang wrote: Hi All Please review the code chan

Re: RFR 8159528: Deprivilege java.security.jgss, jdk.security.jgss and jdk.security.auth

2016-07-11 Thread Mandy Chung
> On Jul 11, 2016, at 9:38 PM, Weijun Wang wrote: > > > > On 7/11/2016 16:50, Mandy Chung wrote: >> >>> On Jul 11, 2016, at 4:15 PM, Weijun Wang wrote: >>> >>> Hi All >>> >>> Please review the code change at >>> >>> dev: http://cr.openjdk.java.net/~weijun/8159528/dev/webrev.00 >> >>

Re: RFR 8159528: Deprivilege java.security.jgss, jdk.security.jgss and jdk.security.auth

2016-07-11 Thread Weijun Wang
On 7/11/2016 16:50, Mandy Chung wrote: On Jul 11, 2016, at 4:15 PM, Weijun Wang wrote: Hi All Please review the code change at dev: http://cr.openjdk.java.net/~weijun/8159528/dev/webrev.00 Good to keep the PLATFORM_MODULE list in alphabetical order. So java.security.jgss should b

Re: RFR 8159528: Deprivilege java.security.jgss, jdk.security.jgss and jdk.security.auth

2016-07-11 Thread Mandy Chung
> On Jul 11, 2016, at 4:15 PM, Weijun Wang wrote: > > Hi All > > Please review the code change at > > dev: http://cr.openjdk.java.net/~weijun/8159528/dev/webrev.00 Good to keep the PLATFORM_MODULE list in alphabetical order. So java.security.jgss should be moved up. > dev/jdk: http:

RFR 8159528: Deprivilege java.security.jgss, jdk.security.jgss and jdk.security.auth

2016-07-11 Thread Weijun Wang
Hi All Please review the code change at dev: http://cr.openjdk.java.net/~weijun/8159528/dev/webrev.00 dev/jdk: http://cr.openjdk.java.net/~weijun/8159528/jdk/webrev.00 Some notes on the jdk changes: 1. java.policy: I just append the new grants to the end of the file (before the comm