To securely instrument access controls onto public Java API, we need to have the ability to disable finalizers, to prevent finalizer attacks from circumventing access controls.

Since finalizers are planned for removal, as soon as finalizers are officially deprecated, I propose a command line flag be provided to disable jvm calls to finalizer methods.

--
Regards,
Peter Firmstone.

Reply via email to