Skip to content

Commit ada2b63

Browse files
Add all constraint check options
1 parent 4eadf33 commit ada2b63

File tree

2 files changed

+23
-2
lines changed

2 files changed

+23
-2
lines changed

closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java

+22-1
Original file line numberDiff line numberDiff line change
@@ -883,13 +883,34 @@ boolean isRestrictedServiceAllowed(Service service, boolean isServiceAdded) {
883883
if (debug != null) {
884884
debug.println("Attempting to match " + stackElement + " with: " + optionAndValue);
885885
}
886+
String stackElemModule = stackElement.getModuleName();
886887
String stackElemFullClassName = stackElement.getClassName();
888+
String stackElemPackage = stackElemFullClassName.substring(stackElemFullClassName.lastIndexOf(".") + 1);
889+
String module;
887890
switch (option) {
891+
case "ModuleAndFullClassName":
892+
String[] moduleAndFullClassName = value.split("/");
893+
if (moduleAndFullClassName.length != 2) {
894+
printStackTraceAndExit("Incorrect specification of accepted uses in constraint: " + constraint);
895+
}
896+
module = moduleAndFullClassName[0];
897+
String fullClassName = moduleAndFullClassName[1];
898+
found = stackElemModule.equals(module) && stackElemFullClassName.equals(fullClassName);
899+
break;
900+
case "ModuleAndPackage":
901+
String[] moduleAndPackage = value.split("/");
902+
if (moduleAndPackage.length != 2) {
903+
printStackTraceAndExit("Incorrect specification of accepted uses in constraint: " + constraint);
904+
}
905+
module = moduleAndPackage[0];
906+
String packageValue = moduleAndPackage[1];
907+
found = stackElemModule.equals(module) && stackElemFullClassName.equals(packageValue);
908+
break;
888909
case "FullClassName":
889910
found = stackElemFullClassName.equals(value);
890911
break;
891912
case "Package":
892-
String stackElemPackage = stackElemFullClassName.substring(stackElemFullClassName.lastIndexOf(".") + 1);
913+
893914
found = stackElemPackage.equals(value);
894915
break;
895916
default:

src/java.base/share/conf/security/java.security

+1-1
Original file line numberDiff line numberDiff line change
@@ -283,7 +283,7 @@ RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.jce.provider.1 = com.ibm.crypto.plu
283283
{KeyGenerator, SunTlsMasterSecret, *}, \
284284
{KeyGenerator, SunTlsPrf, *}, \
285285
{KeyGenerator, SunTlsRsaPremasterSecret, *}, \
286-
{KeyPairGenerator, EC, *, \\S*?StackConstraints\\S*?}, \
286+
{KeyPairGenerator, EC, *}, \
287287
{KeyPairGenerator, RSA, *}, \
288288
{KeyPairGenerator, RSAPSS, *}, \
289289
{Mac, HmacSHA224, *}, \

0 commit comments

Comments
 (0)