Skip to content

Lift minimum JDK version to 21 and remove SecurityManager #2214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
holgerfriedrich wants to merge 3 commits into
base: main
Choose a base branch
from
+105 −306
Open

Lift minimum JDK version to 21 and remove SecurityManager #2214

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3352f32
Lift minimum JDK version to 21 and remove SecurityManager
holgerfriedrich Dec 27, 2025
07fb19f
Replace getSubject and doAs calls
holgerfriedrich Dec 30, 2025
023bbe9
Remove SecurityManager form JavaSecurityTest
holgerfriedrich Jan 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,12 +33,11 @@ jobs:
contents: read

steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up JDK 17
- uses: actions/checkout@v4
- name: Set up JDK 21
uses: actions/setup-java@v4
with:
java-version: '17'
java-version: '21'
distribution: 'temurin'
cache: 'maven'
- name: Build
Expand Down
2 changes: 1 addition & 1 deletion archetypes/assembly/src/main/resources/archetype-resources/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@
<!-- minimal distribution -->
<!--<feature>minimal</feature>-->
</bootFeatures>
<javase>11</javase>
<javase>21</javase>
</configuration>
</plugin>
</plugins>
Expand Down
5 changes: 3 additions & 2 deletions archetypes/blueprint/src/main/resources/archetype-resources/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,8 +63,9 @@
<artifactId>maven-compiler-plugin</artifactId>
<version>3.13.0</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
<release>21</release>
<source>21</source>
<target>21</target>
<maxmem>256M</maxmem>
</configuration>
</plugin>
Expand Down
5 changes: 3 additions & 2 deletions archetypes/bundle/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,9 @@
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>1.8</source>
<target>1.8</target>
<release>21</release>
<source>21</source>
<target>21</target>
<maxmem>256M</maxmem>
</configuration>
</plugin>
Expand Down
5 changes: 3 additions & 2 deletions archetypes/bundle/src/main/resources/archetype-resources/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,9 @@
<artifactId>maven-compiler-plugin</artifactId>
<version>3.13.0</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
<release>21</release>
<source>21</source>
<target>21</target>
<maxmem>256M</maxmem>
</configuration>
</plugin>
Expand Down
5 changes: 3 additions & 2 deletions archetypes/command/src/main/resources/archetype-resources/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,8 +67,9 @@
<inherited>true</inherited>
<version>3.13.0</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
<release>21</release>
<source>21</source>
<target>21</target>
</configuration>
</plugin>
<plugin>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/apache-karaf-integration/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@
</bootFeatures>
<libraries>
</libraries>
<javase>17</javase>
<javase>21</javase>
Copy link
Member

@jbonofre jbonofre Jan 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's require change on the karaf-maven-plugin and dependencies. I will create another PR (as planned) to tackle that.

<generateConsistencyReport>${project.build.directory}</generateConsistencyReport>
<consistencyReportProjectName>Apache Karaf Integration</consistencyReportProjectName>
</configuration>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/apache-karaf-minimal/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@
!org.apache.karaf.command.acl.*,
*
</pidsToExtract>
<javase>11</javase>
<javase>21</javase>
</configuration>
</plugin>
<plugin>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/apache-karaf/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@
</bootFeatures>
<libraries>
</libraries>
<javase>11</javase>
<javase>21</javase>
<generateConsistencyReport>${project.build.directory}</generateConsistencyReport>
<consistencyReportProjectName>Apache Karaf (full)</consistencyReportProjectName>
</configuration>
Expand Down
6 changes: 0 additions & 6 deletions assemblies/features/base/src/main/filtered-resources/resources/bin/inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,6 @@ setupVendorSepcifics() {
setupDefaults() {
DEFAULT_JAVA_OPTS="-XX:+UnlockDiagnosticVMOptions "

if [ "${VERSION}" -gt "11" ]; then
# TODO revisit EventAdminImpl to avoid use of Subject.getSubject(AccessController.getContext());
# -Djava.security.manager=allow is a workaround for SecurityController deprecation in JDK23+
DEFAULT_JAVA_OPTS="$DEFAULT_JAVA_OPTS -Djava.security.manager=allow "
fi

setupVendorSepcifics

DEFAULT_JAVA_OPTS="${DEFAULT_JAVA_OPTS} ${JAVA_VENDOR_OPTS}"
Expand Down
4 changes: 0 additions & 4 deletions assemblies/features/base/src/main/filtered-resources/resources/bin/karaf.bat
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,10 +262,6 @@ if not exist "%JAVA_HOME%\bin\server\jvm.dll" (
)
set DEFAULT_JAVA_OPTS=-XX:+UnlockDiagnosticVMOptions

if "%JAVA_VERSION%" GTR 11 (
set DEFAULT_JAVA_OPTS=%DEFAULT_JAVA_OPTS% -Djava.security.manager=allow
)

if "%JAVA_OPTS%" == "" set JAVA_OPTS=%DEFAULT_JAVA_OPTS%

if "%EXTRA_JAVA_OPTS%" == "" goto :KARAF_EXTRA_JAVA_OPTS_END
Expand Down
2 changes: 1 addition & 1 deletion assemblies/features/enterprise/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,7 +241,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>11</javase>
<javase>21</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/features/integration/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>17</javase>
<javase>21</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down
4 changes: 2 additions & 2 deletions assemblies/features/specs/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>11</javase>
<javase>21</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down Expand Up @@ -149,4 +149,4 @@
</profile>
</profiles>

</project>
</project>
2 changes: 1 addition & 1 deletion assemblies/features/spring-legacy/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>17</javase>
<javase>21</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/features/spring/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>17</javase>
<javase>21</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/features/standard/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -465,7 +465,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>11</javase>
<javase>21</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down
4 changes: 2 additions & 2 deletions examples/karaf-docker-example/karaf-docker-example-dynamic-dist/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@
</bootFeatures>
<libraries>
</libraries>
<javase>11</javase>
<javase>21</javase>
</configuration>
</plugin>
</plugins>
Expand Down Expand Up @@ -194,4 +194,4 @@
</profile>
</profiles>

</project>
</project>
2 changes: 1 addition & 1 deletion examples/karaf-docker-example/karaf-docker-example-static-dist/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@
<framework>static</framework>
<useReferenceUrls>true</useReferenceUrls>
<environment>static</environment>
<javase>11</javase>
<javase>21</javase>
</configuration>
</plugin>
</plugins>
Expand Down
3 changes: 0 additions & 3 deletions instance/src/main/java/org/apache/karaf/instance/core/internal/InstanceServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -537,9 +537,6 @@ private void doStart(InstanceState instance, String name, String javaOpts) throw
" --add-exports=jdk.naming.rmi/com.sun.jndi.url.rmi=ALL-UNNAMED" +
" --add-exports=java.security.sasl/com.sun.security.sasl=ALL-UNNAMED" +
" --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED";
if (!System.getProperty("java.version").startsWith("11")) {
jdkOpts += " -Djava.security.manager=allow";
}
} else {
jdkOpts = " -Djava.endorsed.dirs=\"" + new File(new File(new File(System.getProperty("java.home"), "jre"), "lib"), "endorsed") + System.getProperty("path.separator") + new File(new File(System.getProperty("java.home"), "lib"), "endorsed") + System.getProperty("path.separator") + new File(libDir, "endorsed").getCanonicalPath() + "\""
+ " -Djava.ext.dirs=\"" + new File(new File(new File(System.getProperty("java.home"), "jre"), "lib"), "ext") + System.getProperty("path.separator") + new File(new File(System.getProperty("java.home"), "lib"), "ext") + System.getProperty("path.separator") + new File(libDir, "ext").getCanonicalPath() + "\"";
Expand Down
3 changes: 1 addition & 2 deletions itests/common/src/main/java/org/apache/karaf/itests/KarafTestSupport.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.Principal;
import java.security.PrivilegedExceptionAction;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
Expand Down Expand Up @@ -429,7 +428,7 @@ private String executeCommand(final String command, final Long timeout, final Lo
commandFuture = new FutureTask<>(() -> {
Subject subject = new Subject();
subject.getPrincipals().addAll(Arrays.asList(principals));
return Subject.doAs(subject, (PrivilegedExceptionAction<String>) commandCallable::call);
return Subject.callAs(subject, (Callable<String>) commandCallable::call);
});
}

Expand Down
3 changes: 0 additions & 3 deletions itests/test/src/test/java/org/apache/karaf/itests/JavaSecurityTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,6 @@
import java.nio.file.StandardCopyOption;
import java.util.*;

import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.fail;
import static org.ops4j.pax.exam.CoreOptions.maven;
import static org.ops4j.pax.exam.karaf.options.KarafDistributionOption.*;
Expand Down Expand Up @@ -72,8 +71,6 @@ public Option[] config() {

@Test
public void testJavaSecurity() throws Exception {
assertNotNull("Karaf should run under a security manager", System.getSecurityManager());

BundleService service = getOsgiService(BundleService.class);
long tried = 0;
while (true) {
Expand Down
3 changes: 1 addition & 2 deletions jaas/command/src/main/java/org/apache/karaf/jaas/command/WhoamiCommand.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,8 +55,7 @@ public Object execute() throws Exception {
ShellTable table = new ShellTable();

// Get the currently-active JAAS Subject.
AccessControlContext acc = AccessController.getContext();
Subject subj = Subject.getSubject(acc);
Subject subj = Subject.current();

String classString = USER_CLASS;
if (groups) {
Expand Down
6 changes: 4 additions & 2 deletions jaas/modules/src/main/java/org/apache/karaf/jaas/modules/ldap/GSSAPILdapLoginModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.concurrent.Callable;
import java.util.concurrent.CompletionException;

/**
* Specific LDAPLoginModule to be used with GSSAPI. Uses the specified realm as login context.
Expand Down Expand Up @@ -62,9 +64,9 @@ public boolean login() throws LoginException {
context.login();

try {
succeeded = Subject.doAs(context.getSubject(), (PrivilegedExceptionAction<Boolean>) this::doLogin);
succeeded = Subject.callAs(context.getSubject(), (Callable<Boolean>) this::doLogin);
return succeeded;
} catch (PrivilegedActionException pExcp) {
} catch (CompletionException pExcp) {
logger.error("error with delegated authentication", pExcp);
throw new LoginException(pExcp.getMessage());
}
Expand Down
11 changes: 3 additions & 8 deletions management/server/src/main/java/org/apache/karaf/management/internal/BulkRequestContext.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,16 +63,11 @@ public static BulkRequestContext newContext(ConfigurationAdmin configAdmin) thro
context.configAdmin = configAdmin;
try {
// check JAAS subject here
AccessControlContext acc = AccessController.getContext();
if (acc == null) {
Subject subject = Subject.current();
if (subject == null) {
context.anonymous = true;
} else {
Subject subject = Subject.getSubject(acc);
if (subject == null) {
context.anonymous = true;
} else {
context.principals.addAll(subject.getPrincipals());
}
context.principals.addAll(subject.getPrincipals());
}
// list available ACL configs - valid for this instance only
for (Configuration config : configAdmin.listConfigurations("(service.pid=jmx.acl*)")) {
Expand Down
Loading