OpenJDK with Authorization

OpenJDK with Authorization (SecurityManager)

This project aims to maintain a community-driven fork of OpenJDK that incorporates robust Authorization functionality, rather than attempting to sandbox untrusted code. The primary objectives include:

• Preventing the loading of untrusted code.
• Maintaining guard hooks throughout OpenJDK for comprehensive permission checks and adding more where needed.
• Researching enhancements to Authorization capabilities.
• Ensuring high performance and scalability throughout the platform.

Principle of Least Privilege Policy Writer

This powerful tool automates the creation of policy files grounded in the principle of least privilege. By doing so, it establishes a formidable barrier of SecurityExceptions that potential attackers must navigate within your perimeter defenses.

• Permissions are tightly controlled to ensure that transitive dependencies or unnecessary modules are not loaded.
• Serialization will be restricted to only the classes that are actively used in your deployment staging environment.

Usage Instructions

In your deployment staging environment, run your program with the following command line options:

-Djava.security.manager=au.zeus.jdk.authorization.tool.SecurityPolicyWriter,  
-DSecurityPolicyWriter.path.properties=${your.path}securitypolicywriterpath.properties,  

Other essential system properties you should set include:

• java.security.policy
• javax.net.ssl.trustStore
• javax.net.ssl.trustStoreType
• javax.net.ssl.trustStorePassword

Auditing

Audit your policy files to uncover potential security vulnerabilities and deploy using the automatically generated audit-ready policy files to enhance security further.

High-Performance Security Deployment

For optimal scaling and efficient implementations of SecurityManager and Policy, use:

-Djava.security.manager=au.zeus.jdk.authorization.sm.CombinerSecurityManager,  
-Dpolicy.provider=au.zeus.jdk.authorization.policy.ConcurrentPolicyFile,  

Development Structure

• The master branch serves as a fork of the OpenJDK master, focusing on retaining SecurityManager functions for merging and testing impact from upstream changes.
• Development occurs in the trunk branch, where modifications are branched off and later rebased to trunk as needed.

Plans / Research for Security Hardening the VM

Our strategy includes:

• Replacing the default policy provider with a concurrent policy provider from JGDMS.
• Implementing an httpmd URL handler for SHA256+ algorithms to validate JAR file integrity.
• Streamlining the trusted platform.
• Integrating the PolicyWriter tool from JGDMS to facilitate deployment leveraging least privilege principles.
• Enhancing policy tests and enforcing strict URI support standards to bolster security.
• Removing unnecessary DNS lookups from critical classes.

Security Tooling

In today's landscape, running unaudited, untrusted code poses significant risks. The PolicyWriter tool from JGDMS enables safe testing of untrusted code in controlled environments. Following static analysis and comprehensive auditing, code that is determined to be secure can be executed under the least privilege principle, employing policy files generated by PolicyWriter.

• The simplicity of editing and understanding PolicyWriter's generated policy files ensures compliance with security best practices, reducing the risk of privilege escalation.

Complexity and Maintenance

Navigating the intricacies of concurrency and security remains a challenge for developers. Unlike the substantial investment in refining Java's memory model, security tool development has lagged behind, often resulting in a reliance on outdated tools like the Policy Tool.

• PolicyWriter addresses these shortcomings and enhances transparency by helping to identify permission leaks within code, ultimately reducing complexity.

Performance Insights

OpenJDK's traditional Policy and PermissionCollection implementations suffer from synchronization bottlenecks, particularly due to DNS reliance, in stark contrast to JGDMS’s modern, high-scaling implementation that leverages contemporary coding practices.

Ultimate Goal

Our vision is to foster a community-based redesign of the Java Authorization API, aimed at modernizing its features and capabilities.

Background on OpenJDK's Authorization Removal

The decision to remove Authorization from OpenJDK stemmed from a lack of widespread usage, culminating in an insufficient developer community to support its maintenance.