Skip to content

Commit c249025

Browse files
srinjoyraygae-java-bot
srinjoyray
authored and
gae-java-bot
committed
Removing use of Java security manager from appengine_standard/runtime
PiperOrigin-RevId: 725059265 Change-Id: Ia65414b28aed4054ba3ceff820340fb0a66b0ef5
1 parent a3ad114 commit c249025

4 files changed

Lines changed: 67 additions & 147 deletions

File tree

‎runtime/impl/src/main/java/com/google/apphosting/runtime/ApiProxyImpl.java‎

Lines changed: 9 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,6 @@
4949
import com.google.protobuf.ByteString;
5050
import com.google.protobuf.ExtensionRegistry;
5151
import com.google.protobuf.InvalidProtocolBufferException;
52-
import java.security.AccessControlContext;
53-
import java.security.AccessController;
54-
import java.security.PrivilegedAction;
5552
import java.time.Duration;
5653
import java.util.Collections;
5754
import java.util.HashMap;
@@ -289,8 +286,7 @@ public byte[] makeSyncCall(
289286
final String packageName,
290287
final String methodName,
291288
final byte[] request) {
292-
return AccessController.doPrivileged(
293-
(PrivilegedAction<byte[]>) () -> doSyncCall(environment, packageName, methodName, request));
289+
return doSyncCall(environment, packageName, methodName, request);
294290
}
295291

296292
@Override
@@ -300,9 +296,8 @@ public Future<byte[]> makeAsyncCall(
300296
final String methodName,
301297
final byte[] request,
302298
final ApiProxy.ApiConfig apiConfig) {
303-
return AccessController.doPrivileged(
304-
(PrivilegedAction<Future<byte[]>>) () -> doAsyncCall(
305-
environment, packageName, methodName, request, apiConfig.getDeadlineInSeconds()));
299+
return doAsyncCall(
300+
environment, packageName, methodName, request, apiConfig.getDeadlineInSeconds());
306301
}
307302

308303
private byte[] doSyncCall(
@@ -1350,7 +1345,7 @@ public void run() {
13501345
}
13511346
}
13521347

1353-
private static PrivilegedAction<Void> runWithThreadContext(
1348+
private static Runnable runWithThreadContext(
13541349
Runnable runnable, Environment environment, CloudTraceContext parentThreadContext) {
13551350
return () -> {
13561351
CloudTrace.setCurrentContext(environment, parentThreadContext);
@@ -1359,7 +1354,6 @@ private static PrivilegedAction<Void> runWithThreadContext(
13591354
} finally {
13601355
CloudTrace.setCurrentContext(environment, null);
13611356
}
1362-
return null;
13631357
};
13641358
}
13651359

@@ -1376,16 +1370,10 @@ public Thread newThread(final Runnable runnable) {
13761370
ThreadGroup requestThreadGroup = environment.getRequestThreadGroup();
13771371
RequestState requestState = environment.getRequestState();
13781372

1379-
CloudTraceContext parentThreadContext =
1380-
CloudTrace.getCurrentContext(environment);
1381-
AccessControlContext context = AccessController.getContext();
1382-
Runnable contextRunnable =
1383-
() ->
1384-
AccessController.doPrivileged(
1385-
runWithThreadContext(runnable, environment, parentThreadContext), context);
1386-
return AccessController.doPrivileged(
1387-
(PrivilegedAction<Thread>) () -> new CurrentRequestThread(
1388-
requestThreadGroup, contextRunnable, runnable, requestState, environment));
1373+
CloudTraceContext parentThreadContext = CloudTrace.getCurrentContext(environment);
1374+
Runnable contextRunnable = runWithThreadContext(runnable, environment, parentThreadContext);
1375+
return new CurrentRequestThread(
1376+
requestThreadGroup, contextRunnable, runnable, requestState, environment);
13891377
}
13901378
}
13911379

@@ -1408,11 +1396,7 @@ public Thread newThread(final Runnable runnable) {
14081396

14091397
CloudTraceContext parentThreadContext =
14101398
CloudTrace.getCurrentContext(environment);
1411-
AccessControlContext context = AccessController.getContext();
1412-
Runnable contextRunnable =
1413-
() ->
1414-
AccessController.doPrivileged(
1415-
runWithThreadContext(runnable, environment, parentThreadContext), context);
1399+
Runnable contextRunnable = runWithThreadContext(runnable, environment, parentThreadContext);
14161400

14171401
String requestId = systemService.startBackgroundRequest();
14181402
Number deadline = MoreObjects.firstNonNull(

‎runtime/impl/src/main/java/com/google/apphosting/runtime/AppVersionFactory.java‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@
3535
import java.io.FileNotFoundException;
3636
import java.io.IOException;
3737
import java.lang.Thread.UncaughtExceptionHandler;
38-
import java.lang.reflect.Field;
3938
import java.net.MalformedURLException;
4039
import java.net.URL;
4140
import java.nio.file.FileSystems;
@@ -257,7 +256,6 @@ public AppVersion createAppVersion(
257256
.setUncaughtExceptionHandler(uncaughtExceptionHandler)
258257
.setIgnoreDaemonThreads(ignoreDaemonThreads)
259258
.build();
260-
suppressJaxbWarningReflectionIsNotAllowed(classLoader);
261259
setApplicationDirectory(rootDirectory.getAbsolutePath());
262260
return AppVersion.builder()
263261
.setAppVersionKey(appVersionKey)
@@ -535,35 +533,6 @@ private URL[] getUrls(ClassPathBuilder classPathBuilder) {
535533
return urls;
536534
}
537535

538-
/**
539-
* Suppresses the warning that JAXB logs when reflection is not allowed on
540-
* a field.
541-
* Most annoyingly, the warning is logged the first time that a JAX-WS service
542-
* class is instantiated, due to the private fields in the
543-
* {@code javax.xml.ws.wsaddressing.W3CEndpointReference} class.
544-
* Since this warning is only logged once, irrespective of the number of class/field
545-
* combinations for which reflection fails, there is little that is lost in
546-
* suppressing it. See b/5609065 for more information.
547-
*
548-
* @param classLoader the application ClassLoader
549-
*/
550-
private void suppressJaxbWarningReflectionIsNotAllowed(ClassLoader classLoader) {
551-
// Suppressing the warning is only meaningful in runtimes that install a security manager.
552-
if (System.getSecurityManager() != null) {
553-
try {
554-
// Must use reflection here because the JAXB implementation classes are
555-
// on the application classpath.
556-
Class<?> accessorClass =
557-
classLoader.loadClass("com.sun.xml.bind.v2.runtime.reflect.Accessor");
558-
Field accessWarned = accessorClass.getDeclaredField("accessWarned");
559-
accessWarned.setAccessible(true);
560-
accessWarned.setBoolean(null, true);
561-
} catch (Exception e) {
562-
logger.atWarning().withCause(e).log("failed to suppress JAXB warning reflectively");
563-
}
564-
}
565-
}
566-
567536
private static void setApplicationDirectory(String path) throws IOException {
568537
// Set the (real) "user.dir" system property to the application directory,
569538
// so that calls like File.getAbsolutePath() will return the expected path

‎runtime/impl/src/main/java/com/google/apphosting/runtime/RequestManager.java‎

Lines changed: 30 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,6 @@
4545
import java.net.URI;
4646
import java.net.URISyntaxException;
4747
import java.net.URL;
48-
import java.security.AccessController;
49-
import java.security.PrivilegedAction;
5048
import java.text.DateFormat;
5149
import java.text.SimpleDateFormat;
5250
import java.time.Duration;
@@ -588,18 +586,13 @@ public void sendDeadline(RequestToken token, boolean isUncatchable) {
588586
}
589587
logger.atInfo().log("Stopping request thread.");
590588
// Throw the exception in targetThread.
591-
AccessController.doPrivileged(
592-
(PrivilegedAction<Void>) () -> {
593-
try {
594-
ThreadStop0Holder.threadStop0.invoke(targetThread, throwable);
595-
} catch (Exception e) {
596-
logger.atWarning().withCause(e).log("Failed to stop thread");
597-
}
598-
return null;
599-
});
589+
try {
590+
ThreadStop0Holder.threadStop0.invoke(targetThread, throwable);
591+
} catch (Exception e) {
592+
logger.atWarning().withCause(e).log("Failed to stop thread");
593+
}
600594
}
601595
}
602-
603596
}
604597

605598
private String threadDump(Collection<Thread> threads, String prefix) {
@@ -900,30 +893,24 @@ public List<Thread> getRequestThreads(AppVersionKey appVersionKey) {
900893
}
901894

902895
/**
903-
* Consults {@link ThreadMXBean#findDeadlockedThreads()} to see if
904-
* any deadlocks are currently present. If so, it will
905-
* immediately respond to the runtime and simulate a LOG(FATAL)
906-
* containing the stack trace of the offending threads.
896+
* Consults {@link ThreadMXBean#findDeadlockedThreads()} to see if any deadlocks are currently
897+
* present. If so, it will immediately respond to the runtime and simulate a LOG(FATAL) containing
898+
* the stack trace of the offending threads.
907899
*/
908900
private void checkForDeadlocks(final RequestToken token) {
909-
AccessController.doPrivileged(
910-
(PrivilegedAction<Object>) () -> {
911-
long[] deadlockedThreadsIds = THREAD_MX.findDeadlockedThreads();
912-
if (deadlockedThreadsIds != null) {
913-
StringBuilder builder = new StringBuilder();
914-
builder.append(
915-
"Detected a deadlock across " + deadlockedThreadsIds.length + " threads:");
916-
for (ThreadInfo info :
917-
THREAD_MX.getThreadInfo(deadlockedThreadsIds, MAXIMUM_DEADLOCK_STACK_LENGTH)) {
918-
builder.append(info);
919-
builder.append("\n");
920-
}
921-
String message = builder.toString();
922-
token.addAppLogMessage(Level.fatal, message);
923-
token.logAndKillRuntime(message);
924-
}
925-
return null;
926-
});
901+
long[] deadlockedThreadsIds = THREAD_MX.findDeadlockedThreads();
902+
if (deadlockedThreadsIds != null) {
903+
StringBuilder builder = new StringBuilder();
904+
builder.append("Detected a deadlock across " + deadlockedThreadsIds.length + " threads:");
905+
for (ThreadInfo info :
906+
THREAD_MX.getThreadInfo(deadlockedThreadsIds, MAXIMUM_DEADLOCK_STACK_LENGTH)) {
907+
builder.append(info);
908+
builder.append("\n");
909+
}
910+
String message = builder.toString();
911+
token.addAppLogMessage(Level.fatal, message);
912+
token.logAndKillRuntime(message);
913+
}
927914
}
928915

929916
private void logMemoryStats() {
@@ -934,22 +921,15 @@ private void logMemoryStats() {
934921
}
935922

936923
private void logAllStackTraces() {
937-
AccessController.doPrivileged(
938-
(PrivilegedAction<Object>)
939-
() -> {
940-
long[] allthreadIds = THREAD_MX.getAllThreadIds();
941-
StringBuilder builder = new StringBuilder();
942-
builder.append(
943-
"Dumping thread info for all " + allthreadIds.length + " runtime threads:");
944-
for (ThreadInfo info :
945-
THREAD_MX.getThreadInfo(allthreadIds, MAXIMUM_DEADLOCK_STACK_LENGTH)) {
946-
builder.append(info);
947-
builder.append("\n");
948-
}
949-
String message = builder.toString();
950-
logger.atInfo().log("%s", message);
951-
return null;
952-
});
924+
long[] allthreadIds = THREAD_MX.getAllThreadIds();
925+
StringBuilder builder = new StringBuilder();
926+
builder.append("Dumping thread info for all " + allthreadIds.length + " runtime threads:");
927+
for (ThreadInfo info : THREAD_MX.getThreadInfo(allthreadIds, MAXIMUM_DEADLOCK_STACK_LENGTH)) {
928+
builder.append(info);
929+
builder.append("\n");
930+
}
931+
String message = builder.toString();
932+
logger.atInfo().log("%s", message);
953933
}
954934

955935
private Throwable createDeadlineThrowable(String message, boolean isUncatchable) {

‎runtime/lite/src/main/java/com/google/appengine/runtime/lite/RequestManager.java‎

Lines changed: 28 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,6 @@
5454
import java.net.URI;
5555
import java.net.URISyntaxException;
5656
import java.net.URL;
57-
import java.security.AccessController;
58-
import java.security.PrivilegedAction;
5957
import java.text.DateFormat;
6058
import java.text.SimpleDateFormat;
6159
import java.time.Duration;
@@ -774,27 +772,22 @@ public List<Thread> getRequestThreads(AppVersionKey appVersionKey) {
774772
* the stack trace of the offending threads.
775773
*/
776774
private void checkForDeadlocks(final RequestToken token) {
777-
AccessController.doPrivileged(
778-
(PrivilegedAction<Object>)
779-
() -> {
780-
long[] deadlockedThreadsIds = THREAD_MX.findDeadlockedThreads();
781-
if (deadlockedThreadsIds != null) {
782-
StringBuilder builder = new StringBuilder();
783-
builder.append(
784-
"Detected a deadlock across ")
785-
.append(deadlockedThreadsIds.length)
786-
.append(" threads:");
787-
for (ThreadInfo info :
788-
THREAD_MX.getThreadInfo(deadlockedThreadsIds, MAXIMUM_DEADLOCK_STACK_LENGTH)) {
789-
builder.append(info);
790-
builder.append("\n");
791-
}
792-
String message = builder.toString();
793-
token.addAppLogMessage(Level.fatal, message);
794-
token.logAndKillRuntime(message);
795-
}
796-
return null;
797-
});
775+
long[] deadlockedThreadsIds = THREAD_MX.findDeadlockedThreads();
776+
if (deadlockedThreadsIds != null) {
777+
StringBuilder builder = new StringBuilder();
778+
builder
779+
.append("Detected a deadlock across ")
780+
.append(deadlockedThreadsIds.length)
781+
.append(" threads:");
782+
for (ThreadInfo info :
783+
THREAD_MX.getThreadInfo(deadlockedThreadsIds, MAXIMUM_DEADLOCK_STACK_LENGTH)) {
784+
builder.append(info);
785+
builder.append("\n");
786+
}
787+
String message = builder.toString();
788+
token.addAppLogMessage(Level.fatal, message);
789+
token.logAndKillRuntime(message);
790+
}
798791
}
799792

800793
private void logMemoryStats() {
@@ -805,24 +798,18 @@ private void logMemoryStats() {
805798
}
806799

807800
private void logAllStackTraces() {
808-
AccessController.doPrivileged(
809-
(PrivilegedAction<Object>)
810-
() -> {
811-
long[] allthreadIds = THREAD_MX.getAllThreadIds();
812-
StringBuilder builder = new StringBuilder();
813-
builder
814-
.append("Dumping thread info for all ")
815-
.append(allthreadIds.length)
816-
.append(" runtime threads:");
817-
for (ThreadInfo info :
818-
THREAD_MX.getThreadInfo(allthreadIds, MAXIMUM_DEADLOCK_STACK_LENGTH)) {
819-
builder.append(info);
820-
builder.append("\n");
821-
}
822-
String message = builder.toString();
823-
logger.atInfo().log("%s", message);
824-
return null;
825-
});
801+
long[] allthreadIds = THREAD_MX.getAllThreadIds();
802+
StringBuilder builder = new StringBuilder();
803+
builder
804+
.append("Dumping thread info for all ")
805+
.append(allthreadIds.length)
806+
.append(" runtime threads:");
807+
for (ThreadInfo info : THREAD_MX.getThreadInfo(allthreadIds, MAXIMUM_DEADLOCK_STACK_LENGTH)) {
808+
builder.append(info);
809+
builder.append("\n");
810+
}
811+
String message = builder.toString();
812+
logger.atInfo().log("%s", message);
826813
}
827814

828815
private Throwable createDeadlineThrowable(String message, boolean isUncatchable) {

0 commit comments

Comments
 (0)