Ensure Security class is loaded when checking FIPS mode

[dev-koan]

Initialize security class when accessing com.ibm.fips.mode property or obtaining all the properties using the method getProperties.

Signed-off-by: Dev Agarwal [email protected]

[dev-koan]

The feature is tested in PR => ibmruntimes/openj9-openjdk-jdk#1185

[pshipton]

@jasonkatonica I thought we were going to use a Security property rather than a System property.

[jasonkatonica]

After talking more yesterday at our team meeting we want to support a System property, not a Security property. This property wont be a direct value that is typically in a java.security file and available through the Security class.

We also want applications who have coded to this behavior in IBM Java 8 ( and Semeru ) to not be required to make changes in this area. Sure this property does not always work today given the classloading race condition here however further discussion flushed out that we really want to support this as a System property if possible.

[jasonkatonica]

We would like to support our existing documented behavior in section Java properties and other external interfaces at https://www.ibm.com/support/pages/node/7113528

[keithc-ca]

support our existing documented behavior

That documentation doesn't specifically say how to acquire the system property value. As is, this doesn't guarantee that System.getProperties().getProperty("com.ibm.fips.mode") yields the desired value.

[jasonkatonica]

That documentation doesn't specifically say how to acquire the system property value. As is, this doesn't guarantee that System.getProperties().getProperty("com.ibm.fips.mode") yields the desired value.

Yes very true likely additional work would be needed for this corner case to ensure we reference the Security class that makes this value accurate for the api you describe for com.ibm.fips.mode

[keithc-ca]

The commit message and the description here need not mention RestrictedSecurity.

[keithc-ca]

The commit message says this forces "initialization of Security providers"; that is no longer true. Please update accordingly.

This still doesn't address my earlier concern: #23490 (comment). Unless that is fixed (in a reasonable way), I think we should instead advise users to use Security.getProperty("com.ibm.fips.mode") which can more easily be made to work reliably.

[dev-koan]

The commit message says this forces "initialization of Security providers"; that is no longer true. Please update accordingly.

This still doesn't address my earlier concern: #23490 (comment). Unless that is fixed (in a reasonable way), I think we should instead advise users to use Security.getProperty("com.ibm.fips.mode") which can more easily be made to work reliably.

The commit has been updated.
I have added J9VMInternals.initialize(Security.class); in the getProperties() to make sure Security class is initialized. (When security class is initialized systemProperties is also updated.)

[keithc-ca]

The change below to getProperty(String, String) will only trigger loading Security if the property of interest is "com.ibm.fips.mode"; while this has the potential to affect startup performance for every application, including those that don't use Security. I'm having difficulty accepting that instead of changing our advice for querying the FIPS mode via a system property to using Security.getProperty("com.ibm.fips.mode").

@pshipton What do you think?

[pshipton]

It's not ideal and using a Security property would be better, but I doubt the change in startup time would be measurable. If this is what we need to do for compatibility, so be it.