Blame SOURCES/rh2021263-fips_separate_policy_and_fips_init.patch

97e098
commit 0cd8cee94fe0f867b0b39890e00be620af1d9b07
97e098
Author: Andrew Hughes <gnu.andrew@redhat.com>
97e098
Date:   Tue Jan 18 02:09:27 2022 +0000
97e098
97e098
    RH2021263: Improve Security initialisation, now FIPS support no longer relies on crypto policy support
97e098
97e098
diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java
97e098
index 28ab1846173..f9726741afd 100644
97e098
--- openjdk.orig/src/java.base/share/classes/java/security/Security.java
97e098
+++ openjdk/src/java.base/share/classes/java/security/Security.java
97e098
@@ -61,10 +61,6 @@ public final class Security {
97e098
     private static final Debug sdebug =
97e098
                         Debug.getInstance("properties");
97e098
 
97e098
-    /* System property file*/
97e098
-    private static final String SYSTEM_PROPERTIES =
97e098
-        "/etc/crypto-policies/back-ends/java.config";
97e098
-
97e098
     /* The java.security properties */
97e098
     private static Properties props;
97e098
 
97e098
@@ -206,22 +202,36 @@ public final class Security {
97e098
             }
97e098
         }
97e098
 
97e098
+        if (!loadedProps) {
97e098
+            initializeStatic();
97e098
+            if (sdebug != null) {
97e098
+                sdebug.println("unable to load security properties " +
97e098
+                        "-- using defaults");
97e098
+            }
97e098
+        }
97e098
+
97e098
         String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
97e098
         if ((disableSystemProps == null || "false".equalsIgnoreCase(disableSystemProps)) &&
97e098
             "true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile"))) {
97e098
-            if (SystemConfigurator.configure(props)) {
97e098
-                loadedProps = true;
97e098
+            if (!SystemConfigurator.configureSysProps(props)) {
97e098
+                if (sdebug != null) {
97e098
+                    sdebug.println("WARNING: System properties could not be loaded.");
97e098
+                }
97e098
             }
97e098
         }
97e098
 
97e098
-        if (!loadedProps) {
97e098
-            initializeStatic();
97e098
+        // FIPS support depends on the contents of java.security so
97e098
+        // ensure it has loaded first
97e098
+        if (loadedProps) {
97e098
+            boolean fipsEnabled = SystemConfigurator.configureFIPS(props);
97e098
             if (sdebug != null) {
97e098
-                sdebug.println("unable to load security properties " +
97e098
-                        "-- using defaults");
97e098
+                if (fipsEnabled) {
97e098
+                    sdebug.println("FIPS support enabled.");
97e098
+                } else {
97e098
+                    sdebug.println("FIPS support disabled.");
97e098
+                }
97e098
             }
97e098
         }
97e098
-
97e098
     }
97e098
 
97e098
     /*
97e098
diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
97e098
index 874c6221ebe..b7ed41acf0f 100644
97e098
--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
97e098
+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
97e098
@@ -76,7 +76,7 @@ final class SystemConfigurator {
97e098
      * java.security.disableSystemPropertiesFile property is not set and
97e098
      * security.useSystemPropertiesFile is true.
97e098
      */
97e098
-    static boolean configure(Properties props) {
97e098
+    static boolean configureSysProps(Properties props) {
97e098
         boolean loadedProps = false;
97e098
 
97e098
         try (BufferedInputStream bis =
97e098
@@ -96,11 +96,19 @@ final class SystemConfigurator {
97e098
                 e.printStackTrace();
97e098
             }
97e098
         }
97e098
+        return loadedProps;
97e098
+    }
97e098
+
97e098
+    /*
97e098
+     * Invoked at the end of java.security.Security initialisation
97e098
+     * if java.security properties have been loaded
97e098
+     */
97e098
+    static boolean configureFIPS(Properties props) {
97e098
+        boolean loadedProps = false;
97e098
 
97e098
         try {
97e098
             if (enableFips()) {
97e098
                 if (sdebug != null) { sdebug.println("FIPS mode detected"); }
97e098
-                loadedProps = false;
97e098
                 // Remove all security providers
97e098
                 Iterator<Entry<Object, Object>> i = props.entrySet().iterator();
97e098
                 while (i.hasNext()) {