Repository: wildfly/wildfly
Pull request #18868: [WFLY-20533] Do not set the -Djava.security.manager=allow by default. Only add the property if -secmgr is passed.
Author: login: jamezp
Labels: name: deps-ok
description: Dependencies have been checked, and there are no significant changes
Created: 2025-04-04T22:11:49Z | Merged: 2025-04-08T12:51:57Z

This PR removes the `-Djava.security.manager=allow` argument by default and only adds it if the `-secmgr` is added.

The `ws*` scripts seem to support this, but it doesn't make sense to really do this I would think. However, I left it as I didn't want to change the behavior if the security manager is enabled for whatever reason.

This is the full version https://github.com/wildfly/wildfly-core/pull/6391. Note the way the scripts work in the tests for this PR, it's not really possible to check the JVM parameters. For that reason I was not able to validate via a test. However, this should work.

* https://issues.redhat.com/browse/WFLY-20533
* https://issues.redhat.com/browse/WFLY-20537
* https://issues.redhat.com/browse/WFLY-20538



Diff:
diff --git a/ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.bat b/ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.bat
index 5e5613e3f1ca..a62572c35eac 100644
--- a/ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.bat
+++ b/ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.bat
@@ -116,10 +116,12 @@ if "x%JBOSS_MODULEPATH%" == "x" (
   set  "JBOSS_MODULEPATH=%JBOSS_HOME%\modules"
 )
 
-setlocal EnableDelayedExpansion
-call "!DIRNAME!common.bat" :setSecurityManagerDefault
-set "JAVA_OPTS=!JAVA_OPTS! !SECURITY_MANAGER_CONFIG_OPTION!"
-setlocal DisableDelayedExpansion
+if "%SECMGR%" == "true" (
+    setlocal EnableDelayedExpansion
+    call "!DIRNAME!common.bat" :setSecurityManagerDefault
+    set "JAVA_OPTS=!JAVA_OPTS! !SECURITY_MANAGER_CONFIG_OPTION!"
+    setlocal DisableDelayedExpansion
+)
 
 rem Set the module options
 set "MODULE_OPTS="
diff --git a/ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.sh b/ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.sh
index e93a4cd213e1..81c535c04045 100644
--- a/ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.sh
+++ b/ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.sh
@@ -143,8 +143,10 @@ if $cygwin; then
 fi
 
 # Set default Security Manager configuration value
-setSecurityManagerDefault
-JAVA_OPTS="$JAVA_OPTS $SECURITY_MANAGER_CONFIG_OPTION"
+if [ "$SECMGR" = "true" ]; then
+    setSecurityManagerDefault
+    JAVA_OPTS="$JAVA_OPTS $SECURITY_MANAGER_CONFIG_OPTION"
+fi
 
 # Process the JAVA_OPTS failing if the java.security.manager is set.
 SECURITY_MANAGER_SET=`echo $JAVA_OPTS | $GREP "java\.security\.manager"`
diff --git a/naming/pom.xml b/naming/pom.xml
index 26cb5312db8e..ec821d8f6eb3 100644
--- a/naming/pom.xml
+++ b/naming/pom.xml
@@ -102,4 +102,18 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
+
+    <profiles>
+        <profile>
+            <id>allow-security-manager</id>
+            <activation>
+                <jdk>[17,24)</jdk>
+            </activation>
+
+            <properties>
+                <!-- Required to enable the security manager for testing -->
+                <surefire.system.args>-Djava.security.manager=allow</surefire.system.args>
+            </properties>
+        </profile>
+    </profiles>
 </project>
diff --git a/pom.xml b/pom.xml
index 2ee6ba8ea3a9..66cd1e7f7673 100644
--- a/pom.xml
+++ b/pom.xml
@@ -137,7 +137,6 @@
             --add-opens=java.management/javax.management=ALL-UNNAMED
             --add-opens=java.naming/javax.naming=ALL-UNNAMED
         </modular.jdk.args>
-        <security.manager.props></security.manager.props>
 
         <!--
             See ChildFirstClassLoaderBuilder in model-test for the explanation of the org.jboss.model.test.cache.root and org.jboss.model.test.classpath.cache properties.
@@ -174,7 +173,7 @@
         <surefire.extra.args></surefire.extra.args>
         <surefire.jpda.args></surefire.jpda.args>
         <surefire.non-modular.system.args>-ea -Duser.region=US -Duser.language=en ${surefire.jpda.args} ${surefire.extra.args} ${surefire.jacoco.args}</surefire.non-modular.system.args>
-        <surefire.system.args>${modular.jdk.args} ${security.manager.props} ${surefire.non-modular.system.args}</surefire.system.args>
+        <surefire.system.args>${modular.jdk.args} ${surefire.non-modular.system.args}</surefire.system.args>
         <arquillian.servlet.protocol>Servlet 5.0</arquillian.servlet.protocol>
         <testLogToFile>true</testLogToFile>
         <maven.test.redirectTestOutputToFile>${testLogToFile}</maven.test.redirectTestOutputToFile>
@@ -322,7 +321,7 @@
              on the dependency on the MicroProfile REST Client TCK POM.
          -->
         <version.org.testng.mp.rest.client>7.10.2</version.org.testng.mp.rest.client>
-        <version.org.wildfly.arquillian>5.1.0.Beta10</version.org.wildfly.arquillian>
+        <version.org.wildfly.arquillian>5.1.0.Beta11</version.org.wildfly.arquillian>
         <version.org.wildfly.extras.creaper>2.0.3</version.org.wildfly.extras.creaper>
         <legacy.version.org.wildfly.naming-client>1.0.17.Final</legacy.version.org.wildfly.naming-client>
 
@@ -523,7 +522,7 @@
         <version.org.wildfly.clustering>6.0.1.Final</version.org.wildfly.clustering>
         <version.org.wildfly.core>28.0.0.Beta6</version.org.wildfly.core>
         <version.org.wildfly.http-client>2.1.0.Final</version.org.wildfly.http-client>
-        <version.org.wildfly.launcher>1.0.0.Final</version.org.wildfly.launcher>
+        <version.org.wildfly.launcher>1.0.2.Final</version.org.wildfly.launcher>
         <version.org.wildfly.mvc.krazo>1.0.0.Final</version.org.wildfly.mvc.krazo>
         <version.org.wildfly.vertx>1.0.2.Final</version.org.wildfly.vertx>
         <version.org.wildfly.naming-client>2.0.1.Final</version.org.wildfly.naming-client>
@@ -1526,17 +1525,6 @@
             </modules>
         </profile>
 
-        <profile>
-            <id>jdk18</id>
-            <activation>
-                <jdk>[18,24)</jdk>
-            </activation>
-            <properties>
-                <security.manager.props>
-                    -Djava.security.manager=allow
-                </security.manager.props>
-            </properties>
-        </profile>
         <profile>
             <id>jdk23</id>
             <activation>
diff --git a/testsuite/pom.xml b/testsuite/pom.xml
index cc4831e654a5..c4873ba49c93 100644
--- a/testsuite/pom.xml
+++ b/testsuite/pom.xml
@@ -160,13 +160,13 @@
         <surefire.jpda.args></surefire.jpda.args>
         <as.debug.port>8787</as.debug.port>
         <!-- The JPMS settings needed by the client side of a portion of the testsuite.
-             Defaults to ${modular.jdk.args} plus ${security.manager.props}, i.e. the standard list of recommended
+             Defaults to ${modular.jdk.args}, i.e. the standard list of recommended
              client side JPMS settings for users of our client-side libraries.
              If particular tests need additional settings to support client-side behavior
              in their test code, then this property should be overridden in as fine-grained
              a location as is practical; no more coarse-grained than the global config of
              the pom for the maven module that includes the test. -->
-        <modular.jdk.testsuite.args>${modular.jdk.args} ${security.manager.props}</modular.jdk.testsuite.args>
+        <modular.jdk.testsuite.args>${modular.jdk.args}</modular.jdk.testsuite.args>
         <surefire.system.args>${modular.jdk.testsuite.args} -Dorg.jboss.ejb.client.wildfly-testsuite-hack=true ${surefire.memory.args} ${surefire.jpda.args} -Djboss.dist=${jboss.dist} ${surefire.jacoco.args} -Dmaven.repo.local=${settings.localRepository}</surefire.system.args>
         <extra.server.jvm.args />
         <!-- needed for arquillian-byteman-extension -->
diff --git a/testsuite/scripts/src/test/java/org/wildfly/test/scripts/ScriptProcess.java b/testsuite/scripts/src/test/java/org/wildfly/test/scripts/ScriptProcess.java
index 7ea7154c270e..5567b8326a34 100644
--- a/testsuite/scripts/src/test/java/org/wildfly/test/scripts/ScriptProcess.java
+++ b/testsuite/scripts/src/test/java/org/wildfly/test/scripts/ScriptProcess.java
@@ -168,8 +168,23 @@ private List<String> getCommand(final Collection<String> arguments) {
 
     @Override
     public void close() {
-        destroy(delegate);
-        delegate = null;
+        try {
+            if (this.delegate != null) {
+                // First attempt to destroy all the child processes
+                delegate.children().forEachOrdered(child -> {
+                    if (child.destroyForcibly()) {
+                        try {
+                            child.onExit().get(timeout, TimeUnit.SECONDS);
+                        } catch (InterruptedException | ExecutionException | TimeoutException e) {
+                            LOGGER.errorf(e, "Failed to destroy child %s", child);
+                        }
+                    }
+                });
+            }
+        } finally {
+            destroy(delegate);
+            delegate = null;
+        }
     }
 
     @Override


Reviews:
user: login: jamezp
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T22:13:01Z
user: login: bstansberry
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-04T23:35:50Z
user: login: jamezp
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-04T23:45:16Z
user: login: bstansberry
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-05T01:06:31Z

Review comments:
diff_hunk: @@ -1526,17 +1525,6 @@
             </modules>
         </profile>
 
-        <profile>
-            <id>jdk18</id>
-            <activation>
-                <jdk>[18,24)</jdk>
-            </activation>
-            <properties>
-                <security.manager.props>
-                    -Djava.security.manager=allow
-                </security.manager.props>
-            </properties>
-        </profile>
path: pom.xml
user: login: jamezp
body: Note, there is no need for this which is why I removed it. By default, the wildfly-launcher will add the appropriate JVM arguments. I assume this was added originally as a workaround.
created_at: 2025-04-04T22:13:01Z
author_association: MEMBER
diff_hunk: @@ -83,10 +83,12 @@ if "x%JAVA_HOME%" == "x" (
 )
 
 rem set default modular jvm parameters
-setlocal EnableDelayedExpansion
-call "!DIRNAME!common.bat" :setDefaultModularJvmOptions "!JAVA_OPTS!"
-set "JAVA_OPTS=!JAVA_OPTS! !DEFAULT_MODULAR_JVM_OPTIONS!"
-setlocal DisableDelayedExpansion
+if "%SECMGR%" == "true" (
+    setlocal EnableDelayedExpansion
+    call "!DIRNAME!common.bat" :setDefaultModularJvmOptions "!JAVA_OPTS!"
+    set "JAVA_OPTS=!JAVA_OPTS! !DEFAULT_MODULAR_JVM_OPTIONS!"
+    setlocal DisableDelayedExpansion
+)
path: ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.bat
user: login: bstansberry
body: This is not about SM. It's about --add-opens etc and should not be changed as part of this JIRA.  If something needs changing it's another JIRA.
created_at: 2025-04-04T23:34:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -50,12 +50,6 @@ if "x%JAVA_HOME%" == "x" (
   set "JAVA=%JAVA_HOME%\bin\java"
 )
 
-rem set default modular jvm parameters
-setlocal EnableDelayedExpansion
-call "!DIRNAME!common.bat" :setDefaultModularJvmOptions "!JAVA_OPTS!"
-set "JAVA_OPTS=!JAVA_OPTS! !DEFAULT_MODULAR_JVM_OPTIONS!"
-setlocal DisableDelayedExpansion
path: ee-feature-pack/galleon-shared/src/main/resources/content/bin/jdr.bat
user: login: bstansberry
body: Not about SM; shouldn't be changed.
created_at: 2025-04-04T23:34:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -57,10 +57,6 @@ if [ "x$JAVA" = "x" ]; then
     fi
 fi
 
-# Set default modular JVM options
-setDefaultModularJvmOptions $JAVA_OPTS
-JAVA_OPTS="$JAVA_OPTS $DEFAULT_MODULAR_JVM_OPTIONS"
path: ee-feature-pack/galleon-shared/src/main/resources/content/bin/jdr.sh
user: login: bstansberry
body: Not about SM; shouldn't be changed.
created_at: 2025-04-04T23:34:43Z
author_association: CONTRIBUTOR
diff_hunk: @@ -49,10 +49,12 @@ if "x%JAVA_HOME%" == "x" (
 )
 
 rem set default modular jvm parameters
-setlocal EnableDelayedExpansion
-call "!DIRNAME!common.bat" :setDefaultModularJvmOptions "!JAVA_OPTS!"
-set "JAVA_OPTS=!JAVA_OPTS! !DEFAULT_MODULAR_JVM_OPTIONS!"
-setlocal DisableDelayedExpansion
+if "%SECMGR%" == "true" (
+    setlocal EnableDelayedExpansion
+    call "!DIRNAME!common.bat" :setDefaultModularJvmOptions "!JAVA_OPTS!"
+    set "JAVA_OPTS=!JAVA_OPTS! !DEFAULT_MODULAR_JVM_OPTIONS!"
+    setlocal DisableDelayedExpansion
+)
path: ee-feature-pack/galleon-shared/src/main/resources/content/bin/wsconsume.bat
user: login: bstansberry
body: Not about SM; shouldn't be changed.
created_at: 2025-04-04T23:34:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -63,8 +63,10 @@ if [ "x$JAVA" = "x" ]; then
 fi
 
 # Set default modular JVM options
-setDefaultModularJvmOptions $JAVA_OPTS
-JAVA_OPTS="$JAVA_OPTS $DEFAULT_MODULAR_JVM_OPTIONS"
+if [ "$SECMGR" = "true" ]; then
+    setDefaultModularJvmOptions $JAVA_OPTS
+    JAVA_OPTS="$JAVA_OPTS $DEFAULT_MODULAR_JVM_OPTIONS"
+fi
path: ee-feature-pack/galleon-shared/src/main/resources/content/bin/wsconsume.sh
user: login: bstansberry
body: Not about SM; shouldn't be changed.
created_at: 2025-04-04T23:34:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -47,12 +47,12 @@ if "x%JAVA_HOME%" == "x" (
 ) else (
   set "JAVA=%JAVA_HOME%\bin\java"
 )
-
-rem set default modular jvm parameters
-setlocal EnableDelayedExpansion
-call "!DIRNAME!common.bat" :setDefaultModularJvmOptions "!JAVA_OPTS!"
-set "JAVA_OPTS=!JAVA_OPTS! !DEFAULT_MODULAR_JVM_OPTIONS!"
-setlocal DisableDelayedExpansion
+if "%SECMGR%" == "true" (
+    setlocal EnableDelayedExpansion
+    call "!DIRNAME!common.bat" :setDefaultModularJvmOptions "!JAVA_OPTS!"
+    set "JAVA_OPTS=!JAVA_OPTS! !DEFAULT_MODULAR_JVM_OPTIONS!"
+    setlocal DisableDelayedExpansion
+)
path: ee-feature-pack/galleon-shared/src/main/resources/content/bin/wsprovide.bat
user: login: bstansberry
body: Not about SM; shouldn't be changed.
created_at: 2025-04-04T23:35:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -63,8 +63,10 @@ if [ "x$JAVA" = "x" ]; then
 fi
 
 # Set default modular JVM options
-setDefaultModularJvmOptions $JAVA_OPTS
-JAVA_OPTS="$JAVA_OPTS $DEFAULT_MODULAR_JVM_OPTIONS"
+if [ "$SECMGR" = "true" ]; then
+    setDefaultModularJvmOptions $JAVA_OPTS
+    JAVA_OPTS="$JAVA_OPTS $DEFAULT_MODULAR_JVM_OPTIONS"
+fi
path: ee-feature-pack/galleon-shared/src/main/resources/content/bin/wsprovide.sh
user: login: bstansberry
body: Not about SM; shouldn't be changed.
created_at: 2025-04-04T23:35:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -83,10 +83,12 @@ if "x%JAVA_HOME%" == "x" (
 )
 
 rem set default modular jvm parameters
-setlocal EnableDelayedExpansion
-call "!DIRNAME!common.bat" :setDefaultModularJvmOptions "!JAVA_OPTS!"
-set "JAVA_OPTS=!JAVA_OPTS! !DEFAULT_MODULAR_JVM_OPTIONS!"
-setlocal DisableDelayedExpansion
+if "%SECMGR%" == "true" (
+    setlocal EnableDelayedExpansion
+    call "!DIRNAME!common.bat" :setDefaultModularJvmOptions "!JAVA_OPTS!"
+    set "JAVA_OPTS=!JAVA_OPTS! !DEFAULT_MODULAR_JVM_OPTIONS!"
+    setlocal DisableDelayedExpansion
+)
path: ee-feature-pack/galleon-shared/src/main/resources/content/bin/appclient.bat
user: login: jamezp
body: Good catch on all these. I clearly scanned for the wrong function name.
created_at: 2025-04-04T23:45:16Z
author_association: MEMBER

PR comments:
user: login: bstansberry
created_at: 2025-04-06T02:23:39Z
body: @jamezp The SE 21 failures look related, perhaps from changes in wildfly-launcher?
author_association: CONTRIBUTOR
user: login: jamezp
created_at: 2025-04-06T14:56:06Z
body: They do look related indeed. I'll have a look as soon as I can. 
author_association: MEMBER
user: login: yersan
created_at: 2025-04-07T08:27:24Z
body: Looks like it's caused by the unit test design itself. Maybe the failed ones should only run if the sec manager is enabled, or this specific test case itself should be run with `-Djava.security.manager=allow`
author_association: CONTRIBUTOR
user: login: jamezp
created_at: 2025-04-07T14:39:09Z
body: > Looks like it's caused by the unit test design itself. Maybe the failed ones should only run if the sec manager is enabled, or this specific test case itself should be run with `-Djava.security.manager=allow`

Yes, that was it. I had removed the argument from the main POM and now just added it back to the `naming/pom.xml`
author_association: MEMBER
user: login: jamezp
created_at: 2025-04-07T15:16:07Z
body: Not sure why it's not updating, but CI is running on https://ci.wildfly.org/project/WF_PullRequest?branch=pull%2F18868&mode=builds
author_association: MEMBER
user: login: jamezp
created_at: 2025-04-08T01:02:32Z
body: The last failure is unrelated.
author_association: MEMBER
user: login: bstansberry
created_at: 2025-04-08T12:52:06Z
body: Thanks @jamezp 
author_association: CONTRIBUTOR