Skip to content

Lift minimum JDK version to 21 and remove SecurityManager #2214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
holgerfriedrich wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Lift minimum JDK version to 21 and remove SecurityManager #2214

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a48395e
Lift minimum JDK version to 21 and remove SecurityManager
holgerfriedrich Dec 27, 2025
7183302
disable org.osgi.framework.security in JavaSecurityTest
holgerfriedrich Apr 14, 2026
3165445
Updated how Java 21 is set in various places
CptBartender Jun 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,10 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Set up JDK 17
- name: Set up JDK 21
uses: actions/setup-java@v5
with:
java-version: '17'
java-version: '21'
distribution: 'temurin'
cache: 'maven'
- name: Build
Expand Down Expand Up @@ -74,10 +74,10 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v7
- name: Set up JDK 17
- name: Set up JDK 21
uses: actions/setup-java@v5
with:
java-version: '17'
java-version: '21'
distribution: 'temurin'
cache: 'maven'
- name: Restore Maven Local Repository
Expand Down
4 changes: 2 additions & 2 deletions BUILDING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,13 @@

## Initial Setup

1. Install J2SE 11 SDK (or later)
1. Install J2SE 21 SDK (or later)

2. Make sure that your JAVA_HOME environment variable is set to the newly installed
JDK location, and that your PATH includes `%JAVA_HOME%\bin` (windows) or
`$JAVA_HOME$/bin` (unix).

3. Install Maven 3.8.0 (or later), which can be downloaded from
3. Install Maven 3.8.8 (or later), which can be downloaded from
http://maven.apache.org/download.html. Make sure that your PATH includes
the `$MVN_HOME/bin` directory.

Expand Down
2 changes: 1 addition & 1 deletion archetypes/assembly/src/main/resources/archetype-resources/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@
<!-- minimal distribution -->
<!--<feature>minimal</feature>-->
</bootFeatures>
<javase>17</javase>
<javase>^javaVersion^</javase>
</configuration>
</plugin>
</plugins>
Expand Down
5 changes: 3 additions & 2 deletions archetypes/blueprint/src/main/resources/archetype-resources/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,8 +63,9 @@
<artifactId>maven-compiler-plugin</artifactId>
<version>3.15.0</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
<release>21</release>
<source>21</source>
<target>21</target>
<maxmem>256M</maxmem>
</configuration>
</plugin>
Expand Down
5 changes: 3 additions & 2 deletions archetypes/bundle/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,9 @@
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>1.8</source>
<target>1.8</target>
<release>21</release>
<source>21</source>
<target>21</target>
<maxmem>256M</maxmem>
</configuration>
</plugin>
Expand Down
5 changes: 3 additions & 2 deletions archetypes/bundle/src/main/resources/archetype-resources/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,9 @@
<artifactId>maven-compiler-plugin</artifactId>
<version>3.15.0</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
<release>21</release>
<source>21</source>
<target>21</target>
<maxmem>256M</maxmem>
</configuration>
</plugin>
Expand Down
5 changes: 3 additions & 2 deletions archetypes/command/src/main/resources/archetype-resources/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,8 +67,9 @@
<inherited>true</inherited>
<version>3.15.0</version>
<configuration>
<source>1.8</source>
<target>1.8</target>
<release>21</release>
<source>21</source>
<target>21</target>
</configuration>
</plugin>
<plugin>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/apache-karaf-integration/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@
</bootFeatures>
<libraries>
</libraries>
<javase>17</javase>
<javase>${javaVersion}</javase>
<generateConsistencyReport>${project.build.directory}</generateConsistencyReport>
<consistencyReportProjectName>Apache Karaf Integration</consistencyReportProjectName>
</configuration>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/apache-karaf-minimal/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@
!org.apache.karaf.command.acl.*,
*
</pidsToExtract>
<javase>17</javase>
<javase>${javaVersion}</javase>
</configuration>
</plugin>
<plugin>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/apache-karaf/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@
</bootFeatures>
<libraries>
</libraries>
<javase>17</javase>
<javase>${javaVersion}</javase>
<generateConsistencyReport>${project.build.directory}</generateConsistencyReport>
<consistencyReportProjectName>Apache Karaf (full)</consistencyReportProjectName>
</configuration>
Expand Down
6 changes: 0 additions & 6 deletions assemblies/features/base/src/main/filtered-resources/resources/bin/inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,6 @@ setupVendorSepcifics() {
setupDefaults() {
DEFAULT_JAVA_OPTS="-XX:+UnlockDiagnosticVMOptions "

if [ "${VERSION}" -gt "11" ]; then
# TODO revisit EventAdminImpl to avoid use of Subject.getSubject(AccessController.getContext());
# -Djava.security.manager=allow is a workaround for SecurityController deprecation in JDK23+
DEFAULT_JAVA_OPTS="$DEFAULT_JAVA_OPTS -Djava.security.manager=allow "
fi

setupVendorSepcifics

DEFAULT_JAVA_OPTS="${DEFAULT_JAVA_OPTS} ${JAVA_VENDOR_OPTS}"
Expand Down
4 changes: 0 additions & 4 deletions assemblies/features/base/src/main/filtered-resources/resources/bin/karaf.bat
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,10 +267,6 @@ if not exist "%JAVA_HOME%\bin\server\jvm.dll" (
)
set DEFAULT_JAVA_OPTS=-XX:+UnlockDiagnosticVMOptions

if "%JAVA_VERSION%" GTR 11 (
set DEFAULT_JAVA_OPTS=%DEFAULT_JAVA_OPTS% -Djava.security.manager=allow
)

if "%JAVA_OPTS%" == "" set JAVA_OPTS=%DEFAULT_JAVA_OPTS%

if "%EXTRA_JAVA_OPTS%" == "" goto :KARAF_EXTRA_JAVA_OPTS_END
Expand Down
2 changes: 1 addition & 1 deletion assemblies/features/enterprise/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>17</javase>
<javase>${javaVersion}</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down
2 changes: 1 addition & 1 deletion assemblies/features/integration/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>17</javase>
<javase>${javaVersion}</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down
4 changes: 2 additions & 2 deletions assemblies/features/specs/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>17</javase>
<javase>${javaVersion}</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down Expand Up @@ -149,4 +149,4 @@
</profile>
</profiles>

</project>
</project>
2 changes: 1 addition & 1 deletion assemblies/features/spring/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>17</javase>
<javase>${javaVersion}</javase>
<framework>
<feature>framework</feature>
</framework>
Expand Down
4 changes: 2 additions & 2 deletions assemblies/features/standard/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -476,7 +476,7 @@
<descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
</descriptors>
<distribution>org.apache.karaf.features:framework</distribution>
<javase>17</javase>
<javase>${javaVersion}</javase>
<framework>
<feature>framework</feature>
</framework>
Expand All @@ -503,7 +503,7 @@
<artifacts>
<artifact>
<file>target/feature/feature.xml</file>
<classifier>features</classifier>
<classifier>features</classifier>
<type>xml</type>
</artifact>
</artifacts>
Expand Down
4 changes: 2 additions & 2 deletions examples/karaf-docker-example/karaf-docker-example-dynamic-dist/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@
</bootFeatures>
<libraries>
</libraries>
<javase>17</javase>
<javase>${javaVersion}</javase>
</configuration>
</plugin>
</plugins>
Expand Down Expand Up @@ -194,4 +194,4 @@
</profile>
</profiles>

</project>
</project>
2 changes: 1 addition & 1 deletion examples/karaf-docker-example/karaf-docker-example-static-dist/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@
<framework>static</framework>
<useReferenceUrls>true</useReferenceUrls>
<environment>static</environment>
<javase>17</javase>
<javase>${javaVersion}</javase>
</configuration>
</plugin>
</plugins>
Expand Down
4 changes: 2 additions & 2 deletions examples/karaf-graphql-example/karaf-graphql-example-websocket/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,8 +70,8 @@
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>11</source>
<target>11</target>
<source>21</source>
<target>21</target>
</configuration>
</plugin>
<plugin>
Expand Down
52 changes: 22 additions & 30 deletions instance/src/main/java/org/apache/karaf/instance/core/internal/InstanceServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -509,37 +509,29 @@ private static void doStart(InstanceState instance, String name, String javaOpts
classpath.append(childClasspath);
}

String jdkOpts;
if (!System.getProperty("java.version").startsWith("1.")) {
StringBuilder jdk9Classpath = classpathFromLibDir(new File(new File(System.getProperty("karaf.home"), "lib"), "jdk9plus"));
if (jdk9Classpath.length() > 0) {
classpath.append(System.getProperty("path.separator"));
classpath.append(jdk9Classpath);
}
jdkOpts = " --add-opens java.base/java.security=ALL-UNNAMED" +
" --add-opens java.base/java.net=ALL-UNNAMED" +
" --add-opens java.base/java.lang=ALL-UNNAMED" +
" --add-opens java.base/java.util=ALL-UNNAMED" +
" --add-opens java.naming/javax.naming.spi=ALL-UNNAMED" +
" --add-opens java.rmi/sun.rmi.transport.tcp=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.file=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.ftp=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.http=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.https=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.jar=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.content.text=ALL-UNNAMED" +
" --add-exports=jdk.xml.dom/org.w3c.dom.html=ALL-UNNAMED" +
" --add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED" +
" --add-exports=jdk.naming.rmi/com.sun.jndi.url.rmi=ALL-UNNAMED" +
" --add-exports=java.security.sasl/com.sun.security.sasl=ALL-UNNAMED" +
" --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED";
if (!System.getProperty("java.version").startsWith("11")) {
jdkOpts += " -Djava.security.manager=allow";
}
} else {
jdkOpts = " -Djava.endorsed.dirs=\"" + new File(new File(new File(System.getProperty("java.home"), "jre"), "lib"), "endorsed") + System.getProperty("path.separator") + new File(new File(System.getProperty("java.home"), "lib"), "endorsed") + "\""
+ " -Djava.ext.dirs=\"" + new File(new File(new File(System.getProperty("java.home"), "jre"), "lib"), "ext") + System.getProperty("path.separator") + new File(new File(System.getProperty("java.home"), "lib"), "ext") + System.getProperty("path.separator") + new File(libDir, "ext").getCanonicalPath() + "\"";
StringBuilder jdk9Classpath = classpathFromLibDir(new File(new File(System.getProperty("karaf.home"), "lib"), "jdk9plus"));
if (!jdk9Classpath.isEmpty()) {
classpath.append(File.pathSeparator);
classpath.append(jdk9Classpath);
}
String jdkOpts = " --add-opens java.base/java.security=ALL-UNNAMED" +
" --add-opens java.base/java.net=ALL-UNNAMED" +
" --add-opens java.base/java.lang=ALL-UNNAMED" +
" --add-opens java.base/java.util=ALL-UNNAMED" +
" --add-opens java.naming/javax.naming.spi=ALL-UNNAMED" +
" --add-opens java.rmi/sun.rmi.transport.tcp=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.file=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.ftp=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.http=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.https=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.protocol.jar=ALL-UNNAMED" +
" --add-exports=java.base/sun.net.www.content.text=ALL-UNNAMED" +
" --add-exports=jdk.xml.dom/org.w3c.dom.html=ALL-UNNAMED" +
" --add-exports=java.rmi/sun.rmi.registry=ALL-UNNAMED" +
" --add-exports=jdk.naming.rmi/com.sun.jndi.url.rmi=ALL-UNNAMED" +
" --add-exports=java.security.sasl/com.sun.security.sasl=ALL-UNNAMED" +
" --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED";

String command = "\""
+ new File(System.getProperty("java.home"), ScriptUtils.isWindows() ? "bin\\java.exe" : "bin/java").getCanonicalPath()
+ "\" " + opts
Expand Down
3 changes: 1 addition & 2 deletions itests/common/src/main/java/org/apache/karaf/itests/KarafTestSupport.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.Principal;
import java.security.PrivilegedExceptionAction;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
Expand Down Expand Up @@ -421,7 +420,7 @@ private String executeCommand(final String command, final Long timeout, final Lo
commandFuture = new FutureTask<>(() -> {
Subject subject = new Subject();
subject.getPrincipals().addAll(Arrays.asList(principals));
return Subject.doAs(subject, (PrivilegedExceptionAction<String>) commandCallable::call);
return Subject.callAs(subject, (Callable<String>) commandCallable::call);
});
}

Expand Down
6 changes: 2 additions & 4 deletions itests/test/src/test/java/org/apache/karaf/itests/JavaSecurityTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,6 @@
import java.nio.file.StandardCopyOption;
import java.util.*;

import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.fail;
import static org.ops4j.pax.exam.CoreOptions.maven;
import static org.ops4j.pax.exam.karaf.options.KarafDistributionOption.*;
Expand Down Expand Up @@ -63,7 +62,8 @@ public Option[] config() {
// Add some extra options used by this test...
options.addAll(Arrays.asList(
editConfigurationFilePut("etc/system.properties", "java.security.policy", "${karaf.etc}/all.policy"),
editConfigurationFilePut("etc/system.properties", "org.osgi.framework.security", "osgi"),
// This is no longer allowed as felix framework 7.0.5 calls System.getSecurityManager() in case it is there, see Felix.java
// editConfigurationFilePut("etc/system.properties", "org.osgi.framework.security", "osgi"),
editConfigurationFilePut("etc/system.properties", "org.osgi.framework.trust.repositories", "${karaf.etc}/trustStore.ks"),
editConfigurationFilePut("etc/startup.properties", "mvn:org.apache.felix/org.apache.felix.framework.security/" + version, "1"),
replaceConfigurationFile("system/org/apache/felix/org.apache.felix.framework.security/" + version + "/org.apache.felix.framework.security-" + version + ".jar", temp.toFile())));
Expand All @@ -72,8 +72,6 @@ public Option[] config() {

@Test
public void testJavaSecurity() throws Exception {
assertNotNull("Karaf should run under a security manager", System.getSecurityManager());

BundleService service = getOsgiService(BundleService.class);
long tried = 0;
while (true) {
Expand Down
Loading
Loading