Disable Log4J JMX beans creation in tests to avoid overhead

[sdavids]

Overview

fix #3751

---

I hereby agree to the terms of the JUnit Contributor License Agreement.

---

Definition of Done

• There are no TODOs left in the code
• Method preconditions are checked and documented in the method's Javadoc
• Coding conventions (e.g. for logging) have been followed
• Change is covered by automated tests including corner cases, errors, and exception handling
• Public API has Javadoc and @API annotations
• Change is documented in the User Guide and Release Notes

[sormuras]

LGTM

[marcphilipp]

I guess this is a "best practice" from a security perspective, right? If so, we should also document it in the User Guide, shouldn't we?

junit5/documentation/src/docs/asciidoc/user-guide/running-tests.adoc

Lines 243 to 245 in e160aec

	test {
	systemProperty("java.util.logging.manager", "org.apache.logging.log4j.jul.LogManager")
	}

[sdavids]

I guess this is a "best practice" from a security perspective, right?

Security, memory footprint, and faster initialization:

https://github.com/apache/logging-log4j2/blob/7b5d23e1403db7a7865da4783dd5cb22b0ddfb93/log4j-core/src/main/java/org/apache/logging/log4j/core/jmx/Server.java#L143-L191

---

https://logging.apache.org/log4j/2.x/manual/jmx.html#enabling-jmx

JMX support is enabled by default

Personally, I would have preferred if the default was off, but I guess for backward compatibility it is on.

---

If so, we should also document it in the User Guide, shouldn't we?

I could modify the example you quoted to:

a)

test {
    systemProperty("java.util.logging.manager", "org.apache.logging.log4j.jul.LogManager")
    // https://logging.apache.org/log4j/2.x/manual/jmx.html#enabling-jmx
    systemProperty("log4j2.disableJmx", "true")
}

b)

test {
    systemProperty("java.util.logging.manager", "org.apache.logging.log4j.jul.LogManager")
    // disable log4j2 JMX beans for security reasons
    systemProperty("log4j2.disableJmx", "true")
}

---

Unfortunately, each framework has its own way of doing so—I am not sure if the "how-to" belongs in the JUnit documentation.

"Someplace" we could add a note that it is a good idea to disable JMX bean creation for:

• faster tests
• smaller attack surface while running tests
• lower memory footprint

As far as I am aware, there is also no official way to turn off JMX functionality on the JVM level.

[marcphilipp]

If so, we should also document it in the User Guide, shouldn't we?

I could modify the example you quoted to:

a)

test {
    systemProperty("java.util.logging.manager", "org.apache.logging.log4j.jul.LogManager")
    // https://logging.apache.org/log4j/2.x/manual/jmx.html#enabling-jmx
    systemProperty("log4j2.disableJmx", "true")
}

b)

test {
    systemProperty("java.util.logging.manager", "org.apache.logging.log4j.jul.LogManager")
    // disable log4j2 JMX beans for security reasons
    systemProperty("log4j2.disableJmx", "true")
}

Let's go with something generic like this:

test {
    systemProperty("java.util.logging.manager", "org.apache.logging.log4j.jul.LogManager")
    // Avoid overhead (see https://logging.apache.org/log4j/2.x/manual/jmx.html#enabling-jmx)
    systemProperty("log4j2.disableJmx", "true")
}

Unfortunately, each framework has its own way of doing so—I am not sure if the "how-to" belongs in the JUnit documentation.

"Someplace" we could add a note that it is a good idea to disable JMX bean creation for:

* faster tests

* smaller attack surface while running tests

* lower memory footprint

As far as I am aware, there is also no official way to turn off JMX functionality on the JVM level.

I think this is outside the scope of the JUnit docs so I'd omit that for now.

[marcphilipp]

see #3753 (comment)

[sdavids]

I have updated this PR.

I will create a PR in the log4j2 repo to disable JMX bean creation by default.

see:
apache/logging-log4j2#2462 (comment)

Depending on the outcome of the other PR we can close or merge this one.

Alternatively, we can merge this one now and I would create a new PR to revert this one, if necessary.

Up to you …

[marcphilipp]

Thanks! I decided to rather merge it now than keeping it open. Disabling it by default in Log4J would be a great outcome! 👍

[sdavids]

https://github.com/apache/logging-log4j2/releases/tag/rel%2F2.24.0

Starting in version 2.24.0, JMX support is disabled by default [...]

[sdavids]

Should I author a PR reverting this one?

Avoid overhead (see https://logging.apache.org/log4j/2.x/manual/jmx.html#enabling-jmx)

⇓

Log4J2 < 2.24.0: Avoid overhead (see https://logging.apache.org/log4j/2.x/manual/jmx.html#enabling-jmx)