8343982: Remove usage of security manager from ClassLoader and related classes

Reviewed-by: jpai, yzheng, lancea

Author: Alan Bateman

src/java.base/share/classes/java/lang/ClassLoader.java

@@ -64,7 +64,6 @@
 import jdk.internal.reflect.CallerSensitiveAdapter;
 import jdk.internal.reflect.Reflection;
 import jdk.internal.util.StaticProperty;
-import sun.security.util.SecurityConstants;
 
 /**
  * A class loader is an object that is responsible for loading classes. The
@@ -357,12 +356,6 @@ private static Void checkCreateClassLoader(String name) {
         if (name != null && name.isEmpty()) {
             throw new IllegalArgumentException("name must be non-empty or null");
         }
-
-        @SuppressWarnings("removal")
-        SecurityManager security = System.getSecurityManager();
-        if (security != null) {
-            security.checkCreateClassLoader();
-        }
         return null;
     }
 
@@ -1735,18 +1728,7 @@ public static InputStream getSystemResourceAsStream(String name) {
      *
      * @since  1.2
      */
-    @CallerSensitive
     public final ClassLoader getParent() {
-        if (parent == null)
-            return null;
-        @SuppressWarnings("removal")
-        SecurityManager sm = System.getSecurityManager();
-        if (sm != null) {
-            // Check access to the parent class loader
-            // If the caller's class loader is same as this class loader,
-            // permission check is performed.
-            checkClassLoaderPermission(parent, Reflection.getCallerClass());
-        }
         return parent;
     }
 
@@ -1774,15 +1756,8 @@ public final Module getUnnamedModule() {
      *
      * @since 9
      */
-    @CallerSensitive
     public static ClassLoader getPlatformClassLoader() {
-        @SuppressWarnings("removal")
-        SecurityManager sm = System.getSecurityManager();
-        ClassLoader loader = getBuiltinPlatformClassLoader();
-        if (sm != null) {
-            checkClassLoaderPermission(loader, Reflection.getCallerClass());
-        }
-        return loader;
+        return getBuiltinPlatformClassLoader();
     }
 
     /**
@@ -1853,7 +1828,6 @@ public static ClassLoader getPlatformClassLoader() {
      *          underlying cause of the error can be retrieved via the
      *          {@link Throwable#getCause()} method.
      */
-    @CallerSensitive
     public static ClassLoader getSystemClassLoader() {
         switch (VM.initLevel()) {
             case 0:
@@ -1867,11 +1841,6 @@ public static ClassLoader getSystemClassLoader() {
             default:
                 // system fully initialized
                 assert VM.isBooted() && scl != null;
-                @SuppressWarnings("removal")
-                SecurityManager sm = System.getSecurityManager();
-                if (sm != null) {
-                    checkClassLoaderPermission(scl, Reflection.getCallerClass());
-                }
                 return scl;
         }
     }
@@ -1902,8 +1871,6 @@ static synchronized ClassLoader initSystemClassLoader() {
         }
 
         ClassLoader builtinLoader = getBuiltinAppClassLoader();
-
-        // All are privileged frames.  No need to call doPrivileged.
         String cn = System.getProperty("java.system.class.loader");
         if (cn != null) {
             try {
@@ -1930,36 +1897,6 @@ static synchronized ClassLoader initSystemClassLoader() {
         return scl;
     }
 
-    // Returns true if the specified class loader can be found in this class
-    // loader's delegation chain.
-    boolean isAncestor(ClassLoader cl) {
-        ClassLoader acl = this;
-        do {
-            acl = acl.parent;
-            if (cl == acl) {
-                return true;
-            }
-        } while (acl != null);
-        return false;
-    }
-
-    // Tests if class loader access requires "getClassLoader" permission
-    // check.  A class loader 'from' can access class loader 'to' if
-    // class loader 'from' is same as class loader 'to' or an ancestor
-    // of 'to'.  The class loader in a system domain can access
-    // any class loader.
-    private static boolean needsClassLoaderPermissionCheck(ClassLoader from,
-                                                           ClassLoader to)
-    {
-        if (from == to)
-            return false;
-
-        if (from == null)
-            return false;
-
-        return !to.isAncestor(from);
-    }
-
     // Returns the class's class loader, or null if none.
     static ClassLoader getClassLoader(Class<?> caller) {
         // This can be null if the VM is requesting it
@@ -1970,23 +1907,6 @@ static ClassLoader getClassLoader(Class<?> caller) {
         return caller.getClassLoader0();
     }
 
-    /*
-     * Checks RuntimePermission("getClassLoader") permission
-     * if caller's class loader is not null and caller's class loader
-     * is not the same as or an ancestor of the given cl argument.
-     */
-    static void checkClassLoaderPermission(ClassLoader cl, Class<?> caller) {
-        @SuppressWarnings("removal")
-        SecurityManager sm = System.getSecurityManager();
-        if (sm != null) {
-            // caller can be null if the VM is requesting it
-            ClassLoader ccl = getClassLoader(caller);
-            if (needsClassLoaderPermissionCheck(ccl, cl)) {
-                sm.checkPermission(SecurityConstants.GET_CLASSLOADER_PERMISSION);
-            }
-        }
-    }
-
     // The system class loader
     // @GuardedBy("ClassLoader.class")
     private static volatile ClassLoader scl;

src/java.base/share/classes/jdk/internal/loader/BootLoader.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,8 +32,6 @@
 import java.net.URL;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.security.AccessController;
-import java.security.PrivilegedAction;
 import java.util.Arrays;
 import java.util.Enumeration;
 import java.util.concurrent.ConcurrentHashMap;
@@ -143,18 +141,8 @@ public static Class<?> loadClass(Module module, String name) {
     /**
      * Loads a native library from the system library path.
      */
-    @SuppressWarnings("removal")
     public static void loadLibrary(String name) {
-        if (System.getSecurityManager() == null) {
-            BootLoader.getNativeLibraries().loadLibrary(name);
-        } else {
-            AccessController.doPrivileged(new java.security.PrivilegedAction<>() {
-                public Void run() {
-                    BootLoader.getNativeLibraries().loadLibrary(name);
-                    return null;
-                }
-            });
-        }
+        getNativeLibraries().loadLibrary(name);
     }
 
     /**
@@ -294,38 +282,28 @@ private static Module findModule(String location) {
         /**
          * Returns URL if the given location is a regular file path.
          */
-        @SuppressWarnings("removal")
         private static URL toFileURL(String location) {
-            return AccessController.doPrivileged(new PrivilegedAction<>() {
-                public URL run() {
-                    Path path = Path.of(location);
-                    if (Files.isRegularFile(path)) {
-                        try {
-                            return path.toUri().toURL();
-                        } catch (MalformedURLException e) {}
-                    }
-                    return null;
-                }
-            });
+            Path path = Path.of(location);
+            if (Files.isRegularFile(path)) {
+                try {
+                    return path.toUri().toURL();
+                } catch (MalformedURLException e) {}
+            }
+            return null;
         }
 
         /**
          * Returns the Manifest if the given location is a JAR file
          * containing a manifest.
          */
-        @SuppressWarnings("removal")
         private static Manifest getManifest(String location) {
-            return AccessController.doPrivileged(new PrivilegedAction<>() {
-                public Manifest run() {
-                    Path jar = Path.of(location);
-                    try (InputStream in = Files.newInputStream(jar);
-                         JarInputStream jis = new JarInputStream(in, false)) {
-                        return jis.getManifest();
-                    } catch (IOException e) {
-                        return null;
-                    }
-                }
-            });
+            Path jar = Path.of(location);
+            try (InputStream in = Files.newInputStream(jar);
+                 JarInputStream jis = new JarInputStream(in, false)) {
+                return jis.getManifest();
+            } catch (IOException e) {
+                return null;
+            }
         }
     }