(0.43) Enable -XX:[+|-]CRIUSecProvider JVM option #18593
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Whenever we are performing a checkpoint this is typically done by enabling -XX:+EnableCRIUSupport. It will remove all the security providers and the CRIUSecProvider is inserted to the runtime enviroment. This provides a more locked down approach to what cryptography is allowed while taking a checkpoint. Therefore, this new flag is introduced by passing it after -XX:+EnableCRIUSupport is enabled. When this option is used, we no longer make use of CRIUSecProvider and instead use normal provider loading to enable all security algorithms in an out of the box state. This can allow users to make use of any algorithms in the various providers available.
|
Build is passed based upon Semeru JDK21; There is one failure in Sanity.functional test but does not related to CRIU -> https://hyc-runtimes-jenkins.swg-devops.com/view/OpenJ9%20-%20Personal/job/Pipeline-Build-Test-Personal/19827/ |
|
@jasonkatonica FYI |
|
Hi @pshipton , please help to review |
pshipton
changed the title
pshipton
approved these changes
Dec 11, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Whenever we are performing a checkpoint
this is typically done by enabling
-XX:+EnableCRIUSupport. It will remove
all the security providers and the
CRIUSecProvider is inserted to the
runtime enviroment. This provides a more
locked down approach to what cryptography
is allowed while taking a checkpoint.
Therefore, this new flag is introduced by
passing it after -XX:+EnableCRIUSupport is
enabled. When this option is used, we no
longer make use of CRIUSecProvider and
instead use normal provider loading to
enable all security algorithms in an out
of the box state. This can allow users to
make use of any algorithms in the various
providers available.
Back-ported from #18354