Finding Alternatives to Security Manager
summary
OpenJDK disables Security Manager in JDK 24 so OpenSearch replaces its sandbox with two practical controls: systemd hardening to enforce OS-level file, socket and capability limits (exposure metric drops from 8.8 to 4.6), and a Java agent instrumentation using Byte Buddy that intercepts socket/file calls, stack-walks protection domains and enforces policy-compatible permissions. Per-plugin JVMs and a GraalVM POC are evaluated but deferred; goals are near-zero runtime overhead and no breaking plugin APIs, and Log4j resilience is preserved.
AI-written summary · about
chapters (9)
- 0:00Security Manager alternatives
- 1:51Security Manager purpose and history
- 6:42Why JDK deprecated Security Manager
- 10:54Security threats to address
- 13:20OpenSearch alternatives
- 17:34Systemd hardening
- 20:03Systemd config examples
- 22:35Java agent instrumentation
- 25:43Summary
related talks
40mJava Security Evolution - Out with the Old, In with the New
35mSecuring software while maintaining usability
42mHidden security features of the JVM - everything you didn’t know and more
44mJava Code Security
43mSecurity Architecture of the Java Platform
40mMaximizing Security with JDK: Understanding Built-in Capabilities
48mHidden Security Features of the JVM - Everything You Didn’t Know and More
45mFrom Java 17 to 21: A Showcase of JDK Security Enhancements