AXIS2-6079, support OpenJDK 21 by removing the Java Security Manager, make OpenJDK 17 the minimum requirement as a result

Author: robertlazarski

modules/kernel/src/org/apache/axis2/java/security/AccessController.java

@@ -28,13 +28,15 @@
 
 /**
  * This utility wrapper class is created to support AXIS2 runs
- * inside of Java 2 Security environment. Due to the access control
- * checking algorithm, for Java 2 Security to function properly,
+ * inside of Java security environments. Due to the access control
+ * checking algorithm, for Java security to function properly,
  * <code>doPrivileged()</code>
  * is required in cases where there is application code on the stack frame
- * accessing the system resources (ie, read/write files, opening ports, and etc).
- * This class also improve performance no matther Security Manager is being enabled
- * or not.
+ * accessing system resources (ie, read/write files, opening ports, and etc).
+ * <p/>
+ * This class provides a consistent security model across Java versions by
+ * always using doPrivileged(), ensuring proper privilege elevation regardless
+ * of SecurityManager presence (which was deprecated in Java 17 and removed in Java 21).
  * <p/>
  * Note: This utility should be used properly, otherwise might introduce
  * security holes.
@@ -60,7 +62,8 @@ public class AccessController {
 
     /**
      * Performs the specified <code>PrivilegedAction</code> with privileges
-     * enabled if a security manager is present.
+     * enabled. This method always uses doPrivileged for security consistency
+     * across Java versions.
      * <p/>
      * If the action's <code>run</code> method throws an (unchecked) exception,
      * it will propagate through this method.
@@ -71,12 +74,7 @@ public class AccessController {
      * @see #doPrivileged(PrivilegedExceptionAction)
      */
     public static <T> T doPrivileged(PrivilegedAction<T> action) {
-        SecurityManager sm = System.getSecurityManager();
-        if (sm == null) {
-            return (action.run());
-        } else {
-            return java.security.AccessController.doPrivileged(action);
-        }
+        return java.security.AccessController.doPrivileged(action);
     }
 
 
@@ -85,9 +83,7 @@ public static <T> T doPrivileged(PrivilegedAction<T> action) {
      * enabled and restricted by the specified <code>AccessControlContext</code>.
      * The action is performed with the intersection of the permissions
      * possessed by the caller's protection domain, and those possessed
-     * by the domains represented by the specified
-     * <code>AccessControlContext</code> if a security manager is present.
-     * <p/>
+     * by the domains represented by the specified <code>AccessControlContext</code>.
      * <p/>
      * If the action's <code>run</code> method throws an (unchecked) exception,
      * it will propagate through this method.
@@ -101,51 +97,35 @@ public static <T> T doPrivileged(PrivilegedAction<T> action) {
      * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)
      */
     public static <T> T doPrivileged(PrivilegedAction<T> action, AccessControlContext context) {
-        SecurityManager sm = System.getSecurityManager();
-        if (sm == null) {
-            return action.run();
-        } else {
-            return java.security.AccessController.doPrivileged(action, context);
-        }
+        return java.security.AccessController.doPrivileged(action, context);
     }
 
     /**
      * Performs the specified <code>PrivilegedExceptionAction</code> with
-     * privileges enabled.  The action is performed with <i>all</i> of the
+     * privileges enabled. The action is performed with <i>all</i> of the
      * permissions possessed by the caller's protection domain.
      * <p/>
      * If the action's <code>run</code> method throws an <i>unchecked</i>
      * exception, it will propagate through this method.
      *
      * @param action the action to be performed.
      * @return the value returned by the action's <code>run</code> method.
-     * @throws PrivilgedActionException the specified action's
+     * @throws PrivilegedActionException the specified action's
      *                                  <code>run</code> method threw a <i>checked</i> exception.
      * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)
      * @see #doPrivileged(PrivilegedAction)
      */
     public static <T> T doPrivileged(PrivilegedExceptionAction<T> action)
             throws PrivilegedActionException {
-        SecurityManager sm = System.getSecurityManager();
-        if (sm == null) {
-            try {
-                return action.run();
-            } catch (java.lang.RuntimeException e) {
-                throw e;
-            } catch (Exception e) {
-                throw new PrivilegedActionException(e);
-            }
-        } else {
-            return java.security.AccessController.doPrivileged(action);
-        }
+        return java.security.AccessController.doPrivileged(action);
     }
 
 
     /**
      * Performs the specified <code>PrivilegedExceptionAction</code> with
      * privileges enabled and restricted by the specified
-     * <code>AccessControlContext</code>.  The action is performed with the
-     * intersection of the the permissions possessed by the caller's
+     * <code>AccessControlContext</code>. The action is performed with the
+     * intersection of the permissions possessed by the caller's
      * protection domain, and those possessed by the domains represented by the
      * specified <code>AccessControlContext</code>.
      * <p/>
@@ -166,19 +146,7 @@ public static <T> T doPrivileged(PrivilegedExceptionAction<T> action)
     public static <T> T doPrivileged(PrivilegedExceptionAction<T> action,
                                       AccessControlContext context)
             throws PrivilegedActionException {
-
-        SecurityManager sm = System.getSecurityManager();
-        if (sm == null) {
-            try {
-                return action.run();
-            } catch (java.lang.RuntimeException e) {
-                throw e;
-            } catch (Exception e) {
-                throw new PrivilegedActionException(e);
-            }
-        } else {
-            return java.security.AccessController.doPrivileged(action, context);
-        }
+        return java.security.AccessController.doPrivileged(action, context);
     }
 
     /**