[META] Replace Java Security Manager (JSM)

[reta]

Please describe the end goal of this project

The SecurityManager is going to be disabled permanently in JDK-24 (see please https://openjdk.org/projects/jdk/24/). The purpose of this issue is to explore the possible replacements or/and suggest path forward. So far we have identified the following options:

• maintain OpenJDK fork (as mentioned by @pfirmstone)
• native Java Agent (dynamic code rewriting, must be low overhead)
• Class loader protection
• SystemCallFilter (as mentioned by @rmuir)
• eBPF (should be on Windows any day now), probably the same category as SystemCallFilter
• lightweight in-process VMs (https://github.com/hyperlight-dev/hyperlight)
• GraalVM isolates / sandboxing (https://www.graalvm.org/latest/security-guide/sandboxing/) - no Java (Espresso) support for now, see please [RFC] Replace Java Security Manager (JSM) #1687 (comment) and https://graalvm.slack.com/archives/CPSD12R71/p1731769241953729)
  • [GR-49729] [Espresso] Support running without native access. oracle/graal#10239
  • explore the possibility to run core on JDK-24+ but plugins on JDK-21
• JFR events

So far I am excluding the "radical" solutions:

• WebAssembly / WASM
• Project Leyden (in development)
• JPMS ([RFC] Jigsaw integration #1588)

Supporting References

RFC: #1687

Issues

• [POC] [Security Manager Replacement] Native Java Agent (dynamic code rewriting, must be low overhead) #16633
• [Security Manager Replacement] Strengthen OS core security via systemd configuration  #16729
• [POC] [Security Manager Replacement] GraalVM sandboxing #16861

Related component

Other

[dblock]

[Catch All Triage - 1, 2, 3]