Constants check for JRE bitness causes SecurityException under WebStart [LUCENE-7135] - Githubissues

apache / lucene

Apache Lucene open-source search software

https://lucene.apache.org/

Apache License 2.0

2.65k stars 1.03k forks source link

Constants check for JRE bitness causes SecurityException under WebStart [LUCENE-7135] #8190

Closed asfimport closed 7 years ago

asfimport commented 8 years ago

I have an app that I deploy via WebStart that uses Lucene 5.2.1 (we are locked to 5.2.1 because that's what LanguageTool uses).

When running under the WebStart security manager, there are two locations where exceptions are thrown and prevent pretty much all Lucene classes from initializing. This is true even when we sign everything and specify <security><all-permissions/></security>.

In RamUsageEstimator, fixed by #7981

In Constants, caused by the call System.getProperty("sun.arch.data.model") (stack trace below).

Error: Caused by: java.security.AccessControlException: access denied ("java.util.PropertyPermission" "sun.arch.data.model" "read") 
Error:   at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) 
Error:   at java.security.AccessController.checkPermission(AccessController.java:884) 
Error:   at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) 
Error:   at com.sun.javaws.security.JavaWebStartSecurity.checkPermission(Unknown Source) 
Error:   at java.lang.SecurityManager.checkPropertyAccess(SecurityManager.java:1294) 
Error:   at java.lang.System.getProperty(System.java:717) 
Error:   at org.apache.lucene.util.Constants.<clinit>(Constants.java:71) 
Error:   ... 34 more

The latter is still present in the latest version. My patch illustrates one solution that appears to be working for us.

(This patch, together with a backport of the fix to #7981, seems to fix the issue for our purposes. However if you really wanted to make my day you could put out a maintenance release of 5.2 with both fixes included.)

Migrated from LUCENE-7135 by Aaron Madlon-Kay, 1 vote, resolved Nov 04 2016 Environment:

OS X 10.11.4, Java 1.8.0_77-b03 (under WebStart)

Attachments: LUCENE-7135.diff

asfimport commented 8 years ago

Trejkaz (migrated from JIRA)

I see this when running our unit tests also. Evidently somewhere up the call chain there is some code we don't trust calling us. We then call Lucene, which ultimately calls this stuff.

(We're bitten by #7981 as well, because we are still on 5.4.)

asfimport commented 8 years ago

Aaron Madlon-Kay (migrated from JIRA)

Since there has been no action on this issue, we were forced to publish our patched version:

https://bintray.com/omegat-org/maven/lucene-core
Available in JCenter as compile 'org.omegat.lucene:lucene-core:5.2.1'

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

Is OS_ARCH.contains("64")) really a safe way to determine if we are running in a 64 bit JVM? Maybe we should only do this on fallback, if the security manager doesn't let us do System.getProperty("sun.arch.data.model")?

asfimport commented 7 years ago

Aaron Madlon-Kay (migrated from JIRA)

> Maybe we should only do this on fallback

That's precisely what my patch does.

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

> That's precisely what my patch does.

Woops, sorry, I did not look closely enough: you're right!

OK I think this is a good approach ... I'll push soon. Thanks Aaron Madlon-Kay!

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

> That's precisely what my patch does.

Woops, sorry, I did not look closely enough: you're right!

OK I think this is a good approach ... I'll push soon. Thanks Aaron Madlon-Kay!

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit 813b6855656ecd50a7a28376822bd7b65154cee8 in lucene-solr's branch refs/heads/master from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=813b685

LUCENE-7135: work around security manager when checking for 32/64 bit JVM

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit 96372be35c7c7d937561ce5d526d688ab447cd86 in lucene-solr's branch refs/heads/branch_6x from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=96372be

LUCENE-7135: work around security manager when checking for 32/64 bit JVM

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

Thanks Aaron Madlon-Kay!

asfimport commented 7 years ago

Aaron Madlon-Kay (migrated from JIRA)

Thanks very much for your help, @mikemccand.

Is there any hope for a backport to 5? I suspect it will take a long time for our dependencies to move up.

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

I think it's unlikely we'll do anothe 5.x release Aaron Madlon-Kay ... but I'll mark this as 5.5.4 just in case we do.

asfimport commented 7 years ago

Aaron Madlon-Kay (migrated from JIRA)

Understood. Thanks!

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

Reopen for possible eventual 5.5.4 backport.

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit 2baad4c22d05a1fcc4a09044eae868b6a5bfe1cf in lucene-solr's branch refs/heads/master from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=2baad4c

LUCENE-7135: add issue number in CHANGES.txt

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit f9e2f0c5b65b389e330a16657396a922e47fce1d in lucene-solr's branch refs/heads/branch_6x from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=f9e2f0c

LUCENE-7135: add issue number in CHANGES.txt

asfimport commented 7 years ago

Shalin Shekhar Mangar (@shalinmangar) (migrated from JIRA)

This issue is marked for 6.3 but it was not backported to branch_6_3. So the fix version should be 6.4

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

Woops, thanks @shalinmangar, I fixed it.

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit 08526f581edef098cd94e899beef2a0fff95535c in lucene-solr's branch refs/heads/branch_6_3 from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=08526f5

LUCENE-7135: work around security manager when checking for 32/64 bit JVM

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit 3366219c6edbb8c7791e8e8bab08ede5b485e2d1 in lucene-solr's branch refs/heads/branch_6_3 from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=3366219

LUCENE-7135: add issue number in CHANGES.txt

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

OK I backported this for 6.3.0

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

There is a bug in the logic here: it marks a 64 bit JVM as 32 bit!

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit 92f56ea9dd72d935c21aadae6a20ee23fa9c3cf8 in lucene-solr's branch refs/heads/master from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=92f56ea

LUCENE-7135: only use OS_ARCH if we couldn't access sun.arch.data.model

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit 97c97838022efcac8ccbcffb5edf5735605fdf17 in lucene-solr's branch refs/heads/branch_6x from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=97c9783

LUCENE-7135: only use OS_ARCH if we couldn't access sun.arch.data.model

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit a66a44513ee8191e25b477372094bfa846450316 in lucene-solr's branch refs/heads/branch_6_3 from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=a66a445

LUCENE-7135: only use OS_ARCH if we couldn't access sun.arch.data.model

asfimport commented 7 years ago

Aaron Madlon-Kay (migrated from JIRA)

Very sorry about that!

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

No worries Aaron Madlon-Kay, stuff happens :) I'm just glad we caught it before 6.3.0 was out.

asfimport commented 7 years ago

Michael McCandless (@mikemccand) (migrated from JIRA)

One nice side effect of this 2 day accident was it caused e.g. our nightly geo benchmark https://people.apache.org/\~mikemccand/geobench.html to use NIOFSDirectory instead of MMapDirectory, so we get to see at least for this benchmark how much better MMapDirectory is!

I'm working on nightly benchmarks for the sparse case, preview here: https://people.apache.org/\~mikemccand/lucenebench/sparseResults.html#search_sort_qps

There's an even bigger drop in that benchmark, which is what made me think there might be an issue with this change in the first place. Benchmarking is important :)

asfimport commented 7 years ago

ASF subversion and git services (migrated from JIRA)

Commit 92f56ea9dd72d935c21aadae6a20ee23fa9c3cf8 in lucene-solr's branch refs/heads/apiv2 from Mike McCandless https://git-wip-us.apache.org/repos/asf?p=lucene-solr.git;h=92f56ea

LUCENE-7135: only use OS_ARCH if we couldn't access sun.arch.data.model

asfimport commented 7 years ago

Shalin Shekhar Mangar (@shalinmangar) (migrated from JIRA)

Closing after 6.3.0 release.