那些遇到过的问题

当在 checkPermission 方法中加载某个类时，为什么 SecurityManager 会发出递归更新异常？

kos*_*spi 4 java securitymanager java-security-manager java-11

我正在将 jdk 8 升级到 11。

我在checkPermission方法中加载了一些类，然后安全管理器发出recursive update异常。但使用jdk1.8.0_202一切正常。

是什么导致了这个问题？

  1. 我的环境。
OS: macOS 10.15.6
JDK(Oracle): 11.0.8
IDE: Intellij 2019 3
Run Code Online (Sandbox Code Playgroud)
  1. 主要的
public class Main {
    public static void main(String[] args) {
        System.out.println("Hello world");
    }
}
Run Code Online (Sandbox Code Playgroud)
  1. 安全管理器
package sm;

import java.security.Permission;

public class MySecurityManager extends SecurityManager {

    @Override
    public void checkPermission(Permission permission) {

        // Problem occurs when load ServicePermission.class
        if (permission instanceof javax.security.auth.kerberos.ServicePermission) {
            // throw new SecurityException("javax.security.auth.kerberos.ServicePermission is not allowed.");
        }
    }

    @Override
    public void checkPermission(Permission permission, Object context) {
        this.checkPermission(permission);
    }
}
Run Code Online (Sandbox Code Playgroud)

  1. 运行 -Djava.security.manager=sm.MySecurityManager

  2. 控制台日志

Error occurred during initialization of VM
java.lang.BootstrapMethodError: bootstrap method initialization exception
    at java.lang.invoke.BootstrapMethodInvoker.invoke(java.base@11.0.8/BootstrapMethodInvoker.java:194)
    at java.lang.invoke.CallSite.makeSite(java.base@11.0.8/CallSite.java:307)
    at java.lang.invoke.MethodHandleNatives.linkCallSiteImpl(java.base@11.0.8/MethodHandleNatives.java:258)
    at java.lang.invoke.MethodHandleNatives.linkCallSite(java.base@11.0.8/MethodHandleNatives.java:248)
    at sun.net.www.protocol.jrt.JavaRuntimeURLConnection.<clinit>(java.base@11.0.8/JavaRuntimeURLConnection.java:55)
    at sun.net.www.protocol.jrt.Handler.openConnection(java.base@11.0.8/Handler.java:42)
    at java.net.URL.openConnection(java.base@11.0.8/URL.java:1074)
    at jdk.internal.module.SystemModuleFinders$SystemModuleReader.checkPermissionToConnect(java.base@11.0.8/SystemModuleFinders.java:405)
    at jdk.internal.module.SystemModuleFinders$SystemModuleReader.<init>(java.base@11.0.8/SystemModuleFinders.java:414)
    at jdk.internal.module.SystemModuleFinders$2.get(java.base@11.0.8/SystemModuleFinders.java:315)
    at jdk.internal.module.SystemModuleFinders$2.get(java.base@11.0.8/SystemModuleFinders.java:312)
    at jdk.internal.module.ModuleReferenceImpl.open(java.base@11.0.8/ModuleReferenceImpl.java:93)
    at jdk.internal.loader.BuiltinClassLoader$5.apply(java.base@11.0.8/BuiltinClassLoader.java:961)
    at jdk.internal.loader.BuiltinClassLoader$5.apply(java.base@11.0.8/BuiltinClassLoader.java:958)
    at java.util.concurrent.ConcurrentHashMap.computeIfAbsent(java.base@11.0.8/ConcurrentHashMap.java:1705)
    at jdk.internal.loader.BuiltinClassLoader.moduleReaderFor(java.base@11.0.8/BuiltinClassLoader.java:969)
    at jdk.internal.loader.BuiltinClassLoader.defineClass(java.base@11.0.8/BuiltinClassLoader.java:731)
    at jdk.internal.loader.BuiltinClassLoader.lambda$findClassInModuleOrNull$2(java.base@11.0.8/BuiltinClassLoader.java:682)
    at java.security.AccessController.doPrivileged(java.base@11.0.8/Native Method)
    at jdk.internal.loader.BuiltinClassLoader.findClassInModuleOrNull(java.base@11.0.8/BuiltinClassLoader.java:683)
    at jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(java.base@11.0.8/BuiltinClassLoader.java:605)
    at jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(java.base@11.0.8/BuiltinClassLoader.java:640)
    at jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(java.base@11.0.8/BuiltinClassLoader.java:609)
    at jdk.internal.loader.BuiltinClassLoader.loadClass(java.base@11.0.8/BuiltinClassLoader.java:579)
    at jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(java.base@11.0.8/ClassLoaders.java:178)
    at java.lang.ClassLoader.loadClass(java.base@11.0.8/ClassLoader.java:521)
    at sm.MySecurityManager.checkPermission(MySecurityManager.java:11)
    at java.lang.SecurityManager.checkPropertyAccess(java.base@11.0.8/SecurityManager.java:1066)
    at java.lang.System.getProperty(java.base@11.0.8/System.java:814)
    at java.lang.ClassLoader.initSystemClassLoader(java.base@11.0.8/ClassLoader.java:1971)
    at java.lang.System.initPhase3(java.base@11.0.8/System.java:2070)
Caused by: java.lang.IllegalStateException: Recursive update
    at java.util.concurrent.ConcurrentHashMap.computeIfAbsent(java.base@11.0.8/ConcurrentHashMap.java:1760)
    at jdk.internal.loader.BuiltinClassLoader.moduleReaderFor(java.base@11.0.8/BuiltinClassLoader.java:969)
    at jdk.internal.loader.BuiltinClassLoader.defineClass(java.base@11.0.8/BuiltinClassLoader.java:731)
    at jdk.internal.loader.BuiltinClassLoader.lambda$findClassInModuleOrNull$2(java.base@11.0.8/BuiltinClassLoader.java:682)
    at java.security.AccessController.doPrivileged(java.base@11.0.8/Native Method)
    at jdk.internal.loader.BuiltinClassLoader.findClassInModuleOrNull(java.base@11.0.8/BuiltinClassLoader.java:683)
    at jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(java.base@11.0.8/BuiltinClassLoader.java:605)
    at jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(java.base@11.0.8/BuiltinClassLoader.java:640)
    at jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(java.base@11.0.8/BuiltinClassLoader.java:609)
    at jdk.internal.loader.BuiltinClassLoader.loadClass(java.base@11.0.8/BuiltinClassLoader.java:579)
    at jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(java.base@11.0.8/ClassLoaders.java:178)
    at java.lang.ClassLoader.loadClass(java.base@11.0.8/ClassLoader.java:521)
    at sm.MySecurityManager.checkPermission(MySecurityManager.java:11)
    at java.lang.reflect.AccessibleObject.checkPermission(java.base@11.0.8/AccessibleObject.java:83)
    at java.lang.reflect.Constructor.setAccessible(java.base@11.0.8/Constructor.java:180)
    at java.lang.invoke.InnerClassLambdaMetafactory$1.run(java.base@11.0.8/InnerClassLambdaMetafactory.java:206)
    at java.lang.invoke.InnerClassLambdaMetafactory$1.run(java.base@11.0.8/InnerClassLambdaMetafactory.java:199)
    at java.security.AccessController.doPrivileged(java.base@11.0.8/Native Method)
    at java.lang.invoke.InnerClassLambdaMetafactory.buildCallSite(java.base@11.0.8/InnerClassLambdaMetafactory.java:198)
    at java.lang.invoke.LambdaMetafactory.metafactory(java.base@11.0.8/LambdaMetafactory.java:329)
    at java.lang.invoke.BootstrapMethodInvoker.invoke(java.base@11.0.8/BootstrapMethodInvoker.java:127)
    at java.lang.invoke.CallSite.makeSite(java.base@11.0.8/CallSite.java:307)
    at java.lang.invoke.MethodHandleNatives.linkCallSiteImpl(java.base@11.0.8/MethodHandleNatives.java:258)
    at java.lang.invoke.MethodHandleNatives.linkCallSite(java.base@11.0.8/MethodHandleNatives.java:248)
    at sun.net.www.protocol.jrt.JavaRuntimeURLConnection.<clinit>(java.base@11.0.8/JavaRuntimeURLConnection.java:55)
    at sun.net.www.protocol.jrt.Handler.openConnection(java.base@11.0.8/Handler.java:42)
    at java.net.URL.openConnection(java.base@11.0.8/URL.java:1074)
    at jdk.internal.module.SystemModuleFinders$SystemModuleReader.checkPermissionToConnect(java.base@11.0.8/SystemModuleFinders.java:405)
    at jdk.internal.module.SystemModuleFinders$SystemModuleReader.<init>(java.base@11.0.8/SystemModuleFinders.java:414)
    at jdk.internal.module.SystemModuleFinders$2.get(java.base@11.0.8/SystemModuleFinders.java:315)
    at jdk.internal.module.SystemModuleFinders$2.get(java.base@11.0.8/SystemModuleFinders.java:312)
    at jdk.internal.module.ModuleReferenceImpl.open(java.base@11.0.8/ModuleReferenceImpl.java:93)
    at jdk.internal.loader.BuiltinClassLoader$5.apply(java.base@11.0.8/BuiltinClassLoader.java:961)
    at jdk.internal.loader.BuiltinClassLoader$5.apply(java.base@11.0.8/BuiltinClassLoader.java:958)
    at java.util.concurrent.ConcurrentHashMap.computeIfAbsent(java.base@11.0.8/ConcurrentHashMap.java:1705)
    at jdk.internal.loader.BuiltinClassLoader.moduleReaderFor(java.base@11.0.8/BuiltinClassLoader.java:969)
    at jdk.internal.loader.BuiltinClassLoader.defineClass(java.base@11.0.8/BuiltinClassLoader.java:731)
    at jdk.internal.loader.BuiltinClassLoader.lambda$findClassInModuleOrNull$2(java.base@11.0.8/BuiltinClassLoader.java:682)
    at java.security.AccessController.doPrivileged(java.base@11.0.8/Native Method)
    at jdk.internal.loader.BuiltinClassLoader.findClassInModuleOrNull(java.base@11.0.8/BuiltinClassLoader.java:683)
    at jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(java.base@11.0.8/BuiltinClassLoader.java:605)
    at jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(java.base@11.0.8/BuiltinClassLoader.java:640)
    at jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(java.base@11.0.8/BuiltinClassLoader.java:609)
    at jdk.internal.loader.BuiltinClassLoader.loadClass(java.base@11.0.8/BuiltinClassLoader.java:579)
    at jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(java.base@11.0.8/ClassLoaders.java:178)
    at java.lang.ClassLoader.loadClass(java.base@11.0.8/ClassLoader.java:521)
    at sm.MySecurityManager.checkPermission(MySecurityManager.java:11)
    at java.lang.SecurityManager.checkPropertyAccess(java.base@11.0.8/SecurityManager.java:1066)
    at java.lang.System.getProperty(java.base@11.0.8/System.java:814)
    at java.lang.ClassLoader.initSystemClassLoader(java.base@11.0.8/ClassLoader.java:1971)
    at java.lang.System.initPhase3(java.base@11.0.8/System.java:2070)


Process finished with exit code 1
Run Code Online (Sandbox Code Playgroud)

Hol*_*ger 5

堆栈跟踪表明问题与模块加载而不是类加载有关，这解释了为什么在没有模块的 JDK 8 中没有问题。

当您从底部开始读取堆栈跟踪时，即

    at java.lang.System.initPhase3(java.base@11.0.8/System.java:2070)
Run Code Online (Sandbox Code Playgroud)

你会遇到堆栈帧

    at java.util.concurrent.ConcurrentHashMap.computeIfAbsent(java.base@11.0.8/ConcurrentHashMap.java:1705)
    at jdk.internal.loader.BuiltinClassLoader.moduleReaderFor(java.base@11.0.8/BuiltinClassLoader.java:969)
Run Code Online (Sandbox Code Playgroud)

表示尝试加载模块。这最终会以需要检查的特权操作结束，因此您将找到该行

    at sm.MySecurityManager.checkPermission(MySecurityManager.java:11)
Run Code Online (Sandbox Code Playgroud)

这会触发加载在之前显然没有加载过javax.security.auth.kerberos.ServicePermission的模块java.security.jgss中。

所以loadClass呼叫再次结束于

    at java.util.concurrent.ConcurrentHashMap.computeIfAbsent(java.base@11.0.8/ConcurrentHashMap.java:1760)
    at jdk.internal.loader.BuiltinClassLoader.moduleReaderFor(java.base@11.0.8/BuiltinClassLoader.java:969)
Run Code Online (Sandbox Code Playgroud)

这会触发“java.lang.IllegalStateException: Recursive update”，因为computeIfAbsent不允许从computeIfAbsent同一ConcurrentHashMap. 由于忽略此约束会导致映射损坏，因此 Java 9 中添加了一项检查以拒绝此类尝试。请参阅此问答。

通常，从安全管理器触发类加载（在类加载期间可能会再次检查）可能会出现问题。我建议求助于记录的toString()输出进行比较。毕竟，这也是基于策略文件的安全实现所做的。

既然ServicePermission是final，一个更便宜的permission.getClass().getName().equals( "javax.security.auth.kerberos.ServicePermission")也可以。如果之前没有使用过，这两种方法都会避免加载权限。如问题所示，这甚至可以节省整个模块的加载。

归档时间：

查看次数：

146 次

最近记录：

5 年，10 月 前
由于Java 9 HashMap.computeIfAbsent()在尝试memoize递归函数结果时抛出ConcurrentModificationException 11
更多相关链接
相关归档
Java中的Collection和List有什么区别？ 145
在Java中抑制不推荐使用的导入警告 95
远程JMX连接 91
为什么它无法从JAR文件加载主类清单属性？ 85
Android LocationServices.FusedLocationApi已弃用 74
未指定标头映射,无法通过名称访问记录值(Apache Commons CSV) 51
如何在运行时请求位置权限 51
Eclipse:最有用的重构 44
Java SE 11 - Java 语言规范中类型转换的新案例 14
sun.* 与 com.sun.* 之间的差异 4
难疑归档
将本地存储库分支重置为远程存储库HEAD 3488
如何在Bash中连接字符串变量 2624
查找当前目录和文件的目录 2007
如何确定变量是"未定义"还是"空"？ 2000
HTML中id属性的有效值是什么？ 1945
没有指定分支的"git push"的默认行为 1339
window.onload vs $(document).ready() 1205
如何从另一个分支中获取一个文件 1154
我怎么知道分支是否已经合并为主分支？ 1077
如何在psql中切换数据库？ 1029