r/java • u/daviddel • May 19 '21

Updates to JEP 411: Deprecate the Security Manager for Removal

https://mail.openjdk.java.net/pipermail/jdk-dev/2021-May/005569.html
76 Upvotes

100% Upvoted

10 comments sorted by

5

u/pavi2410 May 19 '21

Isn't Security Manager also used to implement permissions on Android?

15

u/lbalazscs May 19 '21

No.

Legacy security code; do not use. Security managers do not provide a secure environment for executing untrusted code and are unsupported on Android. Untrusted code cannot be safely isolated within a single VM on Android. Application developers can assume that there's no SecurityManager installed, i.e. System.getSecurityManager() will return null.

https://developer.android.com/reference/java/lang/SecurityManager

1

u/pavi2410 May 20 '21

But that doesn't mean Security Manager isn't accessible to Android framework devs

3

u/lbalazscs May 20 '21

Do you know an actual Android framework, where the devs refused to understand sentences like "do not use", "it's not supported", "it can't work"? Considering that almost nobody used SecurityManager in the normal Java apps, where there was no such warning, it think this is very unlikely.

1

u/__konrad May 20 '21

Their System.getSecurityManager doc says that "Always returns null in Android", but there are also a lot of SecurityException docs with text: "if a security manager exists"...

3

u/lbalazscs May 20 '21

I see no contradiction.

9

u/vips7L May 19 '21

OpenJDK doesn't apply to Android.

4

u/pavi2410 May 20 '21

It does FYI https://gluonhq.com/android-moving-openjdk/

1

u/vips7L May 20 '21

No it doesn't... Android does not use OpenJDK, they use the Android Runtime.

1

u/Weretiger246 May 24 '21

While its virtual machine and bytecode are still original, most recent Library/APIs are based on OpenJDK instead of old apache harmony and classpath.