From Fedora Project Wiki
Line 106: Line 106:
"With this change a Fedora system will have a consistent way of setting a default security profile for all Java-depending applications. Overall this brings the Java applications in par with the OpenSSL and GnuTLS with respect to system-wide policy adherence."
"With this change a Fedora system will have a consistent way of setting a default security profile for all Java-depending applications. Overall this brings the Java applications in par with the OpenSSL and GnuTLS with respect to system-wide policy adherence."


[[Category:ChangeReadyForFesco]]
[[Category:ChangeAcceptedF25]]
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->

Revision as of 12:00, 30 May 2016

Java/OpenJDK enforces the system-wide crypto policy

Summary

As it is now, the System-wide crypto policy in F24 is only enforced by the OpenSSL and GnuTLS TLS libraries. To harmonize crypto across all applications in Fedora, including the Java ones, OpenJDK is enhanced to respect the settings of the system-wide crypto policy as well.

Owner

Current status

  • Targeted release: Fedora 25
  • Last updated: 2016-05-30
  • Tracker bug: <will be assigned by the Wrangler>

Detailed Description

As it is now, the System-wide crypto policy in F24 is only enforced by the OpenSSL and GnuTLS TLS libraries. To harmonize crypto across all applications in Fedora, including the Java ones, OpenJDK is enhanced to respect the settings of the system-wide crypto policy as well.

After that change the administrator should be assured that any Java application will follow a policy that adheres to the configured profile.


Benefit to Fedora

With this change a Fedora system will have a consistent way of setting a default security profile for all java applications. Overall this brings the Java applications in par with the OpenSSL and GnuTLS with respect to system-wide policy adherence.


Scope

  • Proposal owners:

The change requires modifying OpenJDK to read additional security properties from the generated by the crypto policies file (/etc/crypto-policies/back-ends/java.config).

  • Other developers:

There are no required actions by other developers. The change requires only targeted changes to openjdk and crypto-policies.


  • Release engineering:

No actions required.


  • Trademark approval:

N/A (not needed for this Change)

Upgrade/compatibility impact

Connection to legacy systems with Java-applications may no longer be possible. This can be worked around by the administrator by switching from the DEFAULT to LEGACY crypto policy.

How To Test

Testing good operation

Test the good operation of Java applications to connect to various sites on the Internet.

Testing application of settings

  • Setup an HTTPS server with a legacy protocol that is disabled in F25 system wide policy (e.g., RC4, SSL 3.0)
  • Use an java application to connect to that server
  • The connection should fail on F25 (may have succeeded on previous versions - something that depends on the application specific policy).


User Experience

Given that the system wide policy does disable obsolete ciphers and protocols, there should be no user noticeable result.

Dependencies

Several. Use "repoquery --whatrequires java" for the dependency listing.

Contingency Plan

  • Contingency mechanism:

If the changes to NSS are not complete on time then OpenJDK will remain the same without respecting the crypto policies in Fedora 25.

  • Contingency deadline: F25 alpha
  • Blocks release? Yes
  • Blocks product? N/A

Documentation

Release Notes

A proposal of notes is the following.

The release notes originally used in Crypto policies changes should be used, in addition to: "With this change a Fedora system will have a consistent way of setting a default security profile for all Java-depending applications. Overall this brings the Java applications in par with the OpenSSL and GnuTLS with respect to system-wide policy adherence."