<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 28 Apr 2023, at 20:14, Eirik Bjørsnøs <<a href="mailto:eirbjo@gmail.com" class="">eirbjo@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div dir="ltr" class="">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
> Agents are used by profiling tools to instrument Java applications,<br class="">
> but agents can also be misused to undermine the integrity of the<br class="">
> Java Platform.<br class="">
<br class="">
I don't think it is fair to assume that profilers are the only "valid"<br class="">
use case for agents and imply that all other use cases are a mis-use<br class="">
of the API.<br class="">
</blockquote>
<div class=""><br class="">
</div>
<div class="">First, I don't read the JEP as implying that all non-profiler use cases are misuse.</div>
<div class=""><br class="">
</div>
<div class="">Having said that, I do think that agents can in fact strengthen the integrity of the platform. Case in point is that when the Java serialization vulnerabilities hit around 2015, I could very quickly ( a few hours) whip together the "NotSoSerial"
serialization firewall agent [1] to efficiently prevent exploits. I later got word that a large CMS vendor deployed it to their platform which included some of the world's busiest websites. I don't know if they used the attach mechanism to plug their serialization
holes, but they surely could at the time.</div>
<div class=""><br class="">
</div>
<div class="">With microservices gaining popularity over the years, restarts are probably more common and automated now, including configuration of JVM options. So attaching to long-running instances to prevent restarts is probably becoming less useful over
time.</div>
<div class=""><br class="">
</div>
<div class="">The agent misuse that the JEP is referring to here is perhaps mostly concerning libraries using the attach mechanism to get access they otherwise would not have in a running JVM? Perhaps the JEP could be updated to be more clear on this?</div>
<div class=""><br class="">
</div>
<div class="">Cheers,</div>
<div class="">Eirik.</div>
<div class=""><br class="">
</div>
<div class="">[1] <a href="https://urldefense.com/v3/__https://github.com/kantega/notsoserial/__;!!ACWV5N9M2RV99hQ!N8oN0PnS91PqZc8Bs_d5cOcHeV61_9P5AcNXC7zRaeaykTQiWKD2gqxnONwng9pKA92IVDQ7ilqZ9bQ$" class="">https://github.com/kantega/notsoserial/</a></div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
<div class="">Keep in mind two things:</div>
<div class=""><br class="">
</div>
<div class="">1. Dynamically loaded agents are more limited in their capabilities than agents loaded at startup because redefinition/retransformation is limited to changing the body of existing methods. Redefinition can only fix issues if you’re lucky.</div>
<div class=""><br class="">
</div>
<div class="">2. Java offers no general mechanism to make patches applied through redefinition persistent. They are reverted at the next startup.</div>
<div class=""><br class="">
</div>
<div class="">Due to these two facts, patching code in production to change its logic (as opposed to benign instrumentation with profiling events) has never been a sanctioned usage of dynamic agents. It’s simply not a generally-effective mechanism for that.
Tools that offer less restricted dynamic patching (e.g. JRebel) require an agent *loaded at startup*.</div>
<div class=""><br class="">
</div>
<div class="">— Ron</div>
</body>
</html>