Command line flag to disable finalizers.

Peter Firmstone peter.firmstone at zeus.net.au
Sat Apr 16 02:46:46 UTC 2022


To securely instrument access controls onto public Java API, we need to 
have the ability to disable finalizers, to prevent finalizer attacks 
from circumventing access controls.

Since finalizers are planned for removal, as soon as finalizers are 
officially deprecated, I propose a command line flag be provided to 
disable jvm calls to finalizer methods.

-- 
Regards,
  
Peter Firmstone.




More information about the security-dev mailing list