Command line flag to disable finalizers.
Peter Firmstone
peter.firmstone at zeus.net.au
Sat Apr 16 02:46:46 UTC 2022
To securely instrument access controls onto public Java API, we need to
have the ability to disable finalizers, to prevent finalizer attacks
from circumventing access controls.
Since finalizers are planned for removal, as soon as finalizers are
officially deprecated, I propose a command line flag be provided to
disable jvm calls to finalizer methods.
--
Regards,
Peter Firmstone.
More information about the security-dev
mailing list