Command line flag to disable finalizers.

[Sean Mullan]

On 4/15/22 10:46 PM, Peter Firmstone wrote:
> To securely instrument access controls onto public Java API, we need to
> have the ability to disable finalizers, to prevent finalizer attacks
> from circumventing access controls.
> 
> Since finalizers are planned for removal, as soon as finalizers are
> officially deprecated, I propose a command line flag be provided to
> disable jvm calls to finalizer methods.

This is already supported. JEP 421 added a "--finalization=disabled" 
option to JDK 18:

https://openjdk.java.net/jeps/421#Command-line-option-to-disable-finalization

--Sean