RFR: 8155246: Throw error if default java.security file is missing

[Sean Coffey]

On Thu, 4 Aug 2022 15:22:23 GMT, Sean Coffey <coffeys at openjdk.org> wrote:

> In the broken case where the conf/security/java.security configuration file doesn't exist, the JDK should throw an Error. 
> 
> CSR in progress.

Hi Tony,

there are a few points for the change IMO:

* The fall back to the "static" security policy file is broken since JDK 9/Modules. Some providers don't register correctly. See JDK-8291888
* The fall back mode used a minimal security config setting and is not actively maintained. I'd argue that it's dangerous - all the JDK protection aids added via the java.security file aren't available if the default one is missing. One is still free to override the property file, as before. We just ensure that $JDK/conf/security/java.security exists. It's a bad JDK install if such a file doesn't exist. This might only make JDK 20 - perhaps we review feedback from that release and decide if we want to proceed with backports then.

regards,
Sean.

-------------

PR: https://git.openjdk.org/jdk/pull/9747