<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<br>
<div class="moz-cite-prefix">On 9/13/18 4:50 PM, Stuart Marks wrote:<br>
</div>
<blockquote type="cite"
cite="mid:688a7f42-d536-ba0c-eb53-d621bcaaa512@oracle.com">Hi
Sean,
<br>
<br>
Looks sensible to me.
<br>
<br>
On 9/13/18 1:02 PM, Sean Mullan wrote:
<br>
<blockquote type="cite">2. A new JDK-specific system property to
disallow the setting of the security manager at run-time:
jdk.allowSecurityManager
<br>
<br>
If set to false, it allows the run-time to optimize the code and
improve performance when it is known that an application will
never run with a SecurityManager. To support this behavior, the
System.setSecurityManager() API has been updated such that it
can throw an UnsupportedOperationException if it does not allow
a security manager to be set dynamically.
<br>
</blockquote>
<br>
I guess the default value is true?
<br>
<br>
The behavior makes sense, though the name I think is misleading.
It seems not to disallow a security manager, but to disallow the
capability to *set* the security manager. Maybe
"jdk.allowSetSecurityManager" ?
<br>
<br>
</blockquote>
<br>
When -Djdk.allowSecurityManager is set at startup, no security
manager is allowed. Most cases a security manager is started via
-Djava.security.manager on the command-line. <br>
<br>
This name also prepares for the future to potentially flip the
default (no security manager by default) and allow a security
manager at runtime. <br>
<br>
Mandy<br>
<br>
</body>
</html>