Status

Current state: Under Discussion

Discussion thread:  
JIRA: here (<- link to https://issueslists.apache.org/jira/browse/SOLR-XXXX)thread/7qqknryoh4hxv2s7291j8g5shlcbock3

JIRA: 

Released: <Solr Version>

Please keep the discussion on the mailing list rather than commenting on the wiki (wiki discussions get unwieldy fast). Confluence supports inline comments that can also be used.

Motivation

Java Security Manager is gone from Java 24. Solr will then run unprotected without sandboxing file access etc. It would make sense to implement some protection in chosen areas, as also e.g. OpenSearch has done.

Public Interfaces

The proposal will likely lead to some new configuration options to tailor the new features. Also the old SecurityProfile files will be gone.

Proposed Changes

We will not re-implement JSM, but a minimum of low-hanging protection mechanisms can be considered:

...

Please see https://github.com/opensearch-project/OpenSearch/issues/17181 for a similar discussion in the Opensearch project. They talked about hardening systemd configuration as well as building a custom Java Agent to intercept system calls.

Compatibility, Deprecation, and Migration Plan

• JSM is going away, which will impact users anyway, see

  Jira
  server ASF JIRA serverId 5aa69414-a9e9-3523-82ec-879b028fb15b key SOLR-17641

  which is the Jira to disable security manager when Java >= 24 is detected by start scripts. 
• The new protections can be a subset of existing JSM rules, so Solr should not stop running if it runs today under JSM
• Most users will not see any change
• There will not be any action required by users

Security considerations

This SIP will harden Solr's security after JSM goes away in Java 24.

Test Plan

Solr has lots of existing tests related to JSM, and such tests can be re-puprosed to cover the new mechanisms.

Rejected Alternatives

• Staying on < Java24
• Leaving Solr unprotected