...

• Limit what file paths can be read/written
• Limit certain network access can be made
• Prevent System.exit()
• Limit Process exec to a limited set of classes
• etc

Please see https://githubopensearch.com/opensearch-project/OpenSearch/issues/17181 for a similar discussion in the Opensearch project. They talked about hardening systemd configuration as well as building a custom Java Agent to intercept system calls.org/blog/finding-a-replacement-for-jsm-in-opensearch-3-0/ for a description on the approach chosen by the Opensearch project. Their java agent can be found here https://github.com/opensearch-project/OpenSearch/tree/main/libs/agent-sm

Compatibility, Deprecation, and Migration Plan

...

Rejected Alternatives

• Staying on < Java24Leaving Solr unprotected
• Removing JSM protections without any replacement