Status

Current state: Under Discussion

Discussion thread: https://lists.apache.org/thread/7qqknryoh4hxv2s7291j8g5shlcbock3

JIRA:  SOLR-17767 - Getting issue details... STATUS

Released: <Solr Version>

Please keep the discussion on the mailing list rather than commenting on the wiki (wiki discussions get unwieldy fast). Confluence supports inline comments that can also be used.

Motivation

Java Security Manager is gone from Java 24. Solr will then run unprotected without sandboxing file access etc. It would make sense to implement some protection in chosen areas, as also e.g. OpenSearch has done.

Public Interfaces

The proposal will likely lead to some new configuration options to tailor the new features. Also the old SecurityProfile files will be gone.

Proposed Changes

We will not re-implement JSM, but a minimum of low-hanging protection mechanisms can be considered:

• Limit what file paths can be read/written
• Limit certain network access can be made
• Prevent System.exit()
• Limit Process exec to a limited set of classes
• etc

Please see https://github.com/opensearch-project/OpenSearch/issues/17181 for a similar discussion in the Opensearch project. They talked about hardening systemd configuration as well as building a custom Java Agent to intercept system calls.

Compatibility, Deprecation, and Migration Plan

• JSM is going away, which will impact users anyway, see SOLR-17641 - Getting issue details... STATUS which is the Jira to disable security manager when Java >= 24 is detected by start scripts. 
• The new protections can be a subset of existing JSM rules, so Solr should not stop running if it runs today under JSM
• Most users will not see any change
• There will not be any action required by users

Security considerations

This SIP will harden Solr's security after JSM goes away in Java 24.

Test Plan

Solr has lots of existing tests related to JSM, and such tests can be re-puprosed to cover the new mechanisms.

Rejected Alternatives

• Staying on < Java24
• Leaving Solr unprotected