diff --git a/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java b/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java index c051e380a07..05510ba77d4 100644 --- a/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java +++ b/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java @@ -404,8 +404,8 @@ private static void checkFIPSCompatibility() { /** * Check whether a security property can be set. * - * A security property that is set by a RestrictedSecurity profile, - * while FIPS security mode is enabled, cannot be reset programmatically. + * A security property that is FIPS related and can be set by a RestrictedSecurity + * profile, while FIPS security mode is enabled, cannot be reset programmatically. * * Every time an attempt to set a security property is made, a check is * performed. If the above scenario holds true, a SecurityException is @@ -426,7 +426,7 @@ public static void checkSetSecurityProperty(String key) { } /* - * Only disallow setting of security properties that are set by the active profile, + * Only disallow setting of security properties that are FIPS related, * if FIPS has been enabled. * * Allow any change, if the 'semeru.fips.allowsetproperties' flag is set to true. @@ -438,8 +438,8 @@ public static void checkSetSecurityProperty(String key) { + "properties to be set, use '-Dsemeru.fips.allowsetproperties=true'."); debug.println("BEWARE: You might not be FIPS compliant if you select to override!"); } - throw new SecurityException("FIPS mode: User-specified '" + key - + "' cannot override profile definition."); + throw new SecurityException("FIPS mode: Property '" + key + + "' cannot be set programmatically when in FIPS mode."); } if (debug != null) { @@ -556,15 +556,15 @@ private static void setProperties(Properties props) { printStackTraceAndExit("Property com.ibm.fips.mode is incompatible with semeru.customprofile and semeru.fips properties"); } + if (userEnabledFIPS && !allowSetProperties) { + // Add all properties that cannot be modified. + unmodifiableProperties.addAll(propsMapping.keySet()); + } + for (Map.Entry entry : propsMapping.entrySet()) { String jdkPropsName = entry.getKey(); String propsNewValue = entry.getValue(); - if ((propsNewValue != null) && userEnabledFIPS && !allowSetProperties) { - // Add to set of properties set by the active profile. - unmodifiableProperties.add(jdkPropsName); - } - if (!isNullOrBlank(propsNewValue)) { props.setProperty(jdkPropsName, propsNewValue); if (debug != null) {