From 58dc8bfb7c434660155687d3982a7165303686b7 Mon Sep 17 00:00:00 2001
From: Kostas Tsiounis <kostas.tsiounis@ibm.com>
Date: Thu, 17 Oct 2024 11:56:09 -0400
Subject: [PATCH] Block all properties that can be set by profile

Instead of just blocking the properties that are set by the
loaded profile, block all properties that can potentially
be set by any RestrictedSecurity profile.

Signed-off-by: Kostas Tsiounis <kostas.tsiounis@ibm.com>
---
 .../internal/security/RestrictedSecurity.java | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java b/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java
index c051e380a07..be0d6a5790d 100644
--- a/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java
+++ b/closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java
@@ -404,8 +404,8 @@ private static void checkFIPSCompatibility() {
     /**
      * Check whether a security property can be set.
      *
-     * A security property that is set by a RestrictedSecurity profile,
-     * while FIPS security mode is enabled, cannot be reset programmatically.
+     * A security property that is FIPS-related and can be set by a RestrictedSecurity
+     * profile, while FIPS security mode is enabled, cannot be reset programmatically.
      *
      * Every time an attempt to set a security property is made, a check is
      * performed. If the above scenario holds true, a SecurityException is
@@ -426,7 +426,7 @@ public static void checkSetSecurityProperty(String key) {
         }
 
         /*
-         * Only disallow setting of security properties that are set by the active profile,
+         * Only disallow setting of security properties that are FIPS-related,
          * if FIPS has been enabled.
          *
          * Allow any change, if the 'semeru.fips.allowsetproperties' flag is set to true.
@@ -438,8 +438,8 @@ public static void checkSetSecurityProperty(String key) {
                         + "properties to be set, use '-Dsemeru.fips.allowsetproperties=true'.");
                 debug.println("BEWARE: You might not be FIPS compliant if you select to override!");
             }
-            throw new SecurityException("FIPS mode: User-specified '" + key
-                    + "' cannot override profile definition.");
+            throw new SecurityException("Property '" + key
+                    + "' cannot be set programmatically when in FIPS mode");
         }
 
         if (debug != null) {
@@ -556,15 +556,15 @@ private static void setProperties(Properties props) {
             printStackTraceAndExit("Property com.ibm.fips.mode is incompatible with semeru.customprofile and semeru.fips properties");
         }
 
+        if (userEnabledFIPS && !allowSetProperties) {
+            // Add all properties that cannot be modified.
+            unmodifiableProperties.addAll(propsMapping.keySet());
+        }
+
         for (Map.Entry<String, String> entry : propsMapping.entrySet()) {
             String jdkPropsName = entry.getKey();
             String propsNewValue = entry.getValue();
 
-            if ((propsNewValue != null) && userEnabledFIPS && !allowSetProperties) {
-                // Add to set of properties set by the active profile.
-                unmodifiableProperties.add(jdkPropsName);
-            }
-
             if (!isNullOrBlank(propsNewValue)) {
                 props.setProperty(jdkPropsName, propsNewValue);
                 if (debug != null) {