Java/OpenJDK enforces the system-wide crypto policy
Summary
As it is now, the System-wide crypto policy in F25 is enforced by the OpenSSL, GnuTLS and NSS TLS libraries. To harmonize crypto across all applications in Fedora, including the Java ones, OpenJDK is enhanced to respect the settings of the system-wide crypto policy as well.
Owner
- Name: Nikos Mavrogiannopoulos
- Email: nmav@redhat.com
- Release notes owner:
Current status
Detailed Description
As it is now, the System-wide crypto policy in F25 is enforced by the OpenSSL, GnuTLS and NSS TLS libraries. To harmonize crypto across all applications in Fedora, including the Java ones, OpenJDK is enhanced to respect the settings of the system-wide crypto policy as well.
After that change the administrator should be assured that any Java application will follow a policy that adheres to the configured profile.
Benefit to Fedora
With this change a Fedora system will have a consistent way of setting a default security profile for all java applications. Overall this brings the Java applications in par with the OpenSSL and GnuTLS with respect to system-wide policy adherence.
Scope
- Proposal owners:
The change requires modifying OpenJDK to read additional security properties from the generated by the crypto policies file (/etc/crypto-policies/back-ends/java.config).
- Other developers:
There are no required actions by other developers. The change requires only targeted changes to openjdk and crypto-policies.
- Release engineering:
No actions required.
- Policies and guidelines:
- The packaging guidelines for crypto policies need to be modified to include OpenJDK/java in the list of libraries supporting the policies.
- Trademark approval:
N/A (not needed for this Change)
Upgrade/compatibility impact
Connection to legacy systems with Java-applications may no longer be possible. This can be worked around by the administrator by switching from the DEFAULT to LEGACY crypto policy.
How To Test
Testing good operation
Test the good operation of Java applications to connect to various sites on the Internet.
Testing application of settings
- Setup an HTTPS server with a legacy protocol that is disabled in F25 system wide policy (e.g., RC4, SSL 3.0)
- Use an java application to connect to that server
- The connection should fail on F25 (may have succeeded on previous versions - something that depends on the application specific policy).
User Experience
Given that the system wide policy does disable obsolete ciphers and protocols, there should be no user noticeable result.
Dependencies
Several. Use "repoquery --whatrequires java" for the dependency listing.
Contingency Plan
- Contingency mechanism:
If the changes to NSS are not complete on time then OpenJDK will remain the same without respecting the crypto policies in Fedora 25.
- Contingency deadline: F26 alpha
- Blocks release? Yes
- Blocks product? N/A
Documentation
Release Notes
A proposal of notes is the following.
The release notes originally used in Crypto policies changes should be used, in addition to: "With this change a Fedora system will have a consistent way of setting a default security profile for all Java-depending applications. Overall this brings the Java applications in par with the OpenSSL and GnuTLS with respect to system-wide policy adherence."