8348967: Deprecate security permission classes for removal

Reviewed-by: rriggs, iris
2025-04-08 16:13:43 +00:00 · 2025-04-08 16:13:43 +00:00 · 3cbe686d62
commit 3cbe686d62
parent 4645ddbb6b
11 changed files with 36 additions and 16 deletions
--- a/src/java.base/share/classes/java/security/Permissions.java
+++ b/src/java.base/share/classes/java/security/Permissions.java
@ -125,6 +125,7 @@ implements Serializable
     * @see PermissionCollection#isReadOnly()
     */
    @Override
+    @SuppressWarnings("removal")
    public void add(Permission permission) {
        if (isReadOnly())
            throw new SecurityException(
@ -288,6 +289,7 @@ implements Serializable
     *  or {@code null} if there were no unresolved permissions of type p.
     *
     */
+    @SuppressWarnings("removal")
    private PermissionCollection getUnresolvedPermissions(Permission p)
    {
        UnresolvedPermissionCollection uc =
@ -392,6 +394,7 @@ implements Serializable
     * permsMap field. Reads in allPermission.
     */
    @java.io.Serial
+    @SuppressWarnings("removal")
    private void readObject(ObjectInputStream in) throws IOException,
    ClassNotFoundException {
        // Don't call defaultReadObject()
--- a/src/java.base/share/classes/java/security/SecurityPermission.java
+++ b/src/java.base/share/classes/java/security/SecurityPermission.java
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
@ -32,7 +32,7 @@ package java.security;
 * <p>
 * The target name is the name of a security configuration parameter.
 *
- * @apiNote
+ * @deprecated
 * This permission cannot be used for controlling access to resources
 * as the Security Manager is no longer supported.
 *
@ -47,6 +47,7 @@ package java.security;
 * @since 1.2
 */

+@Deprecated(since="25", forRemoval=true)
 public final class SecurityPermission extends BasicPermission {

    @java.io.Serial
--- a/src/java.base/share/classes/java/security/UnresolvedPermission.java
+++ b/src/java.base/share/classes/java/security/UnresolvedPermission.java
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
@ -49,8 +49,12 @@ import java.util.Objects;
 *
 * @author Roland Schemers
 * @since 1.2
+ *
+ * @deprecated This permission cannot be used for controlling access to
+ *       resources as the Security Manager is no longer supported.
 */

+@Deprecated(since="25", forRemoval=true)
 public final class UnresolvedPermission extends Permission
 implements java.io.Serializable
 {
--- a/src/java.base/share/classes/java/security/UnresolvedPermissionCollection.java
+++ b/src/java.base/share/classes/java/security/UnresolvedPermissionCollection.java
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2025, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
@ -49,6 +49,7 @@ import java.util.concurrent.CopyOnWriteArrayList;
 * @serial include
 */

+@SuppressWarnings("removal")
 final class UnresolvedPermissionCollection
 extends PermissionCollection
 implements java.io.Serializable
--- a/src/java.base/share/classes/javax/net/ssl/SSLPermission.java
+++ b/src/java.base/share/classes/javax/net/ssl/SSLPermission.java
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2025, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
@ -40,7 +40,7 @@ import java.security.*;
 * signify a wildcard match. For example: "foo.*" and "*" signify a wildcard
 * match, while "*foo" and "a*b" do not.
 *
- * @apiNote
+ * @deprecated
 * This permission cannot be used for controlling access to resources
 * as the Security Manager is no longer supported.
 *
@ -55,6 +55,7 @@ import java.security.*;
 * @author Roland Schemers
 */

+@Deprecated(since="25", forRemoval=true)
 public final class SSLPermission extends BasicPermission {

    @java.io.Serial
--- a/src/java.base/share/classes/javax/security/auth/AuthPermission.java
+++ b/src/java.base/share/classes/javax/security/auth/AuthPermission.java
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2025, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
@ -30,12 +30,13 @@ package javax.security.auth;
 * contains a name (also referred to as a "target name") but no actions
 * list; you either have the named permission or you don't.
 *
- * @apiNote
+ * @deprecated
 * This permission cannot be used for controlling access to resources
 * as the Security Manager is no longer supported.
 *
 * @since 1.4
 */
+@Deprecated(since="25", forRemoval=true)
 public final class AuthPermission extends
 java.security.BasicPermission {

--- a/src/java.base/share/classes/javax/security/auth/PrivateCredentialPermission.java
+++ b/src/java.base/share/classes/javax/security/auth/PrivateCredentialPermission.java
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2025, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
@ -47,12 +47,13 @@ import sun.security.util.ResourcesMgr;
 *      CredentialClass {PrincipalClass "PrincipalName"}*
 * </pre>
 *
- * @apiNote
+ * @deprecated
 * This permission cannot be used for controlling access to resources
 * as the Security Manager is no longer supported.
 *
 * @since 1.4
 */
+@Deprecated(since="25", forRemoval=true)
 public final class PrivateCredentialPermission extends Permission {

    @java.io.Serial
--- a/src/java.security.jgss/share/classes/javax/security/auth/kerberos/DelegationPermission.java
+++ b/src/java.security.jgss/share/classes/javax/security/auth/kerberos/DelegationPermission.java
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2025, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
@ -43,13 +43,14 @@ import java.util.concurrent.ConcurrentHashMap;
 * latter service principal is specified to restrict the use of a
 * proxiable ticket.
 *
- * @apiNote
+ * @deprecated
 * This permission cannot be used for controlling access to resources
 * as the Security Manager is no longer supported.
 *
 * @since 1.4
 */

+@Deprecated(since="25", forRemoval=true)
 public final class DelegationPermission extends BasicPermission
    implements java.io.Serializable {

@ -249,6 +250,7 @@ final class KrbDelegationPermissionCollection extends PermissionCollection
     * the collection, false if not.
     */
    @Override
+    @SuppressWarnings("removal")
    public boolean implies(Permission permission) {
        if (! (permission instanceof DelegationPermission))
            return false;
@ -270,6 +272,7 @@ final class KrbDelegationPermissionCollection extends PermissionCollection
     *                                has been marked readonly
     */
    @Override
+    @SuppressWarnings("removal")
    public void add(Permission permission) {
        if (! (permission instanceof DelegationPermission))
            throw new IllegalArgumentException("invalid permission: "+
--- a/src/java.security.jgss/share/classes/javax/security/auth/kerberos/ServicePermission.java
+++ b/src/java.security.jgss/share/classes/javax/security/auth/kerberos/ServicePermission.java
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2025, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
@ -54,13 +54,14 @@ import java.util.concurrent.ConcurrentHashMap;
 *                            principal.
 * </pre>
 *
- * @apiNote
+ * @deprecated
 * This permission cannot be used for controlling access to resources
 * as the Security Manager is no longer supported.
 *
 * @since 1.4
 */

+@Deprecated(since="25", forRemoval=true)
 public final class ServicePermission extends Permission
    implements java.io.Serializable {

@ -433,6 +434,7 @@ final class KrbServicePermissionCollection extends PermissionCollection
     * the collection, false if not.
     */
    @Override
+    @SuppressWarnings("removal")
    public boolean implies(Permission permission) {
        if (! (permission instanceof ServicePermission np))
            return false;
@ -480,6 +482,7 @@ final class KrbServicePermissionCollection extends PermissionCollection
     *                                has been marked readonly
     */
    @Override
+    @SuppressWarnings("removal")
    public void add(Permission permission) {
        if (! (permission instanceof ServicePermission sp))
            throw new IllegalArgumentException("invalid permission: "+
--- a/src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/utils/JavaUtils.java
+++ b/src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/utils/JavaUtils.java
@ -39,6 +39,7 @@ public final class JavaUtils {
    private static final com.sun.org.slf4j.internal.Logger LOG =
        com.sun.org.slf4j.internal.LoggerFactory.getLogger(JavaUtils.class);

+    @SuppressWarnings("removal")
    private static final SecurityPermission REGISTER_PERMISSION =
        new SecurityPermission("com.sun.org.apache.xml.internal.security.register");

--- a/src/jdk.security.jgss/share/classes/com/sun/security/jgss/InquireSecContextPermission.java
+++ b/src/jdk.security.jgss/share/classes/com/sun/security/jgss/InquireSecContextPermission.java
@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2009, 2024, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2009, 2025, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
@ -32,12 +32,13 @@ import java.security.BasicPermission;
 *
 * <p>The target name is the {@link InquireType} allowed.
 *
- * @apiNote
+ * @deprecated
 * This permission cannot be used for controlling access to resources
 * as the Security Manager is no longer supported.
 *
 * @since 1.7
 */
+@Deprecated(since="25", forRemoval=true)
 public final class InquireSecContextPermission extends BasicPermission {
    private static final long serialVersionUID = -7131173349668647297L;