Skip to content

Test indy instrumentation with security manager#18634

Merged
laurit merged 3 commits into
open-telemetry:mainfrom
laurit:indy-security-manager
May 11, 2026
Merged

Test indy instrumentation with security manager#18634
laurit merged 3 commits into
open-telemetry:mainfrom
laurit:indy-security-manager

Conversation

@laurit

@laurit laurit commented May 8, 2026

Copy link
Copy Markdown
Contributor

Resolves #16821

@laurit
laurit requested a review from a team as a code owner May 8, 2026 06:42
return java.security.AccessController.doPrivileged(
(PrivilegedAction<CallSite>)
() -> internalBootstrap(lookup, adviceMethodName, adviceMethodType, args));
new PrivilegedAction<CallSite>() {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
new PrivilegedAction<CallSite>() {
// must be an anonymous class, not a lambda: a lambda here would trigger
// LambdaMetafactory.spinInnerClass -> defineClass -> re-entrant indy bootstrap
new PrivilegedAction<CallSite>() {

Copilot AI review requested due to automatic review settings May 11, 2026 08:09
@laurit
laurit enabled auto-merge (squash) May 11, 2026 08:10

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds smoke-test coverage for running the Javaagent with SecurityManager enabled and invokedynamic (“indy”) instrumentation turned on, and adjusts indy/bootstrap + class-define handling to avoid problematic re-entrancy and unnecessary work.

Changes:

  • Add a new SecurityManagerIndySmokeTest variant that enables OTEL_JAVAAGENT_EXPERIMENTAL_INDY=true.
  • Strengthen SecurityManagerSmokeTest assertions to fail if logs contain stack-trace frames.
  • Avoid lambda usage in IndyBootstrap’s doPrivileged path and introduce an ignored-classloader predicate to skip supertype resolution for ignored class loaders.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
smoke-tests/src/test/java/io/opentelemetry/smoketest/SecurityManagerSmokeTest.java Captures container output and asserts the run doesn’t emit stack traces.
smoke-tests/src/test/java/io/opentelemetry/smoketest/SecurityManagerIndySmokeTest.java New smoke test enabling indy mode under the SecurityManager image.
javaagent-tooling/src/main/java/io/opentelemetry/javaagent/tooling/instrumentation/indy/IndyBootstrap.java Replaces a doPrivileged lambda with an anonymous class to avoid nested indy/lambda bootstrapping recursion.
javaagent-tooling/src/main/java/io/opentelemetry/javaagent/tooling/DefineClassHandler.java Adds an ignored-classloader predicate to skip define-class supertype loading work for ignored loaders.
javaagent-tooling/src/main/java/io/opentelemetry/javaagent/tooling/AgentInstaller.java Wires ignored classloader configuration into DefineClassHandler and reuses the built ignored-classloader trie.

Comment on lines +22 to +28
private static Predicate<ClassLoader> ignoredClassLoaders = (classLoader) -> false;

private DefineClassHandler() {}

public static void setIgnoredClassLoadersPredicate(Predicate<ClassLoader> predicate) {
ignoredClassLoaders = predicate;
}
Comment on lines +40 to +43
// skip ignore class loaders, class is not going to be instrumented anyway
if (ignoredClassLoaders.test(classLoader)) {
return null;
}
@laurit
laurit merged commit 53261dc into open-telemetry:main May 11, 2026
177 of 180 checks passed
@laurit
laurit deleted the indy-security-manager branch May 11, 2026 12:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

indy incompatibility with SecurityManager for some internal instrumentation

4 participants