HADOOP-19744. Do not use SecurityManager in SubjectUtil.checkThreadInheritsSubject

[stoty]

Description of PR

Remove SecurityManager dependent logic for determining if we can optimize out the doAs()/callAs() methods in
SubjectInheritingThread and Daemon on JDK 22 and 23, and assume that we cannot optimize them out.

How was this patch tested?

Ran TestSubjectPropagation with Java 17,21,23,24,25.

For code changes:

• Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
• Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
• If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 42s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
+1 💚	test4tests	0m 0s		The patch appears to include 1 new or modified test files.
			_ trunk Compile Tests _
+0 🆗	mvndep	7m 4s		Maven dependency ordering for branch
+1 💚	mvninstall	15m 31s		trunk passed
+1 💚	compile	8m 37s		trunk passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	compile	8m 48s		trunk passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
+1 💚	checkstyle	0m 37s		trunk passed
+1 💚	mvnsite	1m 22s		trunk passed
+1 💚	javadoc	1m 16s		trunk passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	javadoc	1m 4s		trunk passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
-1 ❌	spotbugs	0m 36s	/branch-spotbugs-hadoop-common-project_hadoop-auth-warnings.html	hadoop-common-project/hadoop-auth in trunk has 8 extant spotbugs warnings.
-1 ❌	spotbugs	1m 29s	/branch-spotbugs-hadoop-common-project_hadoop-common-warnings.html	hadoop-common-project/hadoop-common in trunk has 448 extant spotbugs warnings.
+1 💚	shadedclient	15m 6s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 17s		Maven dependency ordering for patch
+1 💚	mvninstall	0m 49s		the patch passed
+1 💚	compile	8m 14s		the patch passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	javac	8m 14s		the patch passed
+1 💚	compile	8m 46s		the patch passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
+1 💚	javac	8m 46s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
-0 ⚠️	checkstyle	0m 32s	/results-checkstyle-hadoop-common-project.txt	hadoop-common-project: The patch generated 1 new + 5 unchanged - 0 fixed = 6 total (was 5)
+1 💚	mvnsite	1m 21s		the patch passed
+1 💚	javadoc	1m 10s		the patch passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	javadoc	1m 1s		the patch passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
+1 💚	spotbugs	2m 14s		the patch passed
+1 💚	shadedclient	15m 25s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	2m 50s		hadoop-auth in the patch passed.
+1 💚	unit	15m 56s		hadoop-common in the patch passed.
+1 💚	asflicense	0m 32s		The patch does not generate ASF License warnings.
		122m 49s

Subsystem	Report/Notes
Docker	ClientAPI=1.52 ServerAPI=1.52 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8088/1/artifact/out/Dockerfile
GITHUB PR	#8088
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets
uname	Linux 53d3e6e26ba4 5.15.0-156-generic #166-Ubuntu SMP Sat Aug 9 00:02:46 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / 8944d13
Default Java	Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8088/1/testReport/
Max. process+thread count	1300 (vs. ulimit of 5500)
modules	C: hadoop-common-project/hadoop-auth hadoop-common-project/hadoop-common U: hadoop-common-project
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8088/1/console
versions	git=2.25.1 maven=3.9.11 spotbugs=4.9.7
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	1m 26s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
+1 💚	test4tests	0m 0s		The patch appears to include 1 new or modified test files.
			_ trunk Compile Tests _
+0 🆗	mvndep	7m 9s		Maven dependency ordering for branch
+1 💚	mvninstall	29m 12s		trunk passed
+1 💚	compile	16m 1s		trunk passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	compile	16m 17s		trunk passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
+1 💚	checkstyle	1m 10s		trunk passed
+1 💚	mvnsite	2m 39s		trunk passed
+1 💚	javadoc	2m 10s		trunk passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	javadoc	2m 1s		trunk passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
-1 ❌	spotbugs	1m 5s	/branch-spotbugs-hadoop-common-project_hadoop-auth-warnings.html	hadoop-common-project/hadoop-auth in trunk has 8 extant spotbugs warnings.
-1 ❌	spotbugs	3m 0s	/branch-spotbugs-hadoop-common-project_hadoop-common-warnings.html	hadoop-common-project/hadoop-common in trunk has 448 extant spotbugs warnings.
+1 💚	shadedclient	28m 40s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 31s		Maven dependency ordering for patch
+1 💚	mvninstall	1m 29s		the patch passed
+1 💚	compile	15m 6s		the patch passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	javac	15m 6s		the patch passed
+1 💚	compile	16m 10s		the patch passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
+1 💚	javac	16m 10s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
-0 ⚠️	checkstyle	1m 8s	/results-checkstyle-hadoop-common-project.txt	hadoop-common-project: The patch generated 1 new + 5 unchanged - 0 fixed = 6 total (was 5)
+1 💚	mvnsite	2m 37s		the patch passed
+1 💚	javadoc	2m 3s		the patch passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	javadoc	2m 3s		the patch passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
+1 💚	spotbugs	4m 24s		the patch passed
+1 💚	shadedclient	28m 23s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	3m 43s		hadoop-auth in the patch passed.
+1 💚	unit	22m 17s		hadoop-common in the patch passed.
+1 💚	asflicense	0m 56s		The patch does not generate ASF License warnings.
		213m 1s

Subsystem	Report/Notes
Docker	ClientAPI=1.52 ServerAPI=1.52 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8088/2/artifact/out/Dockerfile
GITHUB PR	#8088
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets
uname	Linux 89b0e0e88516 5.15.0-156-generic #166-Ubuntu SMP Sat Aug 9 00:02:46 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / 0b795b3
Default Java	Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8088/2/testReport/
Max. process+thread count	1278 (vs. ulimit of 5500)
modules	C: hadoop-common-project/hadoop-auth hadoop-common-project/hadoop-common U: hadoop-common-project
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8088/2/console
versions	git=2.25.1 maven=3.9.11 spotbugs=4.9.7
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

[hadoop-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 42s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
+1 💚	test4tests	0m 0s		The patch appears to include 1 new or modified test files.
			_ trunk Compile Tests _
+0 🆗	mvndep	7m 38s		Maven dependency ordering for branch
+1 💚	mvninstall	15m 46s		trunk passed
-1 ❌	compile	6m 47s	/branch-compile-root-jdkUbuntu-21.0.7+6-Ubuntu-0ubuntu120.04.txt	root in trunk failed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04.
-1 ❌	compile	6m 45s	/branch-compile-root-jdkUbuntu-17.0.15+6-Ubuntu-0ubuntu120.04.txt	root in trunk failed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04.
+1 💚	checkstyle	0m 34s		trunk passed
+1 💚	mvnsite	1m 21s		trunk passed
+1 💚	javadoc	1m 8s		trunk passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	javadoc	1m 4s		trunk passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
-1 ❌	spotbugs	0m 35s	/branch-spotbugs-hadoop-common-project_hadoop-auth-warnings.html	hadoop-common-project/hadoop-auth in trunk has 8 extant spotbugs warnings.
-1 ❌	spotbugs	1m 32s	/branch-spotbugs-hadoop-common-project_hadoop-common-warnings.html	hadoop-common-project/hadoop-common in trunk has 448 extant spotbugs warnings.
+1 💚	shadedclient	15m 9s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 19s		Maven dependency ordering for patch
+1 💚	mvninstall	0m 50s		the patch passed
-1 ❌	compile	6m 17s	/patch-compile-root-jdkUbuntu-21.0.7+6-Ubuntu-0ubuntu120.04.txt	root in the patch failed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04.
-1 ❌	javac	6m 17s	/patch-compile-root-jdkUbuntu-21.0.7+6-Ubuntu-0ubuntu120.04.txt	root in the patch failed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04.
-1 ❌	compile	6m 48s	/patch-compile-root-jdkUbuntu-17.0.15+6-Ubuntu-0ubuntu120.04.txt	root in the patch failed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04.
-1 ❌	javac	6m 48s	/patch-compile-root-jdkUbuntu-17.0.15+6-Ubuntu-0ubuntu120.04.txt	root in the patch failed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04.
+1 💚	blanks	0m 0s		The patch has no blanks issues.
-0 ⚠️	checkstyle	0m 31s	/results-checkstyle-hadoop-common-project.txt	hadoop-common-project: The patch generated 1 new + 5 unchanged - 0 fixed = 6 total (was 5)
+1 💚	mvnsite	1m 23s		the patch passed
+1 💚	javadoc	1m 5s		the patch passed with JDK Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04
+1 💚	javadoc	1m 0s		the patch passed with JDK Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
+1 💚	spotbugs	2m 15s		the patch passed
+1 💚	shadedclient	15m 9s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	2m 48s		hadoop-auth in the patch passed.
+1 💚	unit	16m 6s		hadoop-common in the patch passed.
+1 💚	asflicense	0m 34s		The patch does not generate ASF License warnings.
		115m 18s

Subsystem	Report/Notes
Docker	ClientAPI=1.52 ServerAPI=1.52 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8088/3/artifact/out/Dockerfile
GITHUB PR	#8088
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets
uname	Linux 9fdc29dc5e2a 5.15.0-156-generic #166-Ubuntu SMP Sat Aug 9 00:02:46 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / 6858636
Default Java	Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.7+6-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.15+6-Ubuntu-0ubuntu120.04
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8088/3/testReport/
Max. process+thread count	1296 (vs. ulimit of 5500)
modules	C: hadoop-common-project/hadoop-auth hadoop-common-project/hadoop-common U: hadoop-common-project
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8088/3/console
versions	git=2.25.1 maven=3.9.11 spotbugs=4.9.7
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

[stoty]

The build failures are caused by some kind of JS repo outage.

[steveloughran]

+1

checkstyle is complaining because you could just go

return JAVA_SPEC_VER <= 21;

but the structure here lines up for options of changing it in future (unlikely, I know)

[stoty]

+1

checkstyle is complaining because you could just go

return JAVA_SPEC_VER <= 21;

but the structure here lines up for options of changing it in future (unlikely, I know)

Ah, true.
Adding the rambling comments to that one would have been awkward, though.