[jboss-jira] [JBoss JIRA] (WFLY-2440) Thread pool AccessControlContext Propagation

[Darran Lofthouse (JIRA)]

Darran Lofthouse created WFLY-2440:
--------------------------------------

             Summary: Thread pool AccessControlContext Propagation
                 Key: WFLY-2440
                 URL: https://issues.jboss.org/browse/WFLY-2440
             Project: WildFly
          Issue Type: Task
      Security Level: Public (Everyone can see)
            Reporter: Darran Lofthouse
            Assignee: Darran Lofthouse
             Fix For: 8.0.0.CR1


A decision was made within Java that newly created threads should inherit the access control context of their creator.  

In general this was justified on the basis that if you are creating a thread you want it to inherit the permissions you already have.

Once we introduce thread pooling that logic no longer makes as much sense and there is not the same relationship between the thread that triggers it's creation and the long term life of that thread.

This may affect components outside of WildFly but I am raising it here as a top level task.

Should also note that JBoss Threads does already have some protection built in if a security manager is in use but there are times the AccessControlContext will be used without a security manager so more control is required.



--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira