SOLR-17641: Disable the Security Manager when Java 24+ is detected (#3153)

Co-authored-by: Jan Høydahl <[email protected]>

Author: HoustonPutman

solr/CHANGES.txt

@@ -242,6 +242,8 @@ Improvements
 * SOLR-17884: SolrJ users not using deprecated SolrClients can safely exclude Apache HttpClient dependencies.
   (David Smiley)
 
+* SOLR-17641: Solr is now able to start on Java 24 and later, but with Security Manager disabled (Houston Putman, Jan Høydahl)
+
 Optimizations
 ---------------------
 (No changes)

solr/bin/solr

@@ -176,7 +176,7 @@ if [[ $? -ne 0 ]] ; then
   exit 1
 else
   JAVA_VER_NUM=$(echo "$JAVA_VER" | grep -v '_OPTIONS' | head -1 | awk -F '"' '/version/ {print $2}' | sed -e's/^1\.//' | sed -e's/[._-].*$//')
-  if [[ "$JAVA_VER_NUM" -lt "$JAVA_VER_REQ" ]] ; then
+  if (( JAVA_VER_NUM < JAVA_VER_REQ )) ; then
     echo >&2 "Your current version of Java is too old to run this version of Solr."
     echo >&2 "We found major version $JAVA_VER_NUM, using command '${JAVA} -version', with response:"
     echo >&2 "${JAVA_VER}"
@@ -1137,6 +1137,11 @@ else
   REMOTE_JMX_OPTS=()
 fi
 
+# Do not use the java security manager when running Java 24+
+if (( JAVA_VER_NUM >= 24 )) ; then
+    export SOLR_SECURITY_MANAGER_ENABLED="false"
+fi
+
 # Enable java security manager (allowing filesystem access and other things)
 if [ "${SOLR_SECURITY_MANAGER_ENABLED:-true}" == "true" ]; then
   SECURITY_MANAGER_OPTS=('-Djava.security.manager' \

solr/bin/solr.cmd

@@ -90,7 +90,10 @@ IF NOT DEFINED SOLR_SSL_RELOAD_ENABLED (
   set "SOLR_SSL_RELOAD_ENABLED=true"
 )
 
-REM Enable java security manager by default (limiting filesystem access and other things)
+REM Enable java security manager by default for Java 23 and before (limiting filesystem access and other things)
+IF !JAVA_MAJOR_VERSION! GEQ 24 (
+  set SOLR_SECURITY_MANAGER_ENABLED=false
+)
 IF NOT DEFINED SOLR_SECURITY_MANAGER_ENABLED (
   set SOLR_SECURITY_MANAGER_ENABLED=true
 )

solr/solr-ref-guide/modules/upgrade-notes/pages/major-changes-in-solr-9.adoc

@@ -74,6 +74,10 @@ Due to changes in Lucene 9, that isn't possible any more.
 SolrJ users not using SolrClients that use Apache HttpClient can safely exclude those dependencies.
 SolrJ users not using SolrClients that use Jetty HttpClient can safely exclude those dependencies.
 
+=== Java Security Manager
+
+Java has removed support for the Security Manager starting with Java 24; therefore, Solr will disable this feature when run with Java 24 or later. Solr previously used the Security Manager to provide an additional layer of protection against unintended file system access, network access, and process execution. Users upgrading to Java 24 or later should review their security practices and consider alternative measures, such as running Solr in containers or implementing additional operating system-level controls.
+
 == Solr 9.9
 
 === SolrJ