committing changes in /etc after apt run

Package changes:
-chromium-codecs-ffmpeg-extra 78.0.3904.108-0ubuntu0.18.04.1 amd64
+chromium-codecs-ffmpeg-extra 79.0.3945.79-0ubuntu0.18.04.1 amd64
-google-chrome-stable 79.0.3945.79-1 amd64
+google-chrome-stable 79.0.3945.88-1 amd64
-libpython2.7 2.7.15-4ubuntu4~18.04.2 amd64
-libpython2.7-minimal 2.7.15-4ubuntu4~18.04.2 amd64
-libpython2.7-stdlib 2.7.15-4ubuntu4~18.04.2 amd64
+libpython2.7 2.7.17-1~18.04 amd64
+libpython2.7-minimal 2.7.17-1~18.04 amd64
+libpython2.7-stdlib 2.7.17-1~18.04 amd64
-openjdk-11-jre 11.0.4+11-1ubuntu2~18.04.3 amd64
-openjdk-11-jre-headless 11.0.4+11-1ubuntu2~18.04.3 amd64
-openjdk-8-jdk 8u222-b10-1ubuntu1~18.04.1 amd64
-openjdk-8-jdk-headless 8u222-b10-1ubuntu1~18.04.1 amd64
-openjdk-8-jre 8u222-b10-1ubuntu1~18.04.1 amd64
-openjdk-8-jre-headless 8u222-b10-1ubuntu1~18.04.1 amd64
+openjdk-11-jre 11.0.5+10-0ubuntu1.1~18.04 amd64
+openjdk-11-jre-headless 11.0.5+10-0ubuntu1.1~18.04 amd64
+openjdk-8-jdk 8u232-b09-0ubuntu1~18.04.1 amd64
+openjdk-8-jdk-headless 8u232-b09-0ubuntu1~18.04.1 amd64
+openjdk-8-jre 8u232-b09-0ubuntu1~18.04.1 amd64
+openjdk-8-jre-headless 8u232-b09-0ubuntu1~18.04.1 amd64
-python2.7 2.7.15-4ubuntu4~18.04.2 amd64
-python2.7-minimal 2.7.15-4ubuntu4~18.04.2 amd64
+python2.7 2.7.17-1~18.04 amd64
+python2.7-minimal 2.7.17-1~18.04 amd64
-ubuntu-drivers-common 1:0.5.2.4 amd64
+ubuntu-drivers-common 1:0.5.2.5 amd64

diff --git a/alternatives/clhsdb b/alternatives/clhsdb
index 567a929f140f6a3fa1947b463048b9c3bd67bff4..bf8345796d2e752b3b330f4b8b9112a54e23bd38 120000 (symlink)
--- a/alternatives/clhsdb
+++ b/alternatives/clhsdb
@@ -1 +1 @@
-/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/clhsdb
\ No newline at end of file
+/usr/lib/jvm/java-8-openjdk-amd64/bin/clhsdb
\ No newline at end of file

diff --git a/alternatives/hsdb b/alternatives/hsdb
index 855fe864c7a571403934a5d252e780ad56c155e0..133f606f1c52dd89b79c771c0ebd31eca3b4c7f2 120000 (symlink)
--- a/alternatives/hsdb
+++ b/alternatives/hsdb
@@ -1 +1 @@
-/usr/lib/jvm/java-8-openjdk-amd64/jre/bin/hsdb
\ No newline at end of file
+/usr/lib/jvm/java-8-openjdk-amd64/bin/hsdb
\ No newline at end of file

diff --git a/java-11-openjdk/jfr/default.jfc b/java-11-openjdk/jfr/default.jfc
index 6164a4e1bc040c8ed78d0710917e023c7e32f9cf..04e02e93134fad34bb317b316fd7e08afe5114f7 100644 (file)
--- a/java-11-openjdk/jfr/default.jfc
+++ b/java-11-openjdk/jfr/default.jfc
@@ -588,6 +588,26 @@
       <setting name="threshold" control="socket-io-threshold">20 ms</setting>
     </event>
 
+    <event name="jdk.SecurityPropertyModification">
+       <setting name="enabled">false</setting>
+       <setting name="stackTrace">true</setting>
+    </event>
+
+    <event name="jdk.TLSHandshake">
+      <setting name="enabled">false</setting>
+      <setting name="stackTrace">true</setting>
+    </event>
+
+    <event name="jdk.X509Validation">
+       <setting name="enabled">false</setting>
+       <setting name="stackTrace">true</setting>
+    </event>
+
+    <event name="jdk.X509Certificate">
+       <setting name="enabled">false</setting>
+       <setting name="stackTrace">true</setting>
+    </event>
+
     <event name="jdk.JavaExceptionThrow">
       <setting name="enabled" control="enable-exceptions">false</setting>
       <setting name="stackTrace">true</setting>

diff --git a/java-11-openjdk/jfr/profile.jfc b/java-11-openjdk/jfr/profile.jfc
index 267064ad0ee6fc23ef2bf2411ba0cc086de9c300..fec835f14930923d351240f36641c9bccfd8b4e4 100644 (file)
--- a/java-11-openjdk/jfr/profile.jfc
+++ b/java-11-openjdk/jfr/profile.jfc
@@ -588,6 +588,26 @@
       <setting name="threshold" control="socket-io-threshold">10 ms</setting>
     </event>
 
+    <event name="jdk.SecurityPropertyModification">
+       <setting name="enabled">false</setting>
+       <setting name="stackTrace">true</setting>
+    </event>
+
+    <event name="jdk.TLSHandshake">
+      <setting name="enabled">false</setting>
+      <setting name="stackTrace">true</setting>
+    </event>
+
+    <event name="jdk.X509Validation">
+       <setting name="enabled">false</setting>
+       <setting name="stackTrace">true</setting>
+    </event>
+
+    <event name="jdk.X509Certificate">
+       <setting name="enabled">false</setting>
+       <setting name="stackTrace">true</setting>
+    </event>
+
     <event name="jdk.JavaExceptionThrow">
       <setting name="enabled" control="enable-exceptions">false</setting>
       <setting name="stackTrace">true</setting>

diff --git a/java-11-openjdk/security/java.security b/java-11-openjdk/security/java.security
index c6a2c2e9474c6abb24d57a10a9842454ba1fdd0b..0c87fe1191aded519dd3efdcf3ee3a3612fe4e6a 100644 (file)
--- a/java-11-openjdk/security/java.security
+++ b/java-11-openjdk/security/java.security
@@ -1064,6 +1064,24 @@ jceks.key.serialFilter = java.base/java.lang.Enum;java.base/java.security.KeyRep
 #
 #jdk.includeInExceptions=hostInfo
 
+#
+# Disabled mechanisms for the Simple Authentication and Security Layer (SASL)
+#
+# Disabled mechanisms will not be negotiated by both SASL clients and servers.
+# These mechanisms will be ignored if they are specified in the "mechanisms"
+# argument of "Sasl.createSaslClient" or the "mechanism" argument of
+# "Sasl.createSaslServer".
+#
+# The value of this property is a comma-separated list of SASL mechanisms.
+# The mechanisms are case-sensitive. Whitespaces around the commas are ignored.
+#
+# Note: This property is currently used by the JDK Reference implementation.
+# It is not guaranteed to be examined and used by other implementations.
+#
+# Example:
+#   jdk.sasl.disabledMechanisms=PLAIN, CRAM-MD5, DIGEST-MD5
+jdk.sasl.disabledMechanisms=
+
 #
 # Policies for distrusting Certificate Authorities (CAs).
 #
@@ -1094,3 +1112,51 @@ jceks.key.serialFilter = java.base/java.lang.Enum;java.base/java.security.KeyRep
 #
 jdk.security.caDistrustPolicies=SYMANTEC_TLS
 
+#
+# FilePermission path canonicalization
+#
+# This security property dictates how the path argument is processed and stored
+# while constructing a FilePermission object. If the value is set to true, the
+# path argument is canonicalized and FilePermission methods (such as implies,
+# equals, and hashCode) are implemented based on this canonicalized result.
+# Otherwise, the path argument is not canonicalized and FilePermission methods are
+# implemented based on the original input. See the implementation note of the
+# FilePermission class for more details.
+#
+# If a system property of the same name is also specified, it supersedes the
+# security property value defined here.
+#
+# The default value for this property is false.
+#
+jdk.io.permissionsUseCanonicalPath=false
+
+
+#
+# Policies for the proxy_impersonator Kerberos ccache configuration entry
+#
+# The proxy_impersonator ccache configuration entry indicates that the ccache
+# is a synthetic delegated credential for use with S4U2Proxy by an intermediate
+# server. The ccache file should also contain the TGT of this server and
+# an evidence ticket from the default principal of the ccache to this server.
+#
+# This security property determines how Java uses this configuration entry.
+# There are 3 possible values:
+#
+#  no-impersonate     - Ignore this configuration entry, and always act as
+#                       the owner of the TGT (if it exists).
+#
+#  try-impersonate    - Try impersonation when this configuration entry exists.
+#                       If no matching TGT or evidence ticket is found,
+#                       fallback to no-impersonate.
+#
+#  always-impersonate - Always impersonate when this configuration entry exists.
+#                       If no matching TGT or evidence ticket is found,
+#                       no initial credential is read from the ccache.
+#
+# The default value is "always-impersonate".
+#
+# If a system property of the same name is also specified, it supersedes the
+# security property value defined here.
+#
+#jdk.security.krb5.default.initiate.credential=always-impersonate
+

diff --git a/java-8-openjdk/security/java.policy b/java-8-openjdk/security/java.policy
index 769333c4b830e06bdb592b3ed8b2c86f2d76b632..ce437f105ef7e0b0a26fd14a37eaa60efb3006b8 100644 (file)
--- a/java-8-openjdk/security/java.policy
+++ b/java-8-openjdk/security/java.policy
@@ -95,5 +95,7 @@ grant {
         permission java.util.PropertyPermission "java.vm.version", "read";
         permission java.util.PropertyPermission "java.vm.vendor", "read";
         permission java.util.PropertyPermission "java.vm.name", "read";
+
+        permission java.util.PropertyPermission "sun.security.pkcs11.disableKeyExtraction", "read";
 };
 

diff --git a/java-8-openjdk/security/java.security b/java-8-openjdk/security/java.security
index 718f819aa0efa3c1bf19ada94464ed8271b0731d..de4e8f892155200db373f99e5e18ce47a5cd5609 100644 (file)
--- a/java-8-openjdk/security/java.security
+++ b/java-8-openjdk/security/java.security
@@ -1012,3 +1012,32 @@ jceks.key.serialFilter = java.lang.Enum;java.security.KeyRep;\
 # if this property is not enabled.
 #
 jdk.security.caDistrustPolicies=SYMANTEC_TLS
+
+#
+# Policies for the proxy_impersonator Kerberos ccache configuration entry
+#
+# The proxy_impersonator ccache configuration entry indicates that the ccache
+# is a synthetic delegated credential for use with S4U2Proxy by an intermediate
+# server. The ccache file should also contain the TGT of this server and
+# an evidence ticket from the default principal of the ccache to this server.
+#
+# This security property determines how Java uses this configuration entry.
+# There are 3 possible values:
+#
+#  no-impersonate     - Ignore this configuration entry, and always act as
+#                       the owner of the TGT (if it exists).
+#
+#  try-impersonate    - Try impersonation when this configuration entry exists.
+#                       If no matching TGT or evidence ticket is found,
+#                       fallback to no-impersonate.
+#
+#  always-impersonate - Always impersonate when this configuration entry exists.
+#                       If no matching TGT or evidence ticket is found,
+#                       no initial credential is read from the ccache.
+#
+# The default value is "always-impersonate".
+#
+# If a system property of the same name is also specified, it supersedes the
+# security property value defined here.
+#
+#jdk.security.krb5.default.initiate.credential=always-impersonate