committing changes in /etc made by "/usr/bin/apt full-upgrade -y"

Package changes:
-evince 3.36.5-0ubuntu1 amd64
-evince-common 3.36.5-0ubuntu1 all
+evince 3.36.7-0ubuntu1 amd64
+evince-common 3.36.7-0ubuntu1 all
-gir1.2-evince-3.0 3.36.5-0ubuntu1 amd64
+gir1.2-evince-3.0 3.36.7-0ubuntu1 amd64
-gnome-control-center 1:3.36.3-0ubuntu1 amd64
-gnome-control-center-data 1:3.36.3-0ubuntu1 all
+gnome-control-center 1:3.36.4-0ubuntu1 amd64
+gnome-control-center-data 1:3.36.4-0ubuntu1 all
-libevdocument3-4 3.36.5-0ubuntu1 amd64
+libevdocument3-4 3.36.7-0ubuntu1 amd64
-libevview3-3 3.36.5-0ubuntu1 amd64
+libevview3-3 3.36.7-0ubuntu1 amd64
-libnss-myhostname 245.4-4ubuntu3.1 amd64
-libnss-systemd 245.4-4ubuntu3.1 amd64
+libnss-myhostname 245.4-4ubuntu3.2 amd64
+libnss-systemd 245.4-4ubuntu3.2 amd64
-libpam-systemd 245.4-4ubuntu3.1 amd64
+libpam-systemd 245.4-4ubuntu3.2 amd64
-libsystemd0 245.4-4ubuntu3.1 amd64
+libsystemd0 245.4-4ubuntu3.2 amd64
-libudev1 245.4-4ubuntu3.1 amd64
-libudev1 245.4-4ubuntu3.1 i386
+libudev1 245.4-4ubuntu3.2 amd64
+libudev1 245.4-4ubuntu3.2 i386
-openjdk-11-jre 11.0.7+10-3ubuntu1 amd64
-openjdk-11-jre-headless 11.0.7+10-3ubuntu1 amd64
+openjdk-11-jre 11.0.8+10-0ubuntu1~20.04 amd64
+openjdk-11-jre-headless 11.0.8+10-0ubuntu1~20.04 amd64
-python-apt 2.0.0 amd64
-python-apt-common 2.0.0 all
+python-apt 2.0.0ubuntu0.20.04.1 amd64
+python-apt-common 2.0.0ubuntu0.20.04.1 all
-python3-apt 2.0.0 amd64
+python3-apt 2.0.0ubuntu0.20.04.1 amd64
-python3-distupgrade 1:20.04.21 all
+python3-distupgrade 1:20.04.23 all
-systemd 245.4-4ubuntu3.1 amd64
-systemd-container 245.4-4ubuntu3.1 amd64
+systemd 245.4-4ubuntu3.2 amd64
+systemd-container 245.4-4ubuntu3.2 amd64
-systemd-sysv 245.4-4ubuntu3.1 amd64
+systemd-sysv 245.4-4ubuntu3.2 amd64
-ubuntu-release-upgrader-core 1:20.04.21 all
+ubuntu-release-upgrader-core 1:20.04.23 all
-udev 245.4-4ubuntu3.1 amd64
+udev 245.4-4ubuntu3.2 amd64

diff --git a/java-11-openjdk/security/default.policy b/java-11-openjdk/security/default.policy
index 2c11f4665cfd5e521f35396230a2481a4d335fd6..694e403dd5c9b75eb9d7eb851c63c9f5f74e81ec 100644 (file)
--- a/java-11-openjdk/security/default.policy
+++ b/java-11-openjdk/security/default.policy
@@ -162,10 +162,14 @@ grant codeBase "jrt:/jdk.internal.vm.compiler" {
 };
 
 grant codeBase "jrt:/jdk.internal.vm.compiler.management" {
-    permission java.lang.RuntimePermission "accessClassInPackage.org.graalvm.compiler.hotspot";
+    permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.vm.compiler.collections";
     permission java.lang.RuntimePermission "accessClassInPackage.jdk.vm.ci.runtime";
-    permission java.lang.RuntimePermission "accessClassInPackage.sun.management.spi";
-    permission java.lang.RuntimePermission "sun.management.spi.PlatformMBeanProvider.subclass";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.graalvm.compiler.core.common";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.graalvm.compiler.debug";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.graalvm.compiler.hotspot";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.graalvm.compiler.options";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.graalvm.compiler.phases.common.jmx";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.graalvm.compiler.serviceprovider";
 };
 
 grant codeBase "jrt:/jdk.jsobject" {

diff --git a/java-11-openjdk/security/java.security b/java-11-openjdk/security/java.security
index e922ef3e5be9d76d5e854387fb6e0d6c73dc7c94..788ee8431e5db698731ba69e93b94beef43b7bd2 100644 (file)
--- a/java-11-openjdk/security/java.security
+++ b/java-11-openjdk/security/java.security
@@ -1195,3 +1195,15 @@ jdk.io.permissionsUseCanonicalPath=false
 #
 #jdk.security.krb5.default.initiate.credential=always-impersonate
 
+#
+# Trust Anchor Certificates - CA Basic Constraint check
+#
+# X.509 v3 certificates used as Trust Anchors (to validate signed code or TLS
+# connections) must have the cA Basic Constraint field set to 'true'. Also, if
+# they include a Key Usage extension, the keyCertSign bit must be set. These
+# checks, enabled by default, can be disabled for backward-compatibility
+# purposes with the jdk.security.allowNonCaAnchor System and Security
+# properties. In the case that both properties are simultaneously set, the
+# System value prevails. The default value of the property is "false".
+#
+#jdk.security.allowNonCaAnchor=true