# [...] CONTENT FROM UPSTREAM java.security

#
# System-wide crypto-policies
#
# All the FIPS-mode setup is controlled by the FIPS crypto policy. In order
# to disable the FIPS-mode alignment between RHEL and OpenJDK, just disable
# the crypto-policies, which are enabled by default.
#
# The jdk.security.useSystemCryptoPolicies system property controls the
# crypto-policies (and the FIPS alignment) on a per-run basis. Pass
# -Djdk.security.useSystemCryptoPolicies=false to disable the system
# policies.
#
# The $JAVA_HOME/conf/security directory contains the following symlinks:
#   useSystemCryptoPolicies=false -> /dev/null
#   useSystemCryptoPolicies=true  -> /etc/crypto-policies/back-ends/java.config
#   useSystemCryptoPolicies=      -> useSystemCryptoPolicies=true
# The last symlink is used when the jdk.security.useSystemCryptoPolicies
# system property isn't defined, determining the default-choice (true).
#
# To disable the system policies for any application running on this JDK
# deployment, change the default-choice symlink as follows:
#   useSystemCryptoPolicies=      -> useSystemCryptoPolicies=false
# This can be achieved with the following command:
#   ln -fs "useSystemCryptoPolicies=false" \
#          "$JAVA_HOME/conf/security/useSystemCryptoPolicies="
# With that change, applications can still re-enable the system policies,
# by passing -Djdk.security.useSystemCryptoPolicies=true.
#
# To disable the jdk.security.useSystemCryptoPolicies system property,
# modify the following include directive as appropriate. Directly include
# /etc/crypto-policies/back-ends/java.config to force-enable the system
# policies. Remove or comment out the include directive to force-disable
# the system policies.
#
include useSystemCryptoPolicies=${jdk.security.useSystemCryptoPolicies}
#       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# WARNING: anything placed after this include directive will apply on top
# of the system-wide crypto-policies. Adding properties below this section
# is strongly discouraged, as it poses a risk of overriding the system
# policies or invalidating the FIPS deployment.

Absolute symlink -> '/dev/null'

# Alternative (requires adapting the java.security documentation):
an empty file

Absolute symlink -> '/etc/crypto-policies/back-ends/java.config'

# Alternative (requires adapting the java.security documentation):
include /etc/crypto-policies/back-ends/java.config

Relative symlink -> 'useSystemCryptoPolicies=true'

# Alternative (requires adapting the java.security documentation):
include useSystemCryptoPolicies=true

# Trigger OpenJDK FIPS setup
include ${java.home}/conf/security/java.security.fips

# [...] REST OF THE FILE CONTENT UNCHANGED 

#
# Let the downstream-specific code know that FIPS-mode is turned on
#
$fips$=true

#
# FIPS-mode on Security Providers List
#
security.provider.1=SunPKCS11 ${java.home}/conf/security/SunPKCS11-FIPS.cfg
security.provider.2=SUN
security.provider.3=SunEC
security.provider.4=SunJSSE
security.provider.5=SunJCE
security.provider.6=SunRsaSign
security.provider.7=XMLDSig
security.provider.8=
#                   ^ empty on purpose, to finish the Providers List

#
# FIPS-mode on default keystore type
#
keystore.type=pkcs12

name = FIPS
library = ${java.home}/lib/libnssadapter.so
slot = 3
nssUseSecmod = false
attributes(*,CKO_SECRET_KEY,*)={ CKA_SIGN=true CKA_ENCRYPT=true }