Merge pull request #1764 from newrelic/jfr-with-hsm

Disallow JFR when HSM is enabled
newrelic · Feb 27, 2024 · ba1bd5b · ba1bd5b
2 parents ae03a7c + 3bb83a3
commit ba1bd5b
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/newrelic-agent/src/main/java/com/newrelic/agent/jfr/JfrService.java b/newrelic-agent/src/main/java/com/newrelic/agent/jfr/JfrService.java
@@ -88,10 +88,13 @@ void startJfrLoop() throws JfrRecorderException {
     @Override
     public final boolean isEnabled() {
         final boolean enabled = jfrConfig.isEnabled();
+        boolean isHighSecurity = defaultAgentConfig.isHighSecurity();
         if (!enabled) {
             Agent.LOG.log(Level.INFO, "New Relic JFR Monitor is disabled: JFR config has not been enabled in the Java agent.");
+        } else if (isHighSecurity) {
+            Agent.LOG.log(Level.INFO, "New Relic JFR Monitor is enabled but High Security mode is also enabled; JFR will not be activated.");
         }
-        return enabled;
+        return enabled && !isHighSecurity;
     }
 
     @Override

diff --git a/newrelic-agent/src/test/java/com/newrelic/agent/jfr/JfrServiceTest.java b/newrelic-agent/src/test/java/com/newrelic/agent/jfr/JfrServiceTest.java
@@ -105,6 +105,21 @@ public void jfrLoopDoesNotStartWhenIsEnabledIsFalse() throws JfrRecorderExceptio
         assertFalse(spyJfr.isEnabled());
         verify(spyJfr, times(0)).startJfrLoop();
     }
+
+    @Test
+    public void jfrLoopDoesNotStartWhenIsEnabledIsTrueAndHighSecurityIsTrue() throws JfrRecorderException {
+        JfrService jfrService = new JfrService(jfrConfig, agentConfig);
+        JfrService spyJfr = spy(jfrService);
+        when(agentConfig.isHighSecurity()).thenReturn(true);
+        when(jfrConfig.isEnabled()).thenReturn(true);
+        when(spyJfr.coreApisExist()).thenReturn(true);
+
+        spyJfr.doStart();
+
+        assertFalse(spyJfr.isEnabled());
+        verify(spyJfr, times(0)).startJfrLoop();
+    }
+
     @Category( IBMJ9IncompatibleTest.class )
     @Test
     public void jfrLoopDoesStart() {