From a4b5e306884e8667e151dd3a30eb84452f5fdebf Mon Sep 17 00:00:00 2001
From: Weijun Wang <weijun@openjdk.org>
Date: Wed, 2 Sep 2015 19:20:46 +0800
Subject: [PATCH] 8129789: implies() of ServicePermission and
 DelegationPermission underspecified

Reviewed-by: mullan
---
 .../security/auth/kerberos/DelegationPermission.java  |  4 +++-
 .../security/auth/kerberos/ServicePermission.java     | 11 ++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/jdk/src/java.security.jgss/share/classes/javax/security/auth/kerberos/DelegationPermission.java b/jdk/src/java.security.jgss/share/classes/javax/security/auth/kerberos/DelegationPermission.java
index ac4bb0717c0..039dd79f468 100644
--- a/jdk/src/java.security.jgss/share/classes/javax/security/auth/kerberos/DelegationPermission.java
+++ b/jdk/src/java.security.jgss/share/classes/javax/security/auth/kerberos/DelegationPermission.java
@@ -132,7 +132,9 @@ public final class DelegationPermission extends BasicPermission
      * Checks if this Kerberos delegation permission object "implies" the
      * specified permission.
      * <P>
-     * If none of the above are true, {@code implies} returns false.
+     * This method returns true if this {@code DelegationPermission}
+     * is equal to {@code p}, and returns false otherwise.
+     *
      * @param p the permission to check against.
      *
      * @return true if the specified permission is implied by this object,
diff --git a/jdk/src/java.security.jgss/share/classes/javax/security/auth/kerberos/ServicePermission.java b/jdk/src/java.security.jgss/share/classes/javax/security/auth/kerberos/ServicePermission.java
index 0ae18e980e5..f20d2a47339 100644
--- a/jdk/src/java.security.jgss/share/classes/javax/security/auth/kerberos/ServicePermission.java
+++ b/jdk/src/java.security.jgss/share/classes/javax/security/auth/kerberos/ServicePermission.java
@@ -179,7 +179,16 @@ public final class ServicePermission extends Permission
      * Checks if this Kerberos service permission object "implies" the
      * specified permission.
      * <P>
-     * If none of the above are true, {@code implies} returns false.
+     * More specifically, this method returns true if all of the following
+     * are true (and returns false if any of them are not):
+     * <ul>
+     * <li> <i>p</i> is an instanceof {@code ServicePermission},
+     * <li> <i>p</i>'s actions are a proper subset of this
+     * {@code ServicePermission}'s actions,
+     * <li> <i>p</i>'s name is equal to this {@code ServicePermission}'s name
+     * or this {@code ServicePermission}'s name is "*".
+     * </ul>
+     *
      * @param p the permission to check against.
      *
      * @return true if the specified permission is implied by this object,