If the kernel is configured with CONFIG_GRKERNSEC_HARDENED_WORKSTATION or CONFIG_GRKERNSEC_HARDEN_PTRACE java or java based applications will not execute normally. Javac compiles under root but not non-root user. Setting 0 to /proc/sys/kernel/grsecurity/harden_ptrace will cause java apps to un-stall themselves. Reproducible: Always Steps to Reproduce: 1.cd /usr/src/linux 2.make menuconfig 3.choose Security Level Hardened Gentoo [workstation] 4.emerge icedtea-bin 5.create simple HelloWorld.java 6.javac HelloWorld.java 6.emerge eclipse-sdk 7.execute eclipse-3.5 Actual Results: javac consumes 100% CPU and runs forever while compiling HelloWorld. eclipse-3.5 does not show splash screen echo 0 > /proc/sys/kernel/grsecurity/harden_ptrace un-stalls the processes Expected Results: javac compiles HelloWorld in <1 min eclipse-3.5 shows splash screen and continues normally I tested with dev-java/icedtea-bin-1.10.4, dev-java/icedtea-7.2.0-r3, dev-java/icedtea-7.2.0-r3. I tested with oracle-jdk-bin and same problem. _No warning_ in ebuilds about CONFIG_GRKERNSEC_HARDEN_PTRACE nor does the kernel warning about CONFIG_GRKERNSEC_HARDEN_PTRACE with java. Suggested fixes: If CONFIG_GRKERNSEC_HARDEN_PTRACE is enabled then add file containing echo 0 > /proc/sys/kernel/grsecurity/harden_ptrace && /etc/local.d/50_disable_hardened_ptrace.start && chmod +x /etc/local.d/50_disable_hardened_ptrace.start whenever a java vm is installed. Per executable CONFIG_GRKERNSEC_HARDEN_PTRACE exclusions but don't disable it systemwide but only affect spawned java process. Hardened Gentoo [java] level that inherits workstation but disables CONFIG_GRKERNSEC_HARDEN_PTRACE Special group to allow disabling CONFIG_GRKERNSEC_HARDEN_PTRACE like java group.
(In reply to Orson Teodoro from comment #0) > If the kernel is configured with CONFIG_GRKERNSEC_HARDENED_WORKSTATION or > CONFIG_GRKERNSEC_HARDEN_PTRACE java or java based applications will not > execute normally. Javac compiles under root but not non-root user. Setting > 0 to /proc/sys/kernel/grsecurity/harden_ptrace will cause java apps to > un-stall themselves. Same here. > Suggested fixes: Also variant: https://wiki.gentoo.org/wiki/Project:Hardened/PaX_flag_migration_from_PT_PAX_to_XATTR_PAX
