Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 400951 - Java does not run properly on non-root with Grsecurity Hardened Gentoo [workstation] level
Summary: Java does not run properly on non-root with Grsecurity Hardened Gentoo [works...
Status: RESOLVED OBSOLETE
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: The Gentoo Linux Hardened Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-01-26 19:28 UTC by Orson Teodoro
Modified: 2019-02-07 11:56 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Orson Teodoro 2012-01-26 19:28:36 UTC
If the kernel is configured with CONFIG_GRKERNSEC_HARDENED_WORKSTATION or CONFIG_GRKERNSEC_HARDEN_PTRACE java or java based applications will not execute normally.  Javac compiles under root but not non-root user.  Setting 0 to /proc/sys/kernel/grsecurity/harden_ptrace will cause java apps to un-stall themselves.

Reproducible: Always

Steps to Reproduce:
1.cd /usr/src/linux
2.make menuconfig
3.choose Security Level Hardened Gentoo [workstation]
4.emerge icedtea-bin
5.create simple HelloWorld.java
6.javac HelloWorld.java

6.emerge eclipse-sdk
7.execute eclipse-3.5
Actual Results:  
javac consumes 100% CPU and runs forever while compiling HelloWorld.
eclipse-3.5 does not show splash screen
echo 0 > /proc/sys/kernel/grsecurity/harden_ptrace un-stalls the processes

Expected Results:  
javac compiles HelloWorld in <1 min
eclipse-3.5 shows splash screen and continues normally

I tested with dev-java/icedtea-bin-1.10.4, dev-java/icedtea-7.2.0-r3, dev-java/icedtea-7.2.0-r3. I tested with oracle-jdk-bin and same problem.
_No warning_ in ebuilds about CONFIG_GRKERNSEC_HARDEN_PTRACE nor does the kernel warning about CONFIG_GRKERNSEC_HARDEN_PTRACE with java.

Suggested fixes:

If CONFIG_GRKERNSEC_HARDEN_PTRACE is enabled then add file containing
echo 0 > /proc/sys/kernel/grsecurity/harden_ptrace && /etc/local.d/50_disable_hardened_ptrace.start && chmod +x /etc/local.d/50_disable_hardened_ptrace.start
whenever a java vm is installed.

Per executable CONFIG_GRKERNSEC_HARDEN_PTRACE exclusions but don't disable it systemwide but only affect spawned java process.

Hardened Gentoo [java] level that inherits workstation but disables CONFIG_GRKERNSEC_HARDEN_PTRACE

Special group to allow disabling CONFIG_GRKERNSEC_HARDEN_PTRACE like java group.
Comment 1 Andrey Aleksandrovich 2014-03-30 12:43:25 UTC
(In reply to Orson Teodoro from comment #0)
> If the kernel is configured with CONFIG_GRKERNSEC_HARDENED_WORKSTATION or
> CONFIG_GRKERNSEC_HARDEN_PTRACE java or java based applications will not
> execute normally.  Javac compiles under root but not non-root user.  Setting
> 0 to /proc/sys/kernel/grsecurity/harden_ptrace will cause java apps to
> un-stall themselves.

Same here.

> Suggested fixes:
Also variant: https://wiki.gentoo.org/wiki/Project:Hardened/PaX_flag_migration_from_PT_PAX_to_XATTR_PAX