[platform-dev] webstart and java 1.6.0_19(_20) problem

[Aleksander Grzebyk]

Hi,

I'm building webstart application (based on netbeans 6.7 platform) using nbm-maven-plugin (version 3.0).

I get Exception while running it on new jre version 1.6.0_19 (same problem on 1.6.0_20):

java.lang.SecurityException: attempt to add a Permission to a readonly Permissions object
at java.security.Permissions.add(Unknown Source)
at com.sun.deploy.security.CeilingPolicy.addTrustedPermissions(Unknown Source)
at com.sun.javaws.security.AppPolicy.addPermissions(Unknown Source)
at com.sun.jnlp.JNLPClassLoader.getTrustedCodeSources(Unknown Source)
at com.sun.deploy.security.CPCallbackHandler$ParentCallback.strategy(Unknown Source)
at com.sun.deploy.security.CPCallbackHandler$ParentCallback.openClassPathElement(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.getJarFile(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.access$700(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.ensureOpen(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.<init>(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$3.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath.getLoader(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at com.sun.jnlp.JNLPClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at org.netbeans.modules.apisupport.jnlplauncher.Main.main(Main.java:62)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at com.sun.javaws.Launcher.executeApplication(Unknown Source)
at com.sun.javaws.Launcher.executeMainClass(Unknown Source)
at com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
at com.sun.javaws.Launcher.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

If turn off newly added feature 'Mixed code security verification' in Java Control Panel application launches normally, same as running using older java versions.
(see http://java.sun.com/javase/6/docs/technotes/guides/jweb/mixed_code.html)

Initially I thought it was caused by having signed and unsigned jars in my webstart app -> just before this error mixed-code notification had been shown.

So I modified nbm-maven-plugin to sign everything using same key and mixed code notification was not shown anymore but same exception was still thrown.

I tried also to set property 'netbeans.jnlp.fixPolicy' from jnlp to 'false'.
I found out in netbeabs source code that if this property is set to true it causes jnlplaucher to override security and policy settings:
org.netbeans.modules.apisupport.jnlplauncher.Main.java:
...
f (Boolean.getBoolean("netbeans.jnlp.fixPolicy")) { // NOI18N
// Grant all the code all persmission
Policy.setPolicy(new RuntimePolicy());
// Replace the security manager by a fresh copy
// that does the delegation to the permissions system
// -- just to make sure that there is nothing left
// from the JWS
System.setSecurityManager(new SecurityManager());
}
...

It also did not help me. I didn't get the same exception, application started, window opened but I got lot of ClassNotFound exceptions. Classes from external libraries (like spring) were not found.
Example:

java.lang.ClassNotFoundException: org.springframework.context.ApplicationListener
at java.net.URLClassLoader$1.run(URLClassLoader.java:202)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:190)
at com.sun.jnlp.JNLPClassLoader.findClass(JNLPClassLoader.java:332)
at java.lang.ClassLoader.loadClass(ClassLoader.java:307)
at java.lang.ClassLoader.loadClass(ClassLoader.java:248)


Tried Netbeans 6.8,6.9-BETA and nbm-maven-plugin 3.2 ---> same SecurityException

According to http://java.sun.com/javase/6/docs/technotes/guides/jweb/mixed_code.html
adding Trusted-Library: true to every jar may help. But I have not idea how to do it on every internal module and external library.


Can anyone help me? I don't know what to try else or what causes the problem.
I think it's something related to mixed-code verification - turning it off helps.

Thanks in advance.


Regards

Alek,

[alisalimi]

Did you manage to fix this problem? I have the same problem.