openjdk team mailing list archive

[David Stenglein <stengleind@xxxxxxxxx>]

>> $ cat .java.policy
>this file is not part of a package. where does it come from?
>
>I cannot understand your statement about the security problem

In essence, without making these local (per-user) additions to the java
security policy within my account, an applet will not have permission to
load the pulseaudio library or read the actual file containing the
library.

This is not in a packaged file because I did not research where it
should go and that decision has repercussions for the security of the
system.

This ticket encompasses two different issues:

A) libpulse-java.so is in the wrong place, which will break all java applications that wish to use pulseaudio.
B) Java applets do not have permission to load native pulseaudio libraries and therefore will not be able to play audio

These issues are distinct from each other and perhaps should have been
reported separately. I found them together after a fair bit of work and
dumped everything here.

-- 
Java applet audio with pulseaudio broken (local apps likely broken)
https://bugs.launchpad.net/bugs/525883
You received this bug notification because you are a member of OpenJDK,
which is subscribed to openjdk-6 in ubuntu.

Status in “openjdk-6” package in Ubuntu: Incomplete

Bug description:
Binary package hint: openjdk-6-jre

Problem: No audio output from applets in firefox using pulseaudio.


charm% lsb_release -rd
Description:    Ubuntu 9.10
Release:        9.10

This bug is in a combination of packages:
 - openjdk-6-jre 6b16-1.6.1-3ubuntu1
 - openjdk-6-jre-lib 6b16-1.6.1-3ubuntu1
 - icedtea6-plugin 6b16-1.6.1-3ubuntu1

Examples:
  - Webex meetings
  - http://www.javazoom.net/applets/tinyplayer/tinyplayer.html

Doing some investigation, I found two things:

 - There is a security policy problem for applets using sound
 - There is a packaging problem with the location of the native pulse library for java

Working backwards using java stacktraces on stderr, I found the following permissions 
were necessary to get audio output from java:

$ cat .java.policy
grant {
  permission java.lang.RuntimePermission 
        "loadLibrary.pulse-java";
  permission java.io.FilePermission 
        "/usr/lib/jvm/java-6-openjdk/jre/lib/ext/i386/libpulse-java.so", "read";
};

Then, I found that the .so file didn't actually exist! Instead, it's in a different directory:

$ dpkg -L openjdk-6-jre | grep pulse
/usr/lib/jvm/java-6-openjdk/jre/lib/i386/libpulse-java.so

Making a symbolic link fixed everything and made it work:

$ ls -l /usr/lib/jvm/java-6-openjdk/jre/lib/ext/i386
lrwxrwxrwx 1 root root 7 2010-02-22 11:19 /usr/lib/jvm/java-6-openjdk/jre/lib/ext/i386 -> ../i386

I can't say how the policies should be managed for applets, but even regular java programs aren't likely to work until the packaging is fixed.

-Dave