Score:0

Ubuntu

Permission denied trying to start a new process from a Java application as root user (with non-installed JDK)

snorbi

8/4/24, 9:23 AM

I try to start a new process using Java's ProcessBuilder, running as root user (during the prototyping phase).
It works as expected when I run the application using a JDK installed with apt.

My requirement is to allow to use custom JDKs downloaded on-demand. I thought that unpacking the JDK tar.gz file and marking the commands in the bin folder as executable would be enough to make this "unpacked" JDK usable:

-rwxr-xr-x 1 root 12328 Aug  3 22:33 java

But for some reason when I start the same application with this "unpacked" JDK's java command:

#!/usr/bin/env sh

export APP_HOME = "/opt/path/to/app"
export JAVA_HOME = "/opt/path/to/simply/unpacked/jdk"
$JAVA_HOME/bin/java -jar $APP_HOME/app.jar

I get the following error when trying to start a new process using ProcessBuilder, no matter what I try to execute (even very simple commands fail, like whoami):

Caused by: java.io.IOException: Cannot run program "/usr/bin/whoami" (in directory "/opt/..."): error=13, Permission denied
    at java.base/java.lang.ProcessBuilder.start(ProcessBuilder.java:1140)
    at java.base/java.lang.ProcessBuilder.start(ProcessBuilder.java:1074)
    at org.zeroturnaround.exec.ProcessExecutor.invokeStart(ProcessExecutor.java:997)
    ... 11 common frames omitted
Caused by: java.io.IOException: error=13, Permission denied
    at java.base/java.lang.ProcessImpl.forkAndExec(Native Method)
    at java.base/java.lang.ProcessImpl.<init>(ProcessImpl.java:319)
    at java.base/java.lang.ProcessImpl.start(ProcessImpl.java:249)
    at java.base/java.lang.ProcessBuilder.start(ProcessBuilder.java:1111)
    ... 13 common frames omitted

I have already tried two different JDKs (corretto and oracle) with the same result...

The Kotlin code is trivial, eg.:

    try {
        ProcessBuilder().command("/usr/bin/whoami").inheritIO().start().waitFor()
    } catch (e: Exception) {
        println("whoami failed")
    }

I use Ubuntu Server 22.04.2 LTS.

The system is a simple default installation of Ubuntu Server, one partition, no network drives, etc.
/opt is on the local disk as well:

$df -Th /opt/myapp/runtime

Filesystem                        Type  Size  Used Avail Use% Mounted on
/dev/mapper/ubuntu--vg-ubuntu--lv ext4   98G   23G   71G  25% /

The output of ls -l /usr/bin/whoami:

$ ls -l /usr/bin/whoami
-rwxr-xr-x 1 root root 31232 Feb  7  2022 /usr/bin/whoami

Ps.: I'm a Kotlin/Java developer and a simple Linux user, Ubuntu is my preferred development OS - but I'm not a Linux power-user :)

0 + 11

permissions

java

jdk

kanehekili

8/4/24, 9:29 AM

Assuming you are calling a bash/sh script from the ProcessBuilder: how does the first line of your executable file look like? Can you execute it in terminal?

snorbi

8/4/24, 9:33 AM

@kanehekili I edited the question to reflect that the execution of very simple commands (like `whoami`) fails, too. So I guess that executing more complex command would work as well when the cause of the problem is solved...

Marco

8/4/24, 9:47 AM

Are you using `sudo` to run the command as root? Is "/opt" mounted? Mount option of "/opt" ?

snorbi

8/4/24, 9:54 AM

"Is "/opt" mounted?" - I guess so because starting of the new process works if I run the same Java application using a `java` command installed by apt. "Mount option of "/opt" " - how can I check this?

snorbi

8/4/24, 10:19 AM

"Are you using sudo to run the command as root?" - no, I run it directly as root.

Marco

8/4/24, 10:52 AM

How is "$JAVA_HOME" mounted? Mount options of "$JAVA_HOME" ?

snorbi

8/4/24, 11:11 AM

@marco, sorry, I don't know what you mean... JAVA_HOME is simply set to an absolute path (`/opt/myapp/runtime/jdk-oracle-linux-x64-20.0.2`), like in my extracted example above.

Marco

8/4/24, 2:06 PM

is "/opt" on the local disk ? is it an own partition? add output of `df -Th "/opt/myapp/runtime"` to the question.

snorbi

8/4/24, 3:05 PM

@Marco, `/opt` is on local disk, there is only one partition as I know :). I added the output of `df`.

Marco

8/4/24, 3:50 PM

I am not a kotlin developer :-) I just tried with corretto-17 the same way as you described (besides the errors in the script). It worked.

Marco

8/4/24, 3:55 PM

can you add the output of `ls -l /usr/bin/whoami` to the question.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Permission denied trying to start a new process from a Java application as root user (with non-installed JDK)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.