Bug #397
closed
App is missing file access rights on OSX 10.9/10.10 (JNLP)
Added by Benedikt Biallowons over 9 years ago.
Updated over 9 years ago.
Description
Die App startet nicht bei einem schreibgeschütztem Homeverzeichnis (mit falscher Fehlermeldung), da hier das ~/.openecard Verzeichnis und die darin enthaltenen Daten nicht angelegt werden können. Dieser Fehler tritt beispielsweise beim Deployment über JNLP im Safari > 6 (OS X 10.9) auf, da hier Webstart-Applikationen in der Default-Einstellung lediglich der Zugriff auf temporäre Verzeichnisse erlaubt wird (unabhängig von dem "all-permissions"-Tag im JNLP Descriptor).
Files
- Description updated (diff)
- Subject changed from Fehler bei schreibgeschütztem Homeverzeichnis to App is missing file access rights on OSX 10.9 (JNLP)
I suppose the app should handle the fact that there is no access to the home directory.
This might be some work to find all occurrences where this happens.
In general this is a Problem we should try to solve, because JNLP deployments are still the anticipated way of deploying the app. Is there any possibility to get the proper rights?
When making the directory readonly the app starts, though it is not usable for authentication.
In order to fix this I need a stacktrace, so I can see where the security error comes from. Try getting one with the console available in webstart.
Please try with the version available under http://jnlp.openecard.org/dev/ which contains a first fix.
I suppose this will still fail, so please provide a stacktrace, so we can add further fixes.
Still failing, trace attached
- Subject changed from App is missing file access rights on OSX 10.9 (JNLP) to App is missing file access rights on OSX 10.9/10.10 (JNLP)
The main problem is, that Apple implemented an additional restriction layer on top of Java's own permission (via JNLP descriptor) settings: https://support.apple.com/en-us/HT202819. If a JNLP application started via the Java deployment tookit (which uses the Java browser plugin) tries to access files other than in Java temp files directory (java.io.tmpdir) it will be blocked. A user has to (manually) give the access rights to the whole file system via the "Run in Unsafe Mode" mode in Safari's Java security settings.
- Status changed from New to Rejected
Bug not correctable. Solution is to create an App bundle for local installation.
Also available in: Atom
PDF