[solved]java vm cant find libjli.so when running as user

Farmboy · n00b Joined: 10 Jul 2011 Posts: 22

Hello,
here is my problem
I am running Gentoo on amd64(not sure that matters).

I emerge sun-jdk version 1.6.0_32.
I can run java -version as root and as user.

Then I set a capabilities flag on /opt/sun-jdk-1.6.0.32/bin/java
with the command
setcap 'CAP_NET_BIND_SERVICE=+ep' /opt/sun-jdk-1.6.0.32/bin/java

I can run java -version as root but not as user.
I get the error message that libjli.so cannot be loaded.

This lib resides in jre/lib/amd64/jli but java doesnt find it when run as user.

I copy the lib to /usr/local/lib64 and run ldconfig.
Now java -version hangs when run as user.

The same effect happen with oracle-jdk 1.7.0.4.
But when I copy the lib to /usr/local/lib64 I can run it as user.

So why is java not picking up the lib as user?
Any ideas?

Thanks for reading

anb.clarke · n00b Joined: 05 Apr 2006 Posts: 31

You have both sun-jdk 1.6 and oracle-jdk-bin 1.7. Does choosing the user vm defaults with eselect java-vm help in any way?

Farmboy · n00b Joined: 10 Jul 2011 Posts: 22

No it doesnt.
I already set the vm as user.

anb.clarke · n00b Joined: 05 Apr 2006 Posts: 31

The reason that capabilities don't seem to work with Java is that the Sun JDK apparently does not support Linux capabilities.(http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6919633).

ALTERNATIVES:
http://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l
http://splunk-base.splunk.com/answers/5037/using-setcap-to-allow-non-root-splunk-user-to-start-splunkweb-on-port-443

Farmboy · n00b Joined: 10 Jul 2011 Posts: 22

The JDK bug you linked is the exact same behaviour I am also getting.
But from reading the bug its not so much that the jdk doesnt support posix capabilities and more that due to the way the binary is build there is a problem resolving the library path. The net effect remains the same though.

The stackoverflow link you posted is the one where i got the idea with the capabilities from.

http://splunk-base.splunk.com/answers/5037/using-setcap-to-allow-non-root-splunk-user-to-start-splunkweb-on-port-443
gave me the following interesting tidbit:

Farmboy · n00b Joined: 10 Jul 2011 Posts: 22

I just tested out the workaround from the jdk bug report namely changing the rpath with patchelf and it works for me.