Java WebStart permission differences between XP and Vista/Windows 7

Question

I am having an issue attempting to get a production Java WebStart application running on Windows Vista or on Windows 7. This WebStart application is trusted, and is supposed to have full privileges to read/write/load dlls and other native libraries.

It does all of this perfectly fine on Windows XP, however on Vista/Windows 7 it is failing to get access to certain dlls.

If I run the application locally apart from WebStart altogether, it IS able to access the dll.

I came across the following link: http://www.java.com/en/download/help/6000061000.xml

This basically explains that whether you like it or not, a WebStart application on Vista/Windows 7 will not and never will run with quite the same privileges.

Does anybody know a workaround for the elevated security apart from abandoning WebStart altogether? Has anybody else run into a similar issue and even if you didn't figure it out, what have you tried that hasn't worked? Any other suggestions are welcome too.

Answer 1

The issue is that despite an applet or webstart application with elevated privileges, they are ALL placed within the Java plugin cache under the LocalLow directory.

The LocalLow directory is set to Low Integrity in Vista and Windows 7.

What this means is that while the applet or web start application may have full read/write privileges on the machine, because the executables are running from a Low Integrity directory, they are only allowed access to files and folders that are Low Integrity as well.

My way of getting around this is I located the Java plugin cache folder under LocalLow and change its integrity level to Medium. Unless explicitly set or a system folder, all folders are considered Medium Integrity by default.

How did I do this? I downloaded and used a nifty command line tool called chml http://www.minasi.com/apps/ .

While I realize I created a security risk, I see it as localized to just Java plugin applications with All Permissions, essentially, it is no less secure than simply using XP, in fact more so because these java apps STILL cannot access system folders or resources.