How to grant all permissions to java applet through JNLP without popups

Question

We are launching an applet using jnlp The applet needs to load a native library The jar and the jnlp are signed with a self generated certificate. The jnlp grants all permission with

<security>
     <all-permissions/>
</security>

The policy file grants all permissions grant { permission java.security.AllPermission; };

We are getting a popup dialog “ java security warning” That says: this application is going to perform an insecure operation. Do you want to continue?

Continue or cancel (see attached screen shot)

There is no “allow always” button

Which means that the dialog pops up “every time” the applet is launched. This is annoying to the user.

What can be done to disable this dialog to pop up or to make it appear at most once?

Answer 1

We had a problem with the JNLP arguments actually. You cannot specify any argument in the JNLP jre args parameter otherwise you'll get the security warning.

To avoid security warning popup use the properties and JVM arguments from the lists located from line 638: http://javasourcecode.org/html/open-source/jdk/jdk-6u23/com/sun/deploy/config/Config.java.html

On your JNLP, if the JVM arguments include something that is not listed in there, you will get the popup even if you properly sign the certificate. It all boils down to using 'secured' parameters + a proper certificate and it will be ok.

EDIT

The URL was removed so here are the valid arguments:

// note: this list MUST correspond to native secure.c file
private static String[] secureVmArgs = {
    "-d32",                         /* use 32-bit data model if available */
    "-client",                      /* to select the "client" VM */
    "-server",                      /* to select the "server" VM */
    "-verbose",                     /* enable verbose output */
    "-version",                     /* print product version and exit */
    "-showversion",                 /* print product version and continue */
    "-help",                        /* print this help message */
    "-X",                           /* print help on non-standard options */
    "-ea",                          /* enable assertions */
    "-enableassertions",            /* enable assertions */
    "-da",                          /* disable assertions */
    "-disableassertions",           /* disable assertions */
    "-esa",                         /* enable system assertions */
    "-enablesystemassertions",      /* enable system assertions */
    "-dsa",                         /* disable system assertione */
    "-disablesystemassertions",     /* disable system assertione */
    "-Xmixed",                      /* mixed mode execution (default) */
    "-Xint",                        /* interpreted mode execution only */
    "-Xnoclassgc",                  /* disable class garbage collection */
    "-Xincgc",                      /* enable incremental gc. */
    "-Xbatch",                      /* disable background compilation */
    "-Xprof",                       /* output cpu profiling data */
    "-Xdebug",                      /* enable remote debugging */
    "-Xfuture",                     /* enable strictest checks */
    "-Xrs",                         /* reduce use of OS signals */
    "-XX:+ForceTimeHighResolution", /* use high resolution timer */
    "-XX:-ForceTimeHighResolution", /* use low resolution (default) */
    "-XX:+PrintGCDetails",          /* Gives some details about the GCs */
    "-XX:+PrintGCTimeStamps",       /* Prints GCs times happen to the start of the application */
    "-XX:+PrintHeapAtGC",           /* Prints detailed GC info including heap occupancy */
    "-XX:PrintCMSStatistics",       /* If > 0, Print statistics about the concurrent collections */
    "-XX:+PrintTenuringDistribution",  /* Gives the aging distribution of the allocated objects */
    "-XX:+TraceClassUnloading",     /* Display classes as they are unloaded */
    "-XX:SurvivorRatio",            /* Sets the ratio of the survivor spaces */
    "-XX:MaxTenuringThreshol",      /* Determines how much the objects may age */
    "-XX:CMSMarkStackSize",
    "-XX:CMSMarkStackSizeMax",
    "-XX:+CMSClassUnloadingEnabled",/* It needs to be combined with -XX:+CMSPermGenSweepingEnabled */
    "-XX:+CMSIncrementalMode",      /* Enables the incremental mode */
    "-XX:CMSIncrementalDutyCycleMin",  /* The percentage which is the lower bound on the duty cycle */
    "-XX:+CMSIncrementalPacing",    /* Automatic adjustment of the incremental mode duty cycle */
    "-XX:CMSInitiatingOccupancyFraction",  /* Sets the threshold percentage of the used heap */
    "-XX:+UseConcMarkSweepGC",      /* Turns on concurrent garbage collection */
    "-XX:-ParallelRefProcEnabled",
    "-XX:ParallelGCThreads",        /* Sets the number of parallel GC threads */
    "-XX:ParallelCMSThreads",
    "-XX:+DisableExplicitGC",       /* Disable calls to System.gc() */
    "-XX:+UseCompressedOops",       /* Enables compressed references in 64-bit JVMs */
    "-XX:+UseG1GC",
    "-XX:GCPauseIntervalMillis",
    "-XX:MaxGCPauseMillis"          /* A hint to the virtual machine to pause times */
};

EDIT

At the time we had these arguments:

    <j2se version="1.6.0+"
         initial-heap-size="${heap.init}"
         max-heap-size="${heap.max}"
         java-vm-args="-Djava.security.policy=${jnlp.ip}${jnlp.port}/ed/security/java.policy"/>

The problem was with -Djava.security.policy, and I couldn't understand the popup until I removed it from there.

NEW URL FOR java source jdk6.23

Answer 2

What can be done to disable this dialog to pop up or to make it appear at most once?

Use a certificate that has been verified by a trusted authority. Disabling/ignoring the 'always allow' field for self-signed certificates is a decision by Oracle that they are unlikely to change.

Answer 3

Using the remote debug parameters in JAVA_OPTS can cause this pop-up

-agentlib:jdwp=transport=dt_socket,address=localhost:8000,server=y,suspend=n

Answer 4

I had the following params and got the same problem:

-Xss4m -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5021

Removing them solved it.