Sandbox Violation on Runtime Exec

[David DeHaven]

> To make sure I'm understanding.
> So Runtime exec is broken sandboxed period? No matter what is done with Runtime?

I'm not intimately familiar with what Runtime does so can't really comment on that.


> There would be no way to give the application a entitlement correcting the
> deny file-read-data /dev/fad
> as a work-around? (That would not result in the application being rejected App Store).

The short term (ugly) workaround would be to use a JNI call to invoke posix_spawn or NSTask directly, I don't see any other way if Runtime is absolutely unusable.


>> If only I'd thought of that earlier this year when I was looking at this stuff…
> 
> Curious. If the above is true. None of the jdk standard tests catch that Runtime is broken? Or the tests haven't been run yet sandboxed because that support hasn't got far enough along to be figured in for full test runs?

Sandboxing is still a very new concept in terms of JDK development. I did a round of testing and filed issues earlier this year (because of my history as a Mac developer), specifically because Apple now requires sandboxed apps in the App store but this is one case I did not think of during testing. I suspect it will become more of a priority considering Windows 8 will have sandboxing as well. I don't work on the JDK though (JavaFX team) so I can't really comment beyond idle speculation and making general suggestions.

-DrD-