java-native-access / java-native-access/jna

Failed to allocate closure when SELinux is enabled and non-root user is used

Open
#1,505 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
8.9k
Forks
1.7k
PR merge metrics
No merged PRs in 30d

Description

JNA fails to load a native library if SELinux is enabled and I run my code as a non-root user. I tested with Lazysodium for Java, but I don't think that this issue is specific to this particular library only.

Changing the SELinux mode to the permissive doesn't help and there is no record in /var/log/audit/audit.log.

If I run my code as root, the error won't occur. If I disable SELinux and I run my code as a non-root, the error won't occur either.

OS: Amazon Linux 2
System architecture: x86_64
Java: OpenJDK Runtime Environment (build 1.8.0_352-b08)
JNA version: 5.13.0

Stacktrace

Exception in thread "main" java.lang.UnsupportedOperationException: Failed to allocate closure
        at com.sun.jna.Native.registerMethod(Native Method)
        at com.sun.jna.Native.register(Native.java:1906)
        at com.sun.jna.Native.register(Native.java:1775)
        at com.goterl.resourceloader.SharedLibraryLoader.registerLibraryWithClasses(SharedLibraryLoader.java:81)
        at com.goterl.resourceloader.SharedLibraryLoader.load(SharedLibraryLoader.java:58)
        at com.goterl.lazysodium.utils.LibraryLoader.loadBundledLibrary(LibraryLoader.java:134)
        at com.goterl.lazysodium.utils.LibraryLoader.loadLibrary(LibraryLoader.java:95)
        at com.goterl.lazysodium.SodiumJava.<init>(SodiumJava.java:34)
        at com.goterl.lazysodium.SodiumJava.<init>(SodiumJava.java:23)

Steps to reproduce:

import com.goterl.lazysodium.SodiumJava;

public class JnaTest {

    public static void main(String[] args) {
        SodiumJava sodiumJava = new SodiumJava();
    }

}

Dependencies:

<dependency>
    <groupId>net.java.dev.jna</groupId>
    <artifactId>jna</artifactId>
    <version>5.13.0</version>
</dependency>
<dependency>
    <groupId>com.goterl</groupId>
    <artifactId>lazysodium-java</artifactId>
    <version>5.1.4</version>
</dependency>

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure on Amazon Linux 2 with SELinux enabled, as a non-root user, using JNA 5.13.0 and the provided Lazysodium example. Trace the failure from com.sun.jna.Native.registerMethod through Native.register and determine why closure allocation differs for this environment. Done means the native library loads successfully for the affected non-root configuration without weakening SELinux protections.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.