JRuby

Cannot require 'ffi' if script itself doesn't have some unknown privilege

Details

  • Type: Bug Bug
  • Status: Open Open
  • Priority: Major Major
  • Resolution: Unresolved
  • Affects Version/s: JRuby 1.5.2
  • Fix Version/s: None
  • Component/s: Extensions
  • Labels:
    None
  • Environment:
    Windows 7, Java 1.6.0 Update 21 (32-bit and 64-bit)
  • Number of attachments :
    0

Description

A one-liner:

Unable to find source-code formatter for language: ruby. Available languages are: actionscript, html, java, javascript, none, sql, xhtml, xml
require 'ffi'

This gives the error below if the script itself is being run at reduced privileges. I have confirmed that granting the script AllPermission does make it work, and this is my recommended workaround at the moment. However, granting only the loadLibrary permission does not appear to be enough, for whatever reason.

Now, it might be reasonable to disallow the particular case of loading a library using FFI, as it might be considered a means of "cheating" to get a permission you're not supposed to have. If this is JRuby's stance then I will not disagree, however I think it would be more helpful if it worked like this:

  • Requiring 'ffi' itself should work no matter what, as the script itself is not trying to load a library. Loading the native part of jffi should be done with the permission context of JRuby (we grant JRuby full permissions in our deployments.)
  • Actually loading a library via FFI should fail with a SecurityException if (and only if ) the script's security context would have been rejected loading the same library using loadLibrary.
  • The RuntimePermission "loadLibrary" should be the only permission required in order to load any library through FFI, and as a side-effect of the previous mechanism it should be possible to specify a permission to load a single library if the policy file author so desired.

Initially reporting against JRuby itself, as I don't see jffi anywhere in the stack trace.

    file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:69:in `require': Could not load FFI Provider: FFI not available: null (LoadError)
 See http://jira.codehaus.org/browse/JRUBY-4583
	from file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:69
	from file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:1:in `require'
	from file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi.rb:1
	from file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi.rb:1:in `require'
	from <script>:1
org.jruby.embed.EvalFailedException: Could not load FFI Provider: FFI not available: null
 See http://jira.codehaus.org/browse/JRUBY-4583
	at org.jruby.embed.internal.EmbedEvalUnitImpl.run(EmbedEvalUnitImpl.java:127)
	at org.jruby.embed.jsr223.JRubyEngine.eval(JRubyEngine.java:89)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
Caused by: org.jruby.exceptions.RaiseException: Could not load FFI Provider: FFI not available: null
 See http://jira.codehaus.org/browse/JRUBY-4583
	at (unknown).new(file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:69)
	at Kernel.require(file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:69)
	at (unknown).(unknown)(file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:1)
	at Kernel.require(file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi.rb:1)
	at (unknown).(unknown)(file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi.rb:1)
	at Kernel.require(<script>:1)
	at (unknown).(unknown)(:1)
Script failed due to an error:
file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:69:in `require': Could not load FFI Provider: FFI not available: null
 See http://jira.codehaus.org/browse/JRUBY-4583 (LoadError)
	from file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:69
	from file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:1:in `require'
	from file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi.rb:1
	from file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi.rb:1:in `require'
	from <script>:1
	...internal jruby stack elided...
	from Kernel.require(file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:69)
	from (unknown).(unknown)(file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi/ffi.rb:1)
	from Kernel.require(file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi.rb:1)
	from (unknown).(unknown)(file:/C:/App/lib/jruby-complete.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/ffi.rb:1)
	from Kernel.require(<script>:1)
	from (unknown).(unknown)(:1)

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Charles Oliver Nutter added a comment -

You can log the security permission checks by providing the property java.security.debug=access. In your case, when it fails, you should see a failure and know what permissions need to be provided to allow FFI to load.

When I inspected it quickly, I found lots and lots of file read access checks from loading FFI's .rb libraries, and also the following native-lib-related permission checks:

access: access allowed (java.lang.RuntimePermission loadLibrary./Users/headius/projects/jruby/lib/native/Darwin/libjffi-1.0.jnilib)
access: access allowed (java.io.FilePermission /Users/headius/projects/jruby/lib/native/Darwin/libjffi-1.0.jnilib read)

Perhaps you did not provide a read FilePermission to go with the loadLibrary permission?

Show
Charles Oliver Nutter added a comment - You can log the security permission checks by providing the property java.security.debug=access. In your case, when it fails, you should see a failure and know what permissions need to be provided to allow FFI to load. When I inspected it quickly, I found lots and lots of file read access checks from loading FFI's .rb libraries, and also the following native-lib-related permission checks: access: access allowed (java.lang.RuntimePermission loadLibrary./Users/headius/projects/jruby/lib/native/Darwin/libjffi-1.0.jnilib) access: access allowed (java.io.FilePermission /Users/headius/projects/jruby/lib/native/Darwin/libjffi-1.0.jnilib read) Perhaps you did not provide a read FilePermission to go with the loadLibrary permission?
Hide
Permalink
Trejkaz added a comment -

Actually, it turns out to be simpler.

I specified "loadLibrary", and I needed "loadLibrary.". With "loadLibrary.", I can require 'ffi' with no issues.

So now the only problem is, when the permission isn't present, instead of getting a security exception that explains the problem, we get "FFI not available: null".

Show
Trejkaz added a comment - Actually, it turns out to be simpler. I specified "loadLibrary", and I needed "loadLibrary. ". With "loadLibrary. ", I can require 'ffi' with no issues. So now the only problem is, when the permission isn't present, instead of getting a security exception that explains the problem, we get "FFI not available: null".

People

  • Assignee:
    Unassigned
    Reporter:
    Trejkaz
Vote (0)
Watch (0)

Dates

  • Created:
    Updated: