Deploying Java 7 with exceptions

Recent changes  to the Java security model have broken a few things…..

There are now more and stricter security restrictions when runnng Java applets and JSP files. What this ends up doing is breaking things which as a system administrator we have no control over. There could be intranet or internet services that your users use that rely on Java but do not meet the new security requirements.

 

Oracle does provide a way of dealing with this by adding sites to an exception list.

 

This can be done at deployment time with deployment.properties to setup a networked based exception.sites file that all users will use. A enterprise wide exception file might be OK for some people but the users will lose the ablity to add any new exceptions themselves. More details about this method can be found here.

<a href="http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/security/exception_site_list.html" rel="nofollow noopener">http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/security/exce...</a>

 

The other option is for users to manage thier own exception.sites list from the java control panel. This seems reasonable but if there are known exceptions it would be nice to add them at deployment time.

 

Since neither of theses options was what I needed it was time to cook up somthing new. I want the users to be able to manage their own lists, but it needs to start with the known exceptions already in it. I created a powershell script to add the exceptions to the file for all users. This worked ok but it ended up changing the permissions on the file so users would not be able to edit the list. You could work around that, changing the permissions back after editing the file but what happens when a new user logs in? They wouldn't get the exceptions.  A login script is certainly a possibility, but the script really only needs to run once per user.

What I ended up doing is modifiying the script to only update the current users exception.sites file. I then added an active setup entry for java at install time. What this does is run the userconfig script the first time each user logs in after java is installed.

 

I used the powershell function below to add the registry entries for active setup:

 

Function PerUserConfig ($ConfName, $ConfPath){

#Add Required registry keys and values for the defined file to run once for each user the next file they logon

reg add "HKLM\Software\Microsoft\Active Setup\Installed Components\{$confName}" /ve /d "$ConfName" /f

reg add "HKLM\Software\Microsoft\Active Setup\Installed Components\{$ConfName}" /v ComponentID /d "$ConfName" /f

reg add "HKLM\Software\Microsoft\Active Setup\Installed Components\{$ConfName}" /v Version /d "1" /f

reg add "HKLM\Software\Microsoft\Active Setup\Installed Components\{$ConfName}" /v IsInstalled /t REG_DWORD /d "1" /f

reg add "HKLM\Software\Microsoft\Active Setup\Installed Components\{$ConfName}" /v StubPath /d "cmd /c $ConfPath" /f

}

 

Then added this line to my java installation script:

PerUserConfig "Java7_u65"  "C:\PROGRA~2\Java\jre7\userconfig.bat"

 

The userconfig.bat just calls userconfig.ps1

 

userconfig.ps1

 

####////////////////////////////cut////////////////////////////

 

#Java 7 exception appender for use with java deployment package

#By: JAW

 

#Set this array to hold the site strings you want to ensure are included in each user's Java Site Exception List.

$requiredSiteExceptions = "<a href="https://jawtech.com/&quot;" rel="nofollow noopener">https://jawtech.com/"</a>, "Turf-mail.com/"

 

#test if java 7 is installed

if( (test-path "C:\Program Files (x86)\Java\jre7") -eq $true){

 $user = $env:USERPROFILE

 

#check for existing exceptions file and read if required

if( (test-path "$user\AppData\LocalLow\Sun\Java\Deployment\security\exception.sites") -eq $true){

 

$originalList = @(get-content -path "$user\AppData\LocalLow\Sun\Java\Deployment\security\exception.sites")}

 

$dir = "$user\AppData\LocalLow\Sun\Java\Deployment\security"

$path =  "$user\AppData\LocalLow\Sun\Java\Deployment\security\exception.sites"

#add required exceptions array to existing list

$newlist =  $originalList + $requiredSiteExceptions

#remove duplicates

$newlist = $newlist | sort -Unique

#verify path exists, if user has not logged in since java install folders may not exist, create if required

if (!(test-path($dir))) { mkdir $dir  }

#save updated list

$UTF8_No_BOM = New-Object System.Text.UTF8Encoding($False)

[System.IO.File]::WriteAllLines($path,$newlist,$UTF8_No_BOM)

#log results to screen

write-host "Java exceptions added for $user"

 

 

}

else

#java was not installed or is not in standard location, log results and exit.

{

Write-host "Java 7 is not installed or not in standard location. Exceptions not added."

 

}

 

 

###//////////////////////end cut/////////////////////////

 

 

Tags: