Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

.jinit() fails on Apple silicon with hardened run-time #267

Closed
ablaette opened this issue Jun 12, 2021 · 2 comments
Closed

.jinit() fails on Apple silicon with hardened run-time #267

ablaette opened this issue Jun 12, 2021 · 2 comments

Comments

@ablaette
Copy link

Thank you so much for rJava! The new Apple M1 chip is great, yet it is a challenge... I am sure you have seen already that the current rJava release (v1.0-4) does not pass CRAN checks: https://cran.r-project.org/web/checks/check_results_rJava.html

On my local Mac mini the error I get is as follows

library(rJava)
.jinit()

zsh: trace trap R

So the R session crashes entirely. I have tried with different versions of JDK (the Azul Zulu Builds), but the Java version does not make a difference.

Looking inside .jinit(), I can reconstruct this scenario for the R crash:

parameters <- getOption("java.parameters")
boot.classpath <- file.path(rJava:::.rJava.base.path, "java", "boot")
.External(rJava:::RinitJVM, boot.classpath, parameters)

I have also tried to install older versions of rJava, but the framework JavaVM is apparently missing from the latest versions of Xcode.

@s-u
Copy link
Owner

s-u commented Sep 2, 2021

TL;DR: instead of released R, use non-hardened R runtime from https://mac.R-project.org (same reason as https://mac.r-project.org/bin/macosx/RMacOSX-FAQ.html#I-cannot-attach-debugger-to-R )

trap usually means you are permission violation, i.e. the Apple security protection doesn't allow the action. Java uses JIT (just-in-time compiler) which modifies executable code in memory which is potentially unsafe action since exploits use this to modify valid code into malicious code. That's why by default the hardened run-times which are required for notarization of applications by Apple don't allow this modification. Hence macOS will kill process that tries to do that.

One way out is to not use hardened R run-time which is described in the FAQ above. Obviously it is less secure, but your only option at this point. For the next release of R we will consider a modification of the hardened run-time entitlements to allow JIT modifications if permitted by Apple., but it's not something you can do yourself nor can it be changed retrospectively.

@s-u s-u changed the title .jinit() fails on Apple silicon .jinit() fails on Apple silicon with hardened run-time Sep 2, 2021
@s-u
Copy link
Owner

s-u commented Sep 2, 2021

It appears that adding com.apple.security.cs.allow-jit=true to R entitlements does the trick. So you can use R-4.1.1-patched (or higher) from http://mac.R-project.org

@s-u s-u closed this as completed Sep 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants