{"action":"created","issue":{"url":"https://api.github.com/repos/Homebrew/brew/issues/64","repository_url":"https://api.github.com/repos/Homebrew/brew","labels_url":"https://api.github.com/repos/Homebrew/brew/issues/64/labels{/name}","comments_url":"https://api.github.com/repos/Homebrew/brew/issues/64/comments","events_url":"https://api.github.com/repos/Homebrew/brew/issues/64/events","html_url":"https://github.com/Homebrew/brew/issues/64","id":147286866,"number":64,"title":"Java tests (and maybe other `java` use) may fail under sandbox","user":{"login":"apjanke","id":2618447,"avatar_url":"https://avatars.githubusercontent.com/u/2618447?v=3","gravatar_id":"","url":"https://api.github.com/users/apjanke","html_url":"https://github.com/apjanke","followers_url":"https://api.github.com/users/apjanke/followers","following_url":"https://api.github.com/users/apjanke/following{/other_user}","gists_url":"https://api.github.com/users/apjanke/gists{/gist_id}","starred_url":"https://api.github.com/users/apjanke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apjanke/subscriptions","organizations_url":"https://api.github.com/users/apjanke/orgs","repos_url":"https://api.github.com/users/apjanke/repos","events_url":"https://api.github.com/users/apjanke/events{/privacy}","received_events_url":"https://api.github.com/users/apjanke/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-04-11T01:12:36Z","updated_at":"2016-04-11T01:32:32Z","closed_at":null,"body":"With newer releases of Java 1.7 and 1.8, it looks like most uses of `java` will fail under sandboxing with the JRE's default configuration.\r\n\r\nExample: the new test for neo4j is failing.\r\n\r\n```\r\n$ brew test --verbose neo4j\r\nTesting neo4j\r\n==> Using the sandbox\r\n/usr/bin/sandbox-exec -f /tmp/homebrew20160410-45054-1ru5j4o.sb /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/bin/ruby -W0 -I /usr/local/Library/Homebrew -- /usr/local/Library/Homebrew/test.rb /usr/local/Library/Taps/homebrew/homebrew-core/Formula/neo4j.rb --verbose\r\n==> /usr/local/Cellar/neo4j/2.3.3/bin/neo4j start\r\nStarting Neo4j Server.../private/tmp/neo4j20160410-45055-787qej/libexec/data/log/neo4j.log was missing, recreating...\r\nWARNING: not changing user\r\nprocess [45165]... waiting for server to be ready.. Failed to start within 120 seconds.\r\nNeo4j Server may have failed to start, please check the logs.\r\n==> Sandbox log\r\nApr 10 21:00:26 sandboxd[122]: java(45145) deny file-write-data /Users/janke/.oracle_jre_usage/42d8591bd1e10f3f.timestamp\r\nApr 10 21:00:26 sandboxd[122]: java(45147) deny file-write-data /Users/janke/.oracle_jre_usage/42d8591bd1e10f3f.timestamp\r\nApr 10 21:00:26 sandboxd[122]: java(45165) deny file-write-data /Users/janke/.oracle_jre_usage/42d8591bd1e10f3f.timestamp\r\nError: neo4j: failed\r\nFailed executing: /usr/local/Cellar/neo4j/2.3.3/bin/neo4j start\r\n/usr/local/Library/Homebrew/formula.rb:1481:in `block in system'\r\n/usr/local/Library/Homebrew/formula.rb:1418:in `open'\r\n/usr/local/Library/Homebrew/formula.rb:1418:in `system'\r\n/usr/local/Library/Taps/homebrew/homebrew-core/Formula/neo4j.rb:44:in `block in <class:Neo4j>'\r\n/usr/local/Library/Homebrew/formula.rb:1327:in `block in run_test'\r\n/usr/local/Library/Homebrew/extend/fileutils.rb:36:in `mktemp'\r\n/usr/local/Library/Homebrew/formula.rb:1323:in `run_test'\r\n/usr/local/Library/Homebrew/test.rb:28:in `block in <main>'\r\n/System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/ruby/2.0.0/timeout.rb:66:in `timeout'\r\n/usr/local/Library/Homebrew/test.rb:27:in `<main>'\r\n```\r\n\r\nThose writes to `/Users/janke/.oracle_jre_usage/` are from the [Java Usage Tracker](https://docs.oracle.com/javacomponents/usage-tracker/overview/) which was recently introduced, and seems to be enabled by default in the current JDKs on OS X.\r\n\r\nIt does not seem to respect the `$HOME` environment variable. Looks like it's doing a `getpwent` instead, so it always goes to the actual home directory even if `$HOME` is set.\r\n\r\nChanging this behavior on a per-program basis would require setting Java system properties inside launch scripts, which sounds like a pain. I think we should consider whitelisting this specific directory under our sandbox for build and test."},"comment":{"url":"https://api.github.com/repos/Homebrew/brew/issues/comments/208111852","html_url":"https://github.com/Homebrew/brew/issues/64#issuecomment-208111852","issue_url":"https://api.github.com/repos/Homebrew/brew/issues/64","id":208111852,"user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"created_at":"2016-04-11T01:32:32Z","updated_at":"2016-04-11T01:32:32Z","body":"This problem is why `ENV.java_cache` exists. Try setting that inside `test do` and see if it works."}}