title: Setting Java system properties without putting the values on the command line
body: <p>I have some Java code which depends on a system property <code>super.secret.password</code>. I need to set that property when i run my app. The app will be started by a shell script, and the password will be kept in a file with minimal read permissions.</p>
  
  <p>I really don't want to write:</p>
  
  <pre><code>java -Dsuper.secret.password=letmein gov.fortknox.MyApp
  </code></pre>
  
  <p>Because then anyone who can get on to the machine and run <code>ps</code> or <code>top</code> can see what the password is.</p>
  
  <p>So, is there a good way to set system properties without exposing them on the command line?</p>
  
  <p>The only generic solution we've come up with is to write a small C program which reads system properties from a file, then starts the JVM using the <a href="http://download.oracle.com/javase/6/docs/technotes/guides/jni/spec/invocation.html" rel="nofollow">JNI invocation API</a>. Needless to say, we are not keen to do this.</p>
  
  <p>If there isn't a way to set them without using the command line, is there a way to hide the command line from prying eyes? We're using Red Hat Enterprise Linux Server 5.5.</p>
  
  <p>For what it's worth, the app in question is actually JBoss EAP 4.3.0, and we're using the system properties to fill in substitution constructs (<code>${like.this}</code>) in its XML configuration files. There are JBoss-specific solutions - either use the <a href="http://docs.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3/html/Server_Configuration_Guide/Additional_Services-System_Properties_Management.html" rel="nofollow">SystemPropertiesService</a> (by default, configured through the properties-service.xml file in the deploy directory) or pass the <a href="http://docs.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3/html-single/Getting_Started_Guide/index.html#Starting_and_Stopping_the_Server-Using_run.sh" rel="nofollow">-P option</a> to run.sh. However, i am interested in the more general case, where this could be any Java program.</p>