How to pass 'unsafe' arguments to the JVM of a Java Webstart application

Question

My Java Webstart application runs in a controlled trusted environment. This is a closed internal network where I have some control on how the application is started.

How can I pass JVM arguments to the application, even if they are considered 'unsecure' for use by webstart by the JVM?

Brady

Answer 1

There are several options to pass JVM arguments to webstart.

1. Through JNLP file.
2. Through the JAVA_TOOL_OPTIONS environment variable.
3. Through the deployment settings on the local computer.
4. Through the javaws command (I was unable to get this to work).

Note that I have included links to the java 8 version of this documentation. All of these ideas are supported and documented in other Java versions, however sometimes they work a tiny bit different, or have slightly changed restrictions.

Through JNLP file.

The JNLP supports many JVM arguments through the JNLP file. Some can be done though direct settings, such as initial-heap-size and max-heap-size. For other settings java-vm-args can be used.

The JNLP File Syntax documentation lists some supported java-vm-args for 'this version' however it is unsure if that is the version 1.4+ of the example, or JRE 8. I know some unlisted settings are actually supported, such as -XX:MaxGCPauseMillis and activating the G1 garbage collector. You can make a JNLP and then use jinfo -flag MaxGCPauseMillis <pid> to test if a setting has been correctly propagated.

This is the preferred method, because it does not require any direct control of the JVM. The down-side is that only supports specific parameters that are considered 'safe'.

Through the JAVA_TOOL_OPTIONS environment variable

When you start Java Webstart by using the javaws command, you can use the JAVA_TOOL_OPTIONS to set any parameter you want on all JVM started from that environment.

So in Linux you can do to set an unsupported parameter:

export JAVA_TOOL_OPTIONS=-XX:SoftRefLRUPolicyMSPerMB=2000
javaws <my jnlp>

Note that this will affect all java applications ran with this system variable. So setting this for all users, or a specific user should be done with great care. Setting this only for a single application as the example above is much safer.

The advantage of this solution is that you can pass any parameter you want. The downside is that it requires a specific way of launching the application, or a very broad setting. It also requires control over the client system.

Through the deployment settings on the local computer

You can also pass JVM arguments by changing the deployment settings of the JVM. This can be done through the Java Control Panel, which allows you to set default runtime settings.

If you want to automate these settings you can use the deployment properties file. Unfortunately the JRE specific section of this file is undocumented. Manually it is very easy to adapt this file:

deployment.javaws.jre.0.args=-XX\:SoftRefLRUPolicyMSPerMB\=2000

When automating this file, you have to watch very carefully that it contains these settings for all detected JVMs, so you have to be sure to change the correct one. Also this will be used for all Webstart and applets on your system.

Through the javaws command (I was unable to get this to work)

There should be another way (besides the JAVA_TOOL_OPTIONS method) to change the parameters using the command line. The javaws documentation lists the -J option to pass arguments to the JVM, for example by running your JNLP as follows:

javaws -J-XX:SoftRefLRUPolicyMSPerMB=2000 <my jnlp>

However I have not been able to get this to actually set the JVM parameters.

Brady