Home/ Questions/Q 8561687
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-11T16:33:26+00:00

So I have the following problem: I have a web service running inside a

  • 0

So I have the following problem: I have a web service running inside a Tomcat7 server on Linux. The web service however has to execute some commands (mostly file operations such as copy and mount). Copy I’ve replaced with java.nio, but I don’t think that there is a replacement for mount.

So I’m trying to execute shell commands out of my Tomcat Java process. Unfortunately it doesn’t execute my commands. I’ve implemented the execution of shell commands in Java before. So my code should be correct:

Process pr = Runtime.getRuntime().exec("mount -o loop -t iso9660 <myimage> <mymountpoint>");
pr.waitFor();

<myimage> and <mymountpoint> are absolute paths, so no issues there either.

  • I’ve debugged my commands and they are working when executed on the console.
  • I’ve tried sending other commands. Simple commands such as id and pwd are working!
  • I’ve tried using /bin/bash -c "<command>", which didn’t work.
  • I’ve tried executing a shell script, which executes the command, which didn’t work.
  • I’ve tried escaping the spaces in my command, which didn’t work.

So I’ve digged even deeper and now I’m suspecting some Tomcat security policy (Sandbox?), which prevents me from executing the command. Since security is no issue for me (it’s an internal system, completely isolated from the outside world), I’ve tried a hack, which became quite popular just recently:

System.setSecurityManager(null);

This didn’t work either. I’m using Java7 and Tomcat7 on RHEL6. Tomcat7 is just extracted! I don’t have any files in /etc/.. or any other folder than /opt/tomcat/, where I’ve extracted the zip from the Tomcat home page. I’ve searched the /opt/tomcat/conf folder for security settings, but all I could find was the file catalina.policy, where it didn’t seem like I could set some security level for shell commands.

Any ideas?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It’s generally a bad idea to use the single-string form of Runtime.exec. A better option is to use ProcessBuilder, and split up the arguments yourself rather than relying on Java to split them for you (which it does very naïvely).

    ProcessBuilder pb = new ProcessBuilder("/bin/mount", "-o", "loop", /*...*/);
pb.redirectErrorStream(true); // equivalent of 2>&1
Process p = pb.start();

    You say you’re on RHEL so do you have selinux active? Check your logs and see if this is what’s blocking you (I think it’s audit.log you’re looking for, it’s been a few years since I’ve used selinux). If this does turn out to be the problem then you should probably ask on superuser or serverfault rather than SO…

    • 0