Differences in Java WebStart Resolution between XP and Vista / Windows 7

Question

I had a problem creating a Java WebStart application to run on Windows Vista or Windows 7. This WebStart application is reliable and must have full read / write / download permissions for dll and other native libraries.

All this works fine in Windows XP, however in Vista / Windows 7 it cannot access some DLLs.

If I run the application locally separately from WebStart as a whole, it can access the dll.

I came across the following link: http://www.java.com/en/download/help/6000061000.xml

This basically explains whether you like it or not, the WebStart application in Vista / Windows 7 will not and will never work with the same privileges.

Does anyone know a workaround for increased security besides abandoning WebStart? Does anyone else encounter a similar problem, and even if you didn’t understand what you tried, what didn’t work? Any other suggestions are also welcome.

Answer 1

The problem is that despite the applet or webstart application with elevated privileges, they ALL are placed in the Java cache plugin in the LocalLow directory.

The LocalLow directory is set to low integrity in Vista and Windows 7.

This means that although the applet or web launch application may have full read / write permissions on the computer, since executable files are executed from a directory with a low level of integrity, they are allowed access to files and folders with a low degree of integrity as well.

My way around this, I found the Java plugins cache folder under LocalLow and changed its integrity level to Medium. If either the system folder is not explicitly set, by default all folders are considered medium by default.

How did i do this? I downloaded and used the excellent chml command line tool http://www.minasi.com/apps/ .

While I understand that I have created a security risk, I see that it is localized only for Java plug-in applications with all permissions, in fact, it is no less secure than just using XP, in fact, especially since these STILL Java applications cannot access the folder or resource system.