Obscure java11 crypto crash in docker container
![](https://seccdn.libravatar.org/avatar/cb368eedb146358bdb60f6acad91b415.jpg?s=120&d=mm&r=g)
Hi, I've made a TW docker image running a Java program with current java-11-openjdk-headless. The container generated from this image work fine, except that on a Synology NAS running DSM 7.0 beta with x86_64 arch, running this container makes the JVM inside crash very early on crypto initilization: fips - softokn: crypto test failed - aborting, #, # A fatal error has been detected by the Java Runtime Environment:, #, # SIGSEGV (0xb) at pc=0x00007f3c91d10927, pid=1, tid=9, #, # JRE version: OpenJDK Runtime Environment (11.0.11+9) (build 11.0.11+9-suse-1.1-x8664), # Java VM: OpenJDK 64-Bit Server VM (11.0.11+9-suse-1.1-x8664, mixed mode, tiered, compressed oops, g1 gc, linux-amd64), # Problematic frame:, # C [libc.so.6+0x26927] abort+0x1d9, // Here's the Java stack trace: --------------- T H R E A D ---------------, , Current thread (0x00007f328c016800): JavaThread "main" [_thread_in_native, id=7, stack(0x00007f3291c90000,0x00007f3291cd1000)], , Stack: [0x00007f3291c90000,0x00007f3291cd1000], sp=0x00007f3291cca3a0, free space=232k, Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code), C [libc.so.6+0x26927] abort+0x1d9, , Java frames: (J=compiled Java code, j=interpreted, Vv=VM code), j sun.security.pkcs11.Secmod.nssInitialize(Ljava/lang/String;JLjava/lang/String;Z)Z+0 jdk.crypto.cryptoki@11.0.11, j sun.security.pkcs11.Secmod.initialize(Lsun/security/pkcs11/Secmod$DbMode;Ljava/lang/String;Ljava/lang/String;Z)V+305 jdk.crypto.cryptoki@11.0.11, j sun.security.pkcs11.SunPKCS11.<init>(Lsun/security/pkcs11/Config;)V+370 jdk.crypto.cryptoki@11.0.11, j sun.security.pkcs11.SunPKCS11$1.run()Lsun/security/pkcs11/SunPKCS11;+15 jdk.crypto.cryptoki@11.0.11, j sun.security.pkcs11.SunPKCS11$1.run()Ljava/lang/Object;+1 jdk.crypto.cryptoki@11.0.11, v ~StubRoutines::call_stub, j java.security.AccessController.doPrivileged(Ljava/security/PrivilegedExceptionAction;)Ljava/lang/Object;+0 java.base@11.0.11, j sun.security.pkcs11.SunPKCS11.configure(Ljava/lang/String;)Ljava/security/Provider;+17 jdk.crypto.cryptoki@11.0.11, j sun.security.jca.ProviderConfig$3.run()Ljava/security/Provider;+70 java.base@11.0.11, j sun.security.jca.ProviderConfig$3.run()Ljava/lang/Object;+1 java.base@11.0.11, ///////// Googling around "fips - softokn: crypto test failed - aborting", I learned about FIPS and its relation to the mozilla-nss package used by Java for crypto. However, on this NAS, fips is not enabled as /proc/sys/crypto/fips_enabled does not exist. Synology advertises its NAS as supporting FIPS though. After more Googling and very little info found, I have no idea what cause this issue on this particular NAS and if there is a solution to it (especially if this eventually reveal a packaging mistake of mozilla-nss or java-11-openjdk-headless), so I was wondering if someone more versed into this might have a clue ?
![](https://seccdn.libravatar.org/avatar/bff0c215e01f23fcee6fe49e65fae458.jpg?s=120&d=mm&r=g)
On Fri, May 21, 2021 at 05:03:07PM +0200, Michael Pujos wrote:
Hi,
I've made a TW docker image running a Java program with current java-11-openjdk-headless. The container generated from this image work fine, except that on a Synology NAS running DSM 7.0 beta with x86_64 arch, running this container makes the JVM inside crash very early on crypto initilization:
fips - softokn: crypto test failed - aborting, #, # A fatal error has been detected by the Java Runtime Environment:, #, # SIGSEGV (0xb) at pc=0x00007f3c91d10927, pid=1, tid=9, #, # JRE version: OpenJDK Runtime Environment (11.0.11+9) (build 11.0.11+9-suse-1.1-x8664), # Java VM: OpenJDK 64-Bit Server VM (11.0.11+9-suse-1.1-x8664, mixed mode, tiered, compressed oops, g1 gc, linux-amd64), # Problematic frame:, # C [libc.so.6+0x26927] abort+0x1d9,
// Here's the Java stack trace: --------------- T H R E A D ---------------, , Current thread (0x00007f328c016800): JavaThread "main" [_thread_in_native, id=7, stack(0x00007f3291c90000,0x00007f3291cd1000)], , Stack: [0x00007f3291c90000,0x00007f3291cd1000], sp=0x00007f3291cca3a0, free space=232k, Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code), C [libc.so.6+0x26927] abort+0x1d9, , Java frames: (J=compiled Java code, j=interpreted, Vv=VM code), j sun.security.pkcs11.Secmod.nssInitialize(Ljava/lang/String;JLjava/lang/String;Z)Z+0 jdk.crypto.cryptoki@11.0.11, j sun.security.pkcs11.Secmod.initialize(Lsun/security/pkcs11/Secmod$DbMode;Ljava/lang/String;Ljava/lang/String;Z)V+305 jdk.crypto.cryptoki@11.0.11, j sun.security.pkcs11.SunPKCS11.<init>(Lsun/security/pkcs11/Config;)V+370 jdk.crypto.cryptoki@11.0.11, j sun.security.pkcs11.SunPKCS11$1.run()Lsun/security/pkcs11/SunPKCS11;+15 jdk.crypto.cryptoki@11.0.11, j sun.security.pkcs11.SunPKCS11$1.run()Ljava/lang/Object;+1 jdk.crypto.cryptoki@11.0.11, v ~StubRoutines::call_stub, j java.security.AccessController.doPrivileged(Ljava/security/PrivilegedExceptionAction;)Ljava/lang/Object;+0 java.base@11.0.11, j sun.security.pkcs11.SunPKCS11.configure(Ljava/lang/String;)Ljava/security/Provider;+17 jdk.crypto.cryptoki@11.0.11, j sun.security.jca.ProviderConfig$3.run()Ljava/security/Provider;+70 java.base@11.0.11, j sun.security.jca.ProviderConfig$3.run()Ljava/lang/Object;+1 java.base@11.0.11,
/////////
Googling around "fips - softokn: crypto test failed - aborting", I learned about FIPS and its relation to the mozilla-nss package used by Java for crypto. However, on this NAS, fips is not enabled as /proc/sys/crypto/fips_enabled does not exist. Synology advertises its NAS as supporting FIPS though.
After more Googling and very little info found, I have no idea what cause this issue on this particular NAS and if there is a solution to it (especially if this eventually reveal a packaging mistake of mozilla-nss or java-11-openjdk-headless), so I was wondering if someone more versed into this might have a clue ?
We switched openjdk to also pull in Mozilla NSS as crypto provider. it should however not cause this issue. You can try: - open a bugreport for our java maintainer - pull in also libfreebl3-hmac and libsoftokn3-hmac packges into the container to see if it helps. (ALso the java.security file could be adjusted and the SunPKCS11 entry be removed.) Ciao, MArcus
![](https://seccdn.libravatar.org/avatar/cb368eedb146358bdb60f6acad91b415.jpg?s=120&d=mm&r=g)
Thank you, will do. On 5/21/21 5:36 PM, Marcus Meissner wrote:
We switched openjdk to also pull in Mozilla NSS as crypto provider.
it should however not cause this issue.
You can try:
- open a bugreport for our java maintainer
- pull in also libfreebl3-hmac and libsoftokn3-hmac packges into the container to see if it helps.
(ALso the java.security file could be adjusted and the SunPKCS11 entry be removed.)
Ciao, MArcus
participants (2)
-
Marcus Meissner
-
Michael Pujos