Full path for System.load() is not honoured in AIX

[KostasTsiounis]

When trying to do a System.load() on AIX, where the full path to the library is provided, a library with the same name from the builtin libraries is loaded instead (not sure of the full contents of the builtin libraries, but in this case they contain the libraries bundled with the JDK under the lib directory).

The issue was originally observed and can be reproduced by initializing the OpenJCEPlusFIPS provider, while specifying an OCK library from a location other than the lib directory of the JDK.

For example, when running ./jdk-21.0.6+2/bin/java -Djava.security.debug=jceplus -Dock.library.path=/home/jenkins/kostas/OCK/ TestLibLoad.java on AIX where TestLibLoad.java just calls new OpenJCEPlusFIPS(), I get the following stack trace:

jceplus: New OpenJCEPlusFIPS instance
jceplus: Loading ock library using value in property ock.library.path: /home/jenkins/kostas/OCK/
jceplus: Loaded : /home/jenkins/kostas/OCK/libjgsk8iccs_64.so
jceplus: Libpath not found for jgskit, use java home directory.
jceplus: Loading jgskit library using value: /home/jenkins/kostas/jdk-21.0.6+2/lib
jceplus: Loaded : /home/jenkins/kostas/jdk-21.0.6+2/lib/libjgskit.so
jceplus: Loading ock library using value in property ock.library.path: /home/jenkins/kostas/OCK/
jceplus: dependent library load path : /home/jenkins/kostas/OCK
jceplus: dependent library install path : /home/jenkins/kostas/jdk-21.0.6+2/lib/C
Exception in thread "main" java.lang.IllegalStateException: Cause already initialized
        at java.base/java.lang.Throwable.initCause(Throwable.java:381)
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS.setOCKExceptionCause(OpenJCEPlusFIPS.java:819)
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS.providerException(OpenJCEPlusFIPS.java:813)
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS.initializeContext(OpenJCEPlusFIPS.java:756)
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS$1.run(OpenJCEPlusFIPS.java:86)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:692)
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS.<init>(OpenJCEPlusFIPS.java:78)
        at TestLibLoad.main(TestLibLoad.java:11)
Caused by: java.security.ProviderException: Failed to initialize OpenJCEPlusFIPS provider
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS.providerException(OpenJCEPlusFIPS.java:812)
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS.initializeContext(OpenJCEPlusFIPS.java:756)
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS$1.run(OpenJCEPlusFIPS.java:86)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:692)
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS.<init>(OpenJCEPlusFIPS.java:78)
        at TestLibLoad.main(TestLibLoad.java:11)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:586)
        at jdk.compiler/com.sun.tools.javac.launcher.Main.execute(Main.java:484)
        at jdk.compiler/com.sun.tools.javac.launcher.Main.run(Main.java:208)
        at jdk.compiler/com.sun.tools.javac.launcher.Main.main(Main.java:135)
Caused by: java.security.ProviderException: Dependent library was loaded from /home/jenkins/kostas/jdk-21.0.6+2/lib/C
        at openjceplus/com.ibm.crypto.plus.provider.ock.NativeInterface.validateLibraryLocation(NativeInterface.java:323)
        at openjceplus/com.ibm.crypto.plus.provider.ock.OCKContext.createContext(OCKContext.java:43)
        at openjceplus/com.ibm.crypto.plus.provider.OpenJCEPlusFIPS.initializeContext(OpenJCEPlusFIPS.java:751)
        ... 9 more

Notice how the dependent library load path (i.e., what I specified) is /home/jenkins/kostas/OCK, but the dependent library install path (i.e., where the library is actually loaded from) is /home/jenkins/kostas/jdk-21.0.6+2/lib/C

Running the same command (i.e., ./jdk-21.0.6+2/bin/java -Djava.security.debug=jceplus -Dock.library.path=/root/java/ock_load/OCK/ TestLibLoad.java) on Linux gives us the following:

jceplus: New OpenJCEPlusFIPS instance
jceplus: Loading ock library using value in property ock.library.path: /root/java/ock_load/OCK/
jceplus: Loaded : /root/java/ock_load/OCK/libjgsk8iccs_64.so
jceplus: Libpath not found for jgskit, use java home directory.
jceplus: Loading jgskit library using value: /root/java/ock_load/jdk-21.0.6+2/lib
jceplus: Loaded : /root/java/ock_load/jdk-21.0.6+2/lib/libjgskit.so
jceplus: Loading ock library using value in property ock.library.path: /root/java/ock_load/OCK/
jceplus: dependent library load path : /root/java/ock_load/OCK
jceplus: dependent library install path : /root/java/ock_load/OCK/C

Looking into the loading process a bit, I think that in the NativeLibraries.java class an attempt is made to find the library in the builtin ones using just the name (https://github.com/ibmruntimes/openj9-openjdk-jdk21/blob/2a7c9a4bd8d7c820698222e7d06a3655751f9564/src/java.base/share/classes/jdk/internal/loader/NativeLibraries.java#L136).

I'm not sure why the builtin libraries contain the lib directory only in AIX, but it seems problematic that there is no way to enforce using the full library paths.

Just to be clear, this behaviour is only observed on AIX where the builtin libraries contain the ones in the lib directory of the JDK.

[github-actions]

Issue Number: 20646
Status: Open
Recommended Components: comp:vm, comp:jclextensions, comp:build

[pshipton]

@tajila @JasonFengJ9 fyi

[JasonFengJ9]

I will have a look a bit later.