'Access denied' in executable packaged with jPackage when tries to start a SubProcess using Kernel32.CreateProcess()

[wolf-itc]

We've got a problem with amazon-corretto-17.0.10.7.1-windows-x64-jdk: Our application gets packed to an executable and tries to start a subprocess using kernel32.CreateProcess(...)
Until amazon-corretto-17.0.9.8.1-windows-x64-jdk everything works fine, now we get an 'Access denied'.
If I run my application out of the debugger of the IDEA, also everything works fine.

Steps to reproduce: Not sure if it happens every time if you package a java-application into an executable and start a sub-process.
Expected behavior: Sub-Process (e.g.calc.exe) is started

OS: Windows 10 with amazon-corretto-17.0.10.7.1-windows-x64-jdk

boolean result = kernel32.CreateProcess(null, 'calc.exe, null, null, true, new WinDef.DWORD(CREATE_SUSPENDED | CREATE_BREAKAWAY_FROM_JOB | CREATE_UNICODE_ENVIRONMENT), environment, 'c:\test' si, pi);

Result is: Kernel32Util.getLastErrorMessage() is 'Access denied'

Unfortunately, I don't know if I could debug the Exe-Process, and there is no further stacktrace.

[earthling-amzn]

Thank you for bringing this to our attention. Would you be able to provide a small reproducer?
Are you sure your IDE is using the same 17.0.10.7.1 JDK? It's not clear to me if this failure only happens after you have packed your application down to an executable, or are you able to reproduce the error without this packaging step?

[wolf-itc]

Many thanks for the fast reply!
I will have a second look because of the question if the Intellij really uses the assumed JDK-version. I think so, but I have to ensure this at Monday. But it's possible that I can't reproduce this error in the debugger because the IDE every time uses the same JDK.
I will have to ask in the project if I may spend the time for a reproducer. For the moment, I think they will wait for a new JDK-version and hope, that this bug isn't present anymore.
I will write more at Monday.
Until then, have a good weekend!

[earthling-amzn]

Okay, mostly I just want to figure out if this is a runtime problem for the JDK, or an effect of how the application is packaged.

[wolf-itc]

I verified it: In the Task-Manager I can see that the used JRE is the 17.0.10.
But in Intellij there were two more settings for the current JDK, and I changed both to 17.0.10.
The result is that still no problem appears, the sub-processes are started well.
So, the problem is really only there after packaging.

[earthling-amzn]

Okay, looked around at the commit logs and this is the only change (of four) that touched anything related to windows in jpackage between 17.0.9.8.1 and 17.0.10.7.1:

commit 179c60f99f384b7c28bf324f930aa2e886e0cc30
Date:   Wed Oct 11 08:35:19 2023 +0000

    8301247: JPackage app-image exe launches multiple exe's in JDK 17+
    
    Reviewed-by: lucy
    Backport-of: dcea9bf087c87548d9caa899c52e95d17478da22

I've no experience with jpackage, so the discussion in the ticket might make more sense to you ;) It would be really helpful if you could provide the inputs to jpackage and a small program that demonstrates the issue.

[wolf-itc]

Hi William,
I had to correct the titel because I saw that the IOException is thrown by our code. The origin is the 'Access denied' which is returned by the Kernel32.
The commit you mentioned I also have seen, but I cannot believe that this is the reason for our problem.
A demo-prog I still have to clarity (but cannot ask today).

[wolf-itc]

Hi William,
now I was able to create a small demo program to show this error (ZIP is attached).
If it would help, I could provide a working jPackaged version with 17.0.9, and a second failing one jPackaged with 17.0.10.
I also figured out that the problem seems to be the flag 'CREATE_BREAKAWAY_FROM_JOB'. Without that, the subprocess starts fine, but I think, we need this flag.
I hope this helps finding the issue.

demo.zip