My server runs a Java application that requires I replace a few java library files with ones I downloaded on my own. This has to do with JCE security extensions and isn't really relevant to my question.

I've found that these library files tend to get overwritten by apt when it later updates my java package.

Is there an apt-friendly way of masking these specific files so apt won't touch them?

Potential Solutions

  1. I'm considering just removing the write flag from the files, though I'm expecting this will cause apt to spew its guts everywhere when it later tries to overwrite them?

  2. Perhaps there's a java custom library directory I don't know of, where I can park my files and they'll be loaded instead of the package's defaults?

  3. The last-resort option I'm considering is writing a cron job to periodically replace the files with my versions. I hate this option.

Detailed Explanation

We're operating a fairly heavy Java web application (customized build of GeoServer). The application encrypts user data using the Java Cryptography Extension.

The version of JCE that apt installs is an international version, however, this version is relatively crippled. There is another version (that we have to use). This version is only allowed to be installed in certain locales. We have installed it by replacing the default JCE jars (in /usr/lib/jvm/java-7-oracle/jre/lib/security) with the appropriate versions of these jars that we require. It's these two particular jar files under this location that get periodically replaced by apt and end up breaking our application. In turn, I'm afraid to run software updates.

  • 1
    This is a long standing won't fix issue in Debian. I think the least bad way to do this is with a diversion. Or just use Bouncy Castle. Or don't use Ubuntu. Aug 21, 2014 at 17:18
  • How silly. I guess I'll go learn about diversions and if no one reports back with a better solution, I'll document the details of how I use a diversion for this here. Aug 21, 2014 at 17:23
  • I personally prefer the "Don't use Ubuntu" option, but I look forward to seeing what you come up with. Aug 21, 2014 at 20:19
  • @MichaelHampton what distro do you prefer then CentOS perhaps? Aug 21, 2014 at 21:46

2 Answers 2


My "Answer" ended up being extremely application-specific.

In short

Every time my Java web application launches, the JCE jars are re-copied.

In Detail

My java application runs via Jetty. I use a custom upstart job to manage jetty. I added a script stanza to my upstart job that copies in the JCE jars before launching jetty.

In my testing, I found that if I change my java installation back to the default JCEs while my application is running, my application seems entirely unaffected. I think this has to do with how linux handles file read handles. I still have a handle on the old file even after it's been replaced in the file system, pre-existing handles still work until they're closed.

We'll see if this leads to massive pain. I don't think it's too bad though. It's the best of the bad options I've found so far. Failing this, we'll have to change the source of our application to use what seem to me to be very self-defeating work-arounds in the java source itself.


For what it's worth, you're going to have the same problem if you use CentOS. I just ran into this exact same issue with RHEL. One solution I found was to use OpenJDK instead, which supposedly comes with unlimited strength JCE included:

Nevermind JCE unlimited strength, use OpenJDK

That wasn't an option for me, but I also ran across this:

Upgrade safe JCE deployment for Java on RHEL

Which suggests pointing to the JCE jars using the alternatives command. I went with that method and downgraded/upgraded Java to test it out, and it looks like it works well. The actual commands I used are here:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.