Update Java silently via command line?

[tls2t]

Hi all,

I've been having a hard time trying to find out if this is even possible or not. What I'd like to do is to have Casper use a policy to silently check for and/or update Java in the background, but I can't seem to find any sort of terminal command to accomplish this throughout the interwebs. Is something like this even possible?

[colonelpanic]

We use a script that runs on the every30 trigger that scans the versions of all the applications installed, then prompts the user to run software updates from Self Service (another script we wrote that updates all out of date apps) if a non-critical update is available. If a critical update is available it will automatically install the update from the "scanner" script. You can check the version of java that is installed using this statement:

JavaVersion=`grep "CFBundleShortVersionString" /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Info.plist -A 1 | grep "<string>" | grep "Java 7 Update 25" -c`

That will return 1 if the version is update 25, and 0 if not. Then you can perform an action (like running a policy with the new version of java installed via a trigger).

[talkingmoose]

Are you referring to Apple's Java updates or Oracles?

Have you looked at Apple's command line utility "sofwareupdate"? This will get you all updates from them. You can grep/awk for available java packages and use softwareupdate to install.

Looks like Oracle's version of java uses the Sparkle framework, which is a software update framework used by many Mac applications. I haven't been able to find anything useful online to access Sparkle via command line.

[tls2t]

@talkingmoose

Sorry, I completely forgot about the different flavors of Java. I'm referring to Oracle's Java.

[clifhirtle]

Some useful past posts on managing Java updates in the following two threads Terry:

• https://jamfnation.jamfsoftware.com/discussion.html?id=6489
• https://jamfnation.jamfsoftware.com/discussion.html?id=6489

If you are comfortable having the Java updates come down automatically, you can just tweak your next deployment package to have the auto check/install Java option enabled by default.

Using the same logic, you could likely craft a smaller package that toggles auto-updates on/off as needed for machines, keeping it deactivated on production machines, testing new updates as released, then re-enabling auto-update to allow clients to do the work of pulling down the update on their own.

[tls2t]

I managed to get the Java control panel to open from a command prompt by using:

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/ControlPanel

However, it doesn't seem to work when doing it in a policy, either via a command or when used in a script. I'm close, but not sure why it doesn't work.

[jaharmi]

Both Apple Java 6 and Oracle Java 7 are capable of being installed silently; I’ve seen both deployed successfully as “unattended installs” (which are background installations with no user interaction) via Munki. Not sure how this applies to installation from within Casper.

[tls2t]

@jaharmi - I've seen all kinds of documentation about that, but it's not quite what I want to do. Here's the scenario:

Our faculty and staff are NOTORIOUS for not keeping their systems up to date, despite all the nagging/emails. I've managed to create policies/Self Service links to launch things like System Update, or Microsoft Office update when they click on them. Java seems to be the only one I haven't been able to figure out how to get to launch. When pasting that command into a prompt, it will open the Java control panel with no problems, but as soon as I try to put it into a policy or a script, nothing happens. This is what the JSS logs say:

Script result: objc[8317]: Class JavaLaunchHelper is implemented in both /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java and /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/jli/./libjli.dylib. One of the two will be used. Which one is undefined. Exception in thread "main" java.awt.HeadlessException: No X11 DISPLAY variable was set, but this program performed an operation which requires it. at java.awt.GraphicsEnvironment.checkHeadless(GraphicsEnvironment.java:207) at java.awt.Window.(Window.java:535) at java.awt.Frame.(Frame.java:420) at java.awt.Frame.(Frame.java:385) at javax.swing.JFrame.(JFrame.java:180) at com.sun.deploy.panel.ControlPanel.(Unknown Source) at com.sun.deploy.panel.ControlPanel.main(Unknown Source)

I don't know enough about Unix/Terminal/Java to troubleshoot where the problem could be.

[mm2270]

@barret55 - its likely not working because when its run through a policy its running the command as a different user, such as your Casper service account or root, not as the logged in user. OS X has gotten more strict with each new release about what it allows to be run as the logged in user when its being called by another account, especially when it comes to GUI operations.

Here are a couple of things you can try. I'm not sure which of these will work though. We can start simple and work up to the slightly more complicated workaround.
You will need a full script for these, not just a single command that you can place into the Advanced Run Command section.
In both cases, you need to get the logged in user information first in your script.

#!/bin/sh

loggedInUser=$( ls -l /dev/console | awk '{print $3}' )

su "$loggedInUser" -c "open /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/ControlPanel"

If that doesn't work, you might need to resort to using the launchctl bsexec syntax, like this-

#!/bin/sh

loggedInUser=$( ls -l /dev/console | awk '{print $3}' )
loggedInPID=$( ps -axj | awk "/^$loggedInUser/ && /Dock.app/ {print $2;exit}" )

/bin/launchctl bsexec "${loggedInPID}" sudo -iu "${loggedInUser}" "open /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/ControlPanel"

And there are probably one or two other approaches to this too. Try one of these and see if one of them works though.

[tls2t]

@mm2270 The first option seems to work, opening a terminal window along with the Java control panel. So close now! :-)

If there's a way to either hide the terminal window, or have it close automatically, I can finally scratch this off my list of things to do.

Thanks for the help!

[mm2270]

@barret55 -Hmm. not sure why its opening Terminal, other than it may be because the ContolPanel is an executable, not a full app.
But, I suggest taking an entirely different approach here. Since we know that opening the Java Control Panel from System Preferences calls up the actual app you're looking to open, maybe just use some Applescript commands, again, run as the user, to open that Preference Pane. Try this-

#!/bin/sh

loggedInUser=$( ls -l /dev/console | awk '{print $3}' )

su "$loggedInUser" -c "/usr/bin/osascript <<END
tell application "System Preferences" to activate
tell application "System Preferences" to set current pane to pane id "com.oracle.java.JavaControlPanel"
END"

[scottb · Accepted solution]

When you use that script to open it, this is what you get:
Class JavaLaunchHelper is implemented in both /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java and /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/jli/./libjli.dylib. One of the two will be used. Which one is undefined.

That is what's causing the Terminal window to open I suppose?
If you use this it seems to work:

open /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy/JavaControlPanel.prefPane

[mm2270]

Yeah, I see that error now, but funny thing is, when I tested it by ssh'ing into a test Mac and running the script it won't popping up Terminal. Still, that could be the issue.
I still think even the above command would need to be run as the user to work from a policy though.

I just realized that you could also just open the Java Pref Pane from the script directly without needing the Applescript calls. It can also be in one line like-

su "$( ls -l /dev/console | awk '{print $3}' )" -c "open /Library/PreferencePanes/JavaControlPanel.prefPane"

Not really tested, but that may work.

[tls2t]

@boettchs Yep, that works great. Only thing is that it opens System Preferences at the same time, but I think that the users will be more ok with having to close that, than seeing some weird terminal window open up, and wonder what it is.

Thanks for all the help everyone!

[scottb]

@mm2270][/url][/url: Yes, you need to still put in the user for it to run.

@barret55][/url: yes, it opens too, but I figured it's a decent tradeoff. But I just tried and put in a sleep, then quit System Preferences into the script and it seems to kill the System Prefs while leaving open the Java Pane. If you want to clean it up some.

[tls2t]

@boettchs Nope, I'm fine with it as-is. Thanks for all the help. This one's been bothering me for months.

[justin]

wish i could implement this, but we've got users in finance and JPMorgan always says to refrain from updating until they certify the update to work.