GraalVM: Access to native code is not allowed by the host environment

Question

I just recently setup a Centos7 VM to play around with GraalVM. I downloaded graalvm-1.0.0-rc1, installed Netbeans8.2, and downloaded the FastR extension (via gu). I then wrote a simple java program to test some of the various supported languages. Below is the code I wrote:

package javatest;

import org.graalvm.polyglot.*;
import java.io.PrintStream;
import java.util.Set;

public class JavaTest {

public static void main(String[] args) {

    PrintStream output = System.out;
    Context context = Context.create();
    Set<String> languages = context.getEngine().getLanguages().keySet();
    output.println("Current Languages available in GraalVM: " + languages);

    // TODO code application logic here
    System.out.println("Java: Hello World");

    context.eval("js","print('JavaScript: Hello World')");
    context.eval("R", "print('R: Hello World');");
  }
}

Output is as follows:

run:
Current Languages available in GraalVM: [R, js, llvm]
Java: Hello World
JavaScript: Hello World
FastR unexpected failure: error loading libR from: /usr/local/graalvm-1.0.0- 
    rc1/jre/languages/R/lib/libR.so.
If running on NFI backend, did you provide location of libtrufflenfi.so as 
value of system property 'truffle.nfi.library'?
The current value is '/usr/local/graalvm-1.0.0- 
    rc1/jre/lib/amd64/libtrufflenfi.so'. 
Details: Access to native code is not allowed by the host environment.
Exception in thread "main" org.graalvm.polyglot.PolyglotException
   at org.graalvm.polyglot.Context.eval(Context.java:336)
   at javatest.JavaTest.main(JavaTest.java:32)

As you can see by the initial call to view the supported languages it recognizes that R is installed but once I call the eval on the language it kicks out. The trufflenfi.so file is there and available. I have defined it as a run parameter (even though I shouldn't need to).

I can find nothing on why the "access to native code is not allowed by the host environment" is being displayed and am at a loss. Any ideas on what I'm doing wrong? Note: I also tried the same test with python and ruby and got the same result but removed for the simplest of test cases.

Answer 1

This is a security feature of polyglot contexts created with the GraalVM polyglot API. By default every language is isolated from the host environment, therefore it is not allowed to acccess Java classes, native access or files in your filesystem. Currently with GraalVM 1.0.0-RC1 the languages Ruby and R need native access to boot their environment up. The languages JavaScript and Python don't need native access to boot.

If you want to create a context with all access you can create the context like this:

Context.newBuilder().allowAllAccess(true).build();

You can also just selectively allow access to native code:

Context.newBuilder().allowNativeAccess(true).build();

Here is your example fixed:

package javatest;

import org.graalvm.polyglot.*;
import java.io.PrintStream;
import java.util.Set;

public class JavaTest {

public static void main(String[] args) {

    PrintStream output = System.out;
    Context context = Context.newBuilder().allowAllAccess(true).build();
    Set<String> languages = context.getEngine().getLanguages().keySet();
    output.println("Current Languages available in GraalVM: " + languages);

    // TODO code application logic here
    System.out.println("Java: Hello World");

    context.eval("js","print('JavaScript: Hello World')");
    context.eval("R", "print('R: Hello World');");
  }
}

Here are some more examples that uses all access for Ruby and R: http://www.graalvm.org/docs/graalvm-as-a-platform/embed/