.jinit() fails on Apple silicon with hardened run-time

[ablaette]

Thank you so much for rJava! The new Apple M1 chip is great, yet it is a challenge... I am sure you have seen already that the current rJava release (v1.0-4) does not pass CRAN checks: https://cran.r-project.org/web/checks/check_results_rJava.html

On my local Mac mini the error I get is as follows

library(rJava)
.jinit()

zsh: trace trap R

So the R session crashes entirely. I have tried with different versions of JDK (the Azul Zulu Builds), but the Java version does not make a difference.

Looking inside .jinit(), I can reconstruct this scenario for the R crash:

parameters <- getOption("java.parameters")
boot.classpath <- file.path(rJava:::.rJava.base.path, "java", "boot")
.External(rJava:::RinitJVM, boot.classpath, parameters)

I have also tried to install older versions of rJava, but the framework JavaVM is apparently missing from the latest versions of Xcode.

[s-u]

TL;DR: instead of released R, use non-hardened R runtime from https://mac.R-project.org (same reason as https://mac.r-project.org/bin/macosx/RMacOSX-FAQ.html#I-cannot-attach-debugger-to-R )

trap usually means you are permission violation, i.e. the Apple security protection doesn't allow the action. Java uses JIT (just-in-time compiler) which modifies executable code in memory which is potentially unsafe action since exploits use this to modify valid code into malicious code. That's why by default the hardened run-times which are required for notarization of applications by Apple don't allow this modification. Hence macOS will kill process that tries to do that.

One way out is to not use hardened R run-time which is described in the FAQ above. Obviously it is less secure, but your only option at this point. For the next release of R we will consider a modification of the hardened run-time entitlements to allow JIT modifications if permitted by Apple., but it's not something you can do yourself nor can it be changed retrospectively.

[s-u]

It appears that adding com.apple.security.cs.allow-jit=true to R entitlements does the trick. So you can use R-4.1.1-patched (or higher) from http://mac.R-project.org