With Ubuntu 13.04 the possibility to whitelist (and consequentely blacklist) certain applications from creating a tray icon is gone. Since then the tray icons of Java applications and Wine icons are hardcoded and always visible.

Although there are certain ppas, that provide a unity patch by giving back the systray.whitelist (not for 14.04 though, yet) I'd like to know if there are other ways to hide the tray-icons of java apps (e.g. JDownloader)

I know that there's a way in doing so for qt-applications by implementing apparmor-profiles that deny read access to the sni-qt package (e.g. for Skype, or Spotify)

Is there a way to implement apparmor profiles or something similar for Java applications and/or Wine applications?

thanks

  • 1
    You could access their icons, and change them to be transparent and small, so it takes up almost no space and is invisible? – Tim Jun 27 '14 at 7:08
  • 2
    Good idea, but no. The 16x16 place seems to be reserved for java applications. By changing to a invisible 1px svg, one gets still a 16x16 not transparent icon – wa4557 Jun 27 '14 at 8:47
  • 1
    OK, thats a shame... – Tim Jun 27 '14 at 14:32

For Java Apps:

  • Actually for JDownloader case, It's a modular design. Tray icon comes as a plugin that can be disabled from:

    JDownloader → Addons → Addon Manager → Extensions → Uncheck Activate box for JD Light Tray

  • For Java applications general case, It is possible to use Java security manager by writing a custom policy rules.

    1. Create java.policy file in ~/.jdownloader contains:

      grant codeBase "file:/home/user/.jdownloader/-" {
      
      // full access
      //    permission java.security.AllPermission;
      
      // AWTPermission full or only selected elements from it
      //    permission java.awt.AWTPermission "*";
      
          permission java.awt.AWTPermission "accessClipboard";
          permission java.awt.AWTPermission "accessEventQueue";
      //    permission java.awt.AWTPermission "accessSystemTray";
          permission java.awt.AWTPermission "createRobot";
          permission java.awt.AWTPermission "fullScreenExclusive";
          permission java.awt.AWTPermission "listenToAllAWTEvents";
          permission java.awt.AWTPermission "readDisplayPixels";
          permission java.awt.AWTPermission "replaceKeyboardFocusManager";
          permission java.awt.AWTPermission "setAppletStub";
          permission java.awt.AWTPermission "setWindowAlwaysOnTop";
          permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
          permission java.awt.AWTPermission "toolkitModality";
          permission java.awt.AWTPermission "watchMousePointer";
      
      // Added by try and learn
          permission java.io.FilePermission "/-", "read,write,delete";
          permission java.util.PropertyPermission "*", "read,write";
          permission java.util.logging.LoggingPermission "control";
          permission java.lang.RuntimePermission "*";
          permission java.net.NetPermission "*";
          permission java.security.SecurityPermission "*";
          permission javax.net.ssl.SSLPermission "*";
          permission java.net.SocketPermission "*", "connect,resolve";
          permission java.lang.reflect.ReflectPermission "*";
      };
      
    2. Modify jdownloader launch script to use custom policy

      sudo nano /usr/bin/jdownloader
      

      Add: -Djava.security.manager -Djava.security.policy=java.policy to java command call:

      exec java ${JAVA_OPTIONS}  -Djava.security.manager -Djava.security.policy=java.policy -jar JDownloader.jar $*
      

These are the minimum rules that allowed me to launch jdownloader. You may need to add more permissions. Because there is no deny option you have to write all needed grant rules.

References:

BTW, try to comment one of the rules by adding // to the beginning of line; So you can see how the error of denied permissions looks like. It tells you which permission you should to add. Also notice that I have used many - & * trying to extend rules as I'm looking for a quick solution (default was AllPermission anyway) and I'm not looking to jail the application.

Here is a template to start with, trying to grant all possible permissions:

grant codeBase "file:/home/user/.jdownloader/-" {

//    permission java.security.AllPermission;

//    permission java.awt.AWTPermission "*";

    permission java.awt.AWTPermission "accessClipboard";
    permission java.awt.AWTPermission "accessEventQueue";
//    permission java.awt.AWTPermission "accessSystemTray";
    permission java.awt.AWTPermission "createRobot";
    permission java.awt.AWTPermission "fullScreenExclusive";
    permission java.awt.AWTPermission "listenToAllAWTEvents";
    permission java.awt.AWTPermission "readDisplayPixels";
    permission java.awt.AWTPermission "replaceKeyboardFocusManager";
    permission java.awt.AWTPermission "setAppletStub";
    permission java.awt.AWTPermission "setWindowAlwaysOnTop";
    permission java.awt.AWTPermission "showWindowWithoutWarningBanner";
    permission java.awt.AWTPermission "toolkitModality";
    permission java.awt.AWTPermission "watchMousePointer";


    permission javax.sound.sampled.AudioPermission "*";
    permission javax.security.auth.AuthPermission "*";
//    permission javax.security.auth.kerberos.DelegationPermission "";
    permission javax.xml.bind.JAXBPermission "*";
    permission java.nio.file.LinkPermission "hard";
    permission java.nio.file.LinkPermission "symbolic";
    permission java.util.logging.LoggingPermission "control";
//    permission java.lang.management.ManagementPermission "*";
    permission javax.management.MBeanServerPermission "*";
    permission javax.management.MBeanTrustPermission "*";
    permission java.net.NetPermission "*";
    permission java.util.PropertyPermission "*", "read,write";
    permission java.lang.reflect.ReflectPermission "*";
    permission java.lang.RuntimePermission "*";
    permission java.security.SecurityPermission "*";
    permission java.io.SerializablePermission "*";
    permission java.sql.SQLPermission "*";
    permission javax.net.ssl.SSLPermission "*";
    permission javax.management.remote.SubjectDelegationPermission "*";
    permission javax.xml.ws.WebServicePermission "*";
//    permission  "*";

    permission java.io.FilePermission "/-", "read,write,execute,delete,readlink";
    permission javax.management.MBeanPermission "*", "*";
//    permission javax.security.auth.PrivateCredentialPermission "", "read";
    permission javax.security.auth.kerberos.ServicePermission "*", "initiate,accept";
    permission java.net.SocketPermission "*", "accept,connect,listen,resolve";
    permission java.net.URLPermission "*";
};

Note:

Java Policy Tools is a GUI tool to edit policy files. It make it more easy t find out all available options from drop box. It should be already install with Java package.

enter image description here

  • 1
    Cool thanks, that's almost perfect! – wa4557 Jan 5 '15 at 15:07
up vote 1 down vote accepted

Although Sneetshers answer is perfect I discovered a simpler (and obvious) solution. This approach works with JDownloader, but should also work with all other Java programs.

Just remove the logo rm ~/.jdownloader/jd/img/logo/jd_logo_128_128.png and afterwards create a invalid png icon with touch ~/.jdownloader/jd/img/logo/jd_logo_128_128.png

Using this approach, one can still use the TrayIcon plugin (useful for minimizing to tray) without the ugly java icon

As I see no obvious better solutions, it's possible that this will help:

You could get rid of the tray alltogether!

  • either disable it, if possible
  • or replace the whole panel by some other that you can configure manually, just not adding a tray element. (I like xfce4-panel for this kind of things)

If you would miss tray-based features now, most should be replacable case by case somehow, like a scrip showing desktop notifications on some events.

  • 1
    Ok thanks, but this is obviously not what I wanted. I like the unity-tray, I just dislike some of the tray-icons – wa4557 Apr 18 '14 at 8:26
  • 1
    Yes, that was more of a shot in the dark, in terms of knowing your underlying usecase. For an 'appliance'-style machine, runing one fixed application, plus the desktop bar for basic menus only. the method would even work :) [But I remember I have once seen a message of some program refusing to start with no panel... ] – Volker Siegel Apr 18 '14 at 8:42

If you want all the applications that use a tray icon to be able to make use of it in Ubuntu 14.04, you can use a PPA that comes with Unity patched to re-enable the systray whitelist. To do this, open a terminal and run the following commands:

sudo add-apt-repository ppa:gurqn/systray-trusty
sudo apt-get update
sudo apt-get upgrade

Then, restart Unity by pressing ALT + F2 and entering "unity" or by logging out. The PPA now automatically whitelists all applications so there's no need to manually whitelist individual apps to be able to use the systray.

Reverting the changes

If you want to revert the changes and go back to the default Unity packages from the Ubuntu repositories, use the commands below to purge the Unity systray whitelist PPA:

sudo apt-get install ppa-purge
sudo ppa-purge ppa:gurqn/systray-trusty

From http://www.webupd8.org/2013/05/how-to-get-systray-whitelist-back-in.html

  • 1
    Welcome to Ask Ubuntu Stak Exchange! Please, include essential part of link in your answer to prevent breaking post after link dies. – enedil Aug 17 '14 at 22:07
  • 2
    That's a global whitelist, which means that all programs are whitelisted. Blacklisting programs (like wine and Java programs) ist the complete opposite and does not work with this version of unity neither – wa4557 Dec 31 '14 at 11:33

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.