As a follow-up to my previous post on removing Oracle Java, it’s possible that Mac admins may be requested to block Oracle Java in place of removing it. This may be challenging, but possible with the right information and tools. For more details, please see below the jump.

Normally, there’s three approaches on macOS that you can take when needing to block an app:

1. Block by process name
2. Block by code signature
3. Block with parental controls

Block by process name

Blocking by process name may be problematic in this case, since the process names for Oracle’s Java and any other non-Oracle Java are almost certainly going to be identical (for example, java as the process name.) Blocking Oracle’s Java by process name will mean that the non-Oracle Java you may be installing to replace Oracle’s Java will be caught by the same process-based block. 

This is to say nothing of apps which may have embedded Java runtimes you’re not aware of; blocking Oracle’s Java by process may inadvertently also block the processes run by an app’s embedded Java runtime.

Block by code signature

This may be the best approach, as you may be able to use Oracle Java’s code signing signature and bundle identifier to block Oracle Java. Solutions which can do this include the following:

• Google’s Santa
• Jamf Protect

These solutions should be able to block by the code signature’s Team Identifier and the java binaries’ bundle identifier(s). You can find these by running the following command:

Here’s an example of using the codesign command to get the code signature’s Team Identifier and the bundle identifier for the java binary in Oracle’s Java JDK 11.0.20:

• Bundle identifier: Identifier
• Team Identifier: TeamIdentifier

Note: The bundle identifier may be different for each version of Oracle’s Java. You may be able to block using only the Team Identifier, but the drawback of this is that you may also block other Oracle apps which use that same code signing Team Identifier, like Oracle’s VirtualBox hypervisor software:

Block with parental controls:

You can use a macOS configuration profile to set all binaries in a particular directory path to be blocked from running. While this functionality has been deprecated by Apple as of macOS Catalina, it continues to work as of macOS Ventura.

In this case, you can set the enclosing directory paths of Oracle’s Java binaries to the block list and thus prevent Oracle’s Java binaries from running:

When setting a blocklist using a profile, one thing to be aware of is that the blocklist can be overridden by an administrator account. If an administrator chooses, they can set the application block to be overridden once or permanently.

For those who want to block Oracle’s Java binaries using a macOS configuration profile, I’ve created an example profile and posted it here on GitHub:

https://github.com/rtrouton/profiles/tree/main/BlockOracleJavaBinariesFromRunning