Package: paxrat Version: 1.0-3+b1 When I install openjdk-8-jre-headless, it installs ca-certificates-java as a dependency. ca-certificates-java's postinst is called and killed by grsec because it calls "java -Xmx64m -jar [...]".
Once that happens, paxrat is then executed and paxctl is run on /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java. A "apt-get install -f" will then run ca-certificates-java's postinst again which will complete.
