Skip to content

Commit 9b07042

Browse files
authored
Fix incorrect setContextClassLoader permissions (#64745)
Netty requires the setContextClassLoader permission. However, many of our policy files incorrectly use `*` as the name, thinking `setContextClassLoader` is the actions element of the permission (it looks like a copy paste error that was then itself copy pasted through several policy files). This commit corrects these permissions, which had actually granted all RuntimePermissions.
1 parent 2fffd78 commit 9b07042

File tree

4 files changed

+5
-5
lines changed

4 files changed

+5
-5
lines changed

modules/transport-netty4/src/main/plugin-metadata/plugin-security.policy

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ grant codeBase "${codebase.netty-common}" {
2525
permission java.net.SocketPermission "*", "accept,connect";
2626

2727
// Netty sets custom classloader for some of its internal threads
28-
permission java.lang.RuntimePermission "*", "setContextClassLoader";
28+
permission java.lang.RuntimePermission "setContextClassLoader";
2929
};
3030

3131
grant codeBase "${codebase.netty-transport}" {

plugins/transport-nio/src/main/plugin-metadata/plugin-security.policy

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,5 @@ grant codeBase "${codebase.netty-common}" {
2727
// netty makes and accepts socket connections
2828
permission java.net.SocketPermission "*", "accept,connect";
2929
// Netty sets custom classloader for some of its internal threads
30-
permission java.lang.RuntimePermission "*", "setContextClassLoader";
30+
permission java.lang.RuntimePermission "setContextClassLoader";
3131
};

x-pack/plugin/core/src/main/plugin-metadata/plugin-security.policy

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ grant codeBase "${codebase.netty-common}" {
1414
// for reading the system-wide configuration for the backlog of established sockets
1515
permission java.io.FilePermission "/proc/sys/net/core/somaxconn", "read";
1616
// Netty sets custom classloader for some of its internal threads
17-
permission java.lang.RuntimePermission "*", "setContextClassLoader";
17+
permission java.lang.RuntimePermission "setContextClassLoader";
1818
};
1919

2020
grant codeBase "${codebase.netty-transport}" {

x-pack/plugin/ml/src/main/plugin-metadata/plugin-security.policy

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ grant codeBase "${codebase.netty-common}" {
1010
// for reading the system-wide configuration for the backlog of established sockets
1111
permission java.io.FilePermission "/proc/sys/net/core/somaxconn", "read";
1212
// Netty sets custom classloader for some of its internal threads
13-
permission java.lang.RuntimePermission "*", "setContextClassLoader";
13+
permission java.lang.RuntimePermission "setContextClassLoader";
1414
};
1515

1616
grant codeBase "${codebase.netty-transport}" {
@@ -27,4 +27,4 @@ grant codeBase "${codebase.elasticsearch-rest-client}" {
2727
grant codeBase "${codebase.httpasyncclient}" {
2828
// rest client uses system properties which gets the default proxy
2929
permission java.net.NetPermission "getProxySelector";
30-
};
30+
};

0 commit comments

Comments
 (0)