Description
Elasticsearch Version
7.10.1
Installed Plugins
No response
Java Version
bundled
OS Version
centos7
Problem Description
In the x-pack/watcher module, the file plugin-security.policy does not contain
permission org. elasticsearch.secure_sm.ThreadPermission "modifyArbitraryThread";
permission org. elasticsearch.secure_sm.ThreadPermission "modifyArbitraryThreadGroup"
I think it necessary to add them.
We have encountered the following problems in our environment：java.lang.Error: java.security.AccessControlException: access denied ("org.elasticsearch.secure_sm.ThreadPermission" "modifyArbitraryThreadGroup")
Steps to Reproduce
no
Logs (if relevant)
[2022-04-14T19:09:46,308][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [1615978736000983832] fatal error in thread [ticker-schedule-trigger-engine], exiting
java.lang.Error: java.security.AccessControlException: access denied ("org.elasticsearch.secure_sm.ThreadPermission" "modifyArbitraryThreadGroup")
at java.util.concurrent.ForkJoinWorkerThread$InnocuousForkJoinWorkerThread.createThreadGroup(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinWorkerThread$InnocuousForkJoinWorkerThread.(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinPool$InnocuousForkJoinWorkerThreadFactory$1.run(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinPool$InnocuousForkJoinWorkerThreadFactory$1.run(Unknown Source) ~[?:1.8.0_181]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinPool$InnocuousForkJoinWorkerThreadFactory.newThread(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinPool.createWorker(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinPool.tryAddWorker(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinPool.signalWork(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinPool.externalSubmit(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinPool.externalPush(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinTask.fork(Unknown Source) ~[?:1.8.0_181]
at java.util.stream.AbstractTask.compute(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.CountedCompleter.exec(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinTask.doExec(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinTask.doInvoke(Unknown Source) ~[?:1.8.0_181]
at java.util.concurrent.ForkJoinTask.invoke(Unknown Source) ~[?:1.8.0_181]
at java.util.stream.ReduceOps$ReduceOp.evaluateParallel(Unknown Source) ~[?:1.8.0_181]
at java.util.stream.AbstractPipeline.evaluate(Unknown Source) ~[?:1.8.0_181]
at java.util.stream.LongPipeline.reduce(Unknown Source) ~[?:1.8.0_181]
at java.util.stream.LongPipeline.sum(Unknown Source) ~[?:1.8.0_181]
at java.util.stream.ReferencePipeline.count(Unknown Source) ~[?:1.8.0_181]
at org.elasticsearch.common.util.iterable.Iterables.size(Iterables.java:107) ~[elasticsearch-7.10.1.jar:7.10.1]
at org.elasticsearch.xpack.watcher.execution.ExecutionService.processEventsAsync(ExecutionService.java:215) ~[?:?]
at org.elasticsearch.xpack.watcher.execution.AsyncTriggerEventConsumer.accept(AsyncTriggerEventConsumer.java:29) ~[?:?]
at org.elasticsearch.xpack.watcher.execution.AsyncTriggerEventConsumer.accept(AsyncTriggerEventConsumer.java:18) ~[?:?]
at org.elasticsearch.xpack.watcher.trigger.TriggerService$GroupedConsumer.lambda$accept$0(TriggerService.java:255) ~[?:?]
at java.util.concurrent.CopyOnWriteArrayList.forEach(Unknown Source) ~[?:1.8.0_181]
at org.elasticsearch.xpack.watcher.trigger.TriggerService$GroupedConsumer.accept(TriggerService.java:255) ~[?:?]
at org.elasticsearch.xpack.watcher.trigger.TriggerService$GroupedConsumer.accept(TriggerService.java:245) ~[?:?]
at org.elasticsearch.xpack.watcher.trigger.schedule.engine.TickerScheduleTriggerEngine.lambda$notifyListeners$0(TickerScheduleTriggerEngine.java:139) ~[?:?]
at java.util.concurrent.CopyOnWriteArrayList.forEach(Unknown Source) ~[?:1.8.0_181]
at org.elasticsearch.xpack.watcher.trigger.schedule.engine.TickerScheduleTriggerEngine.notifyListeners(TickerScheduleTriggerEngine.java:139) ~[?:?]
at org.elasticsearch.xpack.watcher.trigger.schedule.engine.TickerScheduleTriggerEngine.checkJobs(TickerScheduleTriggerEngine.java:125) ~[?:?]
at org.elasticsearch.xpack.watcher.trigger.schedule.engine.TickerScheduleTriggerEngine$Ticker.run(TickerScheduleTriggerEngine.java:191) ~[?:?]
Caused by: java.security.AccessControlException: access denied ("org.elasticsearch.secure_sm.ThreadPermission" "modifyArbitraryThreadGroup")
at java.security.AccessControlContext.checkPermission(Unknown Source) ~[?:1.8.0_181]
at java.security.AccessController.checkPermission(Unknown Source) ~[?:1.8.0_181]
at java.lang.SecurityManager.checkPermission(Unknown Source) ~[?:1.8.0_181]
at org.elasticsearch.secure_sm.SecureSM.checkThreadGroupAccess(SecureSM.java:201) ~[elasticsearch-secure-sm-7.10.1.jar:7.10.1]
at org.elasticsearch.secure_sm.SecureSM.checkAccess(SecureSM.java:147) ~[elasticsearch-secure-sm-7.10.1.jar:7.10.1]
at java.lang.ThreadGroup.checkAccess(Unknown Source) ~[?:1.8.0_181]
at java.lang.ThreadGroup.checkParentAccess(Unknown Source) ~[?:1.8.0_181]
at java.lang.ThreadGroup.(Unknown Source) ~[?:1.8.0_181]
... 35 more