Configsync problem with ElasticSearch recent releases

luigigf49 · June 3, 2021, 6:15pm

Hi Marevol,

ElasticSearch introduced some restrictions on the use of plugins from versions above 7.11
In fact it seems that the configsync plugin is no longer usable due to the new restrictions.
Fess requires the installation of the plugin which to be visible must be defined its path in elasticsearch.yml; for example :

configsync.config_path: D: / Elastic / Elasticsearch / config /

But installation of this plugin fails with this error :

…
…
Exception in thread “main” java.lang.IllegalArgumentException: plugin policy [C:\Program Files\Elastic\Elasticsearch\7.12.1\plugins.installing-14280001803523461252\plugin-security.policy] contains illegal permission (“java.io.FilePermission” “<>” “read,write”) in global grant
…
…

This link

github.com/elastic/elasticsearch

java.io.FilePermission is no longer allowed for custom plug-in.

opened 05:01PM - 23 Feb 21 UTC

closed 08:15PM - 27 Feb 21 UTC

plebedev

:Core/Infra/Plugins >bug Team:Core/Infra

**Elasticsearch version** (`bin/elasticsearch --version`): Version: 7.11.1, B…uild: default/tar/ff17057114c2199c9c1bbecc727003a907c0db7a/2021-02-15T13:44:09.394032Z, JVM: 11.0.6 **Plugins installed**: [] **JVM version** (`java -version`): java version "11.0.6" 2020-01-14 LTS **OS version** (`uname -a` if on a Unix-like system): 18.7.0 Darwin Kernel Version 18.7.0: Fri Oct 30 12:37:06 PDT 2020; root:xnu-4903.278.44.0.2~1/RELEASE_X86_64 x86_64 **Description of the problem including expected versus actual behavior**: We manage our own ES cluster on k8s, and have developed a custom plug-in that needs to read a secret installed on a pod. For this we added the following to plugin-security.policy file: ``` permission java.io.FilePermission "/var/run/secrets/kubernetes.io/serviceaccount/token", "read"; ``` With 7.10, this works as expected. However, the installation of the plugin fails with 7.11.1: ``` Exception in thread "main" java.lang.IllegalArgumentException: plugin policy [/Users/plebedev/elasticsearch-7.11.1/plugins/.installing-7543768861641787116/plugin-security.policy] contains illegal permission ("java.io.FilePermission" "/var/run/secrets/kubernetes.io/serviceaccount/token#plus" "read") in global grant ``` (see stack trace below). Here is the full file: ``` grant { permission java.net.SocketPermission "*", "resolve, connect"; permission java.lang.RuntimePermission "getClassLoader"; permission java.lang.RuntimePermission "setContextClassLoader"; permission java.util.PropertyPermission "guava.concurrent.generate_cancellation_cause", "read"; permission java.io.FilePermission "/var/run/secrets/kubernetes.io/serviceaccount/token", "read"; permission java.lang.RuntimePermission "setFactory"; permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; permission java.lang.RuntimePermission "accessDeclaredMembers"; }; ``` In 7.11, the following file was added: https://github.com/elastic/elasticsearch/blob/v7.11.0/server/src/main/java/org/elasticsearch/bootstrap/PolicyUtil.java that explicitly list permissions allowed for plug-ins, and java.io.FilePermission is not part of it. If I simply remove this grant I will get this error: ``` Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/var/run/secrets/kubernetes.io/serviceaccount/token" "read") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:?] at java.security.AccessController.checkPermission(AccessController.java:897) ~[?:?] at java.lang.SecurityManager.checkPermission(SecurityManager.java:322) ~[?:?] at java.lang.SecurityManager.checkRead(SecurityManager.java:661) ~[?:?] at java.io.File.canRead(File.java:764) ~[?:?] ``` If this is a bug, this needs to be fixed. If this is an intended behavior, the documentation needs to be updated that this is a breaking change, and the appropriate alternative provided. **Steps to reproduce**: You can use https://github.com/elastic/elasticsearch/tree/v7.11.1/plugins/examples/painless-whitelist as a baseline, add plugin-security.policy file (as described https://www.elastic.co/guide/en/elasticsearch/plugins/current/plugin-authors.html#plugin-authors-jsm) with the permission above and try to install on 7.11.1. **Provide logs (if relevant)**: ``` Exception in thread "main" java.lang.IllegalArgumentException: plugin policy [/Users/plebedev/elasticsearch-7.11.1/plugins/.installing-7543768861641787116/plugin-security.policy] contains illegal permission ("java.io.FilePermission" "/var/run/secrets/kubernetes.io/serviceaccount/token#plus" "read") in global grant at org.elasticsearch.bootstrap.PolicyUtil.validatePolicyPermissionsForJar(PolicyUtil.java:300) at org.elasticsearch.bootstrap.PolicyUtil.validatePolicyPermissions(PolicyUtil.java:310) at org.elasticsearch.bootstrap.PolicyUtil.getPluginPolicyInfo(PolicyUtil.java:321) at org.elasticsearch.plugins.InstallPluginCommand.installPlugin(InstallPluginCommand.java:861) at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:245) at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:215) at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116) at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:80) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116) at org.elasticsearch.cli.Command.main(Command.java:79) at org.elasticsearch.plugins.PluginCli.main(PluginCli.java:36) ```

contains the report of a problem similar to mine and the response of an ElasticSearch technician.

Many thanks
Luigi

shinsuke · June 3, 2021, 9:14pm

Configsync is not a plugin. Please see Installation Guide.

luigigf49 · June 4, 2021, 7:02am

Hi Marevol,

now I have this error from Fess startup :

org.lastaflute.di.exception.ContainerInitFailureException: Look! Read the message below.
*/ * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ***
Failed to initialize the container.

[Path]
esclient.xml

[Namespace]
null

[Included by]
esflute_config.xml
esflute_user.xml
esflute_log.xml
*** * * * * * * * * /*
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.throwContainerInitFailureException(LaContainerImpl.java:463)**
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:415)**
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:431)**
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413)**
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:431)**
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413)**
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:431)**
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413)**
** at org.lastaflute.di.core.factory.SingletonLaContainerFactory.init(SingletonLaContainerFactory.java:67)**
** at org.lastaflute.web.container.WebLastaContainerInitializer.doInitContainer(WebLastaContainerInitializer.java:81)**
** at org.lastaflute.web.container.WebLastaContainerInitializer.initialize(WebLastaContainerInitializer.java:45)**
** at org.lastaflute.web.servlet.filter.LastaPrepareFilter.initializeContainer(LastaPrepareFilter.java:137)**
** at org.lastaflute.web.servlet.filter.LastaPrepareFilter.init(LastaPrepareFilter.java:94)**
** at org.apache.catalina.core.ApplicationFilterConfig.initFilter(ApplicationFilterConfig.java:270)**
** at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:251)**
** at org.apache.catalina.core.ApplicationFilterConfig.(ApplicationFilterConfig.java:102)**
** at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4566)**
** at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5203)**
** at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)**
** at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1384)**
** at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1374)**
** at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)**
** at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)**
** at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:140)**
** at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:909)**
** at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:843)**
** at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)**
** at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1384)**
** at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1374)**
** at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)**
** at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)**
** at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:140)**
** at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:909)**
** at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:262)**
** at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)**
** at org.apache.catalina.core.StandardService.startInternal(StandardService.java:434)**
** at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)**
** at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:930)**
** at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)**
** at org.apache.catalina.startup.Tomcat.start(Tomcat.java:486)**
** at org.dbflute.tomcat.TomcatBoot.startServer(TomcatBoot.java:713)**
** at org.dbflute.tomcat.TomcatBoot.go(TomcatBoot.java:402)**
** at org.dbflute.tomcat.TomcatBoot.bootAwait(TomcatBoot.java:347)**
** at org.codelibs.fess.FessBoot.main(FessBoot.java:96)**
Caused by: org.lastaflute.di.core.exception.IllegalMethodRuntimeException: [ESSR0060]Can not configure method(open) of org.codelibs.fess.es.client.SearchEngineClient, because [fess.20210604] IndexNotFoundException[no such index [fess.20210604]]
** at org.lastaflute.di.core.assembler.AbstractMethodAssembler.invoke(AbstractMethodAssembler.java:61)**
** at org.lastaflute.di.core.assembler.DefaultInitMethodAssembler.assemble(DefaultInitMethodAssembler.java:40)**
** at org.lastaflute.di.core.deployer.SingletonComponentDeployer.assemble(SingletonComponentDeployer.java:57)**
** at org.lastaflute.di.core.deployer.SingletonComponentDeployer.deploy(SingletonComponentDeployer.java:41)**
** at org.lastaflute.di.core.deployer.SingletonComponentDeployer.init(SingletonComponentDeployer.java:35)**
** at org.lastaflute.di.core.meta.impl.ComponentDefImpl.init(ComponentDefImpl.java:85)**
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:434)**
** at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413)**
** … 42 more**
Caused by: [fess.20210604] IndexNotFoundException[no such index [fess.20210604]]
** at org.codelibs.fesen.client.action.HttpGetMappingsAction.lambda$execute$0(HttpGetMappingsAction.java:47)**
** at org.codelibs.curl.CurlRequest.lambda$execute$4(CurlRequest.java:220)**
** at org.codelibs.curl.CurlRequest.lambda$connect$3(CurlRequest.java:199)**
** at java.base/java.util.concurrent.ForkJoinTask$RunnableExecuteAction.exec(ForkJoinTask.java:1429)**
** at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:290)**
** at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1016)**
** at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1665)**
** at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1598)**
** at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:183)**
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.apache.catalina.loader.WebappClassLoaderBase (file:/D:/Fess/fess-13.12.2/lib/classes/) to field java.io.ObjectStreamClass$Caches.localDescs
WARNING: Please consider reporting this to the maintainers of org.apache.catalina.loader.WebappClassLoaderBase
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release

Thankyou
Luigi

luigigf49 · June 4, 2021, 7:14am

Hi Marevol,

I restarted the ElasticSearch service a couple of times and now everything seems to work!
I would ask you to clarify, if possible, the doubt of the path of … / data / config / otherwise it’s okay as everything is working.

Many thanks
Luigi