# Custom classic plugin plugin-security.policy - cannot access external REST
**URL:** https://discuss.elastic.co/t/custom-classic-plugin-plugin-security-policy-cannot-access-external-rest/354783
**Category:** Elasticsearch
**Tags:** elastic-stack-security, docker
**Created:** [March 6, 2024, 12:18am UTC](https://discuss.elastic.co/t/custom-classic-plugin-plugin-security-policy-cannot-access-external-rest/354783 "2024-03-06T00:18:34Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Steph\_van\_Schalkwyk](https://discuss.elastic.co/u/Steph_van_Schalkwyk)
#### Post date: [March 6, 2024, 12:18am UTC](https://discuss.elastic.co/t/custom-classic-plugin-plugin-security-policy-cannot-access-external-rest/354783/1 "2024-03-06T00:18:34Z")
I have this in my plugin-security.policy:
```auto
grant {
permission java.net.SocketPermission "*", "connect,resolve,accept,listen";
```
The file is "picked up" by the plugin installer, as it is warning me about other required permissions (which I eventually added).
When I run this processor in a pipeline, it is giving me this:
```auto
"""access denied ("java.net.SocketPermission" "control-plane-gateway-xxxxxx.dev:443" "connect,resolve
```
I've looked at all the policy files I could find in the code base. Nothing seems to work.
I have also tried to add permissions in code, but due to the deprecation warning, I gave up on that avenue.
Any helpful comments?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [March 6, 2024, 1:41am UTC](https://discuss.elastic.co/t/custom-classic-plugin-plugin-security-policy-cannot-access-external-rest/354783/2 "2024-03-06T01:41:29Z")
It's hard to debug without seeing your code, but the most likely cause is that you haven't wrapped your socket access in a `doPrivileged` block.
The rests of the ES codebase does not have socket permissions, so under Java's stack based security model, your code cannot open a socket if it has been called by code that lacks permission to open sockets.
The builtin GeoIP module can be used as an example:
- [elasticsearch/modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/HttpClient.java at main · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/blob/main/modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/HttpClient.java)
- [elasticsearch/modules/ingest-geoip/src/main/plugin-metadata/plugin-security.policy at main · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/blob/main/modules/ingest-geoip/src/main/plugin-metadata/plugin-security.policy)
---
### Author:  [@Steph\_van\_Schalkwyk](https://discuss.elastic.co/u/Steph_van_Schalkwyk)
#### Post date: [March 6, 2024, 5:11am UTC](https://discuss.elastic.co/t/custom-classic-plugin-plugin-security-policy-cannot-access-external-rest/354783/3 "2024-03-06T05:11:54Z")
Thank you.
I came to the same conclusion.
I'll use the ClientBuilder and post the results.
---
### Author:  [@Steph\_van\_Schalkwyk](https://discuss.elastic.co/u/Steph_van_Schalkwyk)
#### Post date: [March 6, 2024, 10:38pm UTC](https://discuss.elastic.co/t/custom-classic-plugin-plugin-security-policy-cannot-access-external-rest/354783/4 "2024-03-06T22:38:39Z")
Thanks for the hint.
I created an ```InputStream post(String urlToGet, String method, String authorization, String content\_type, String body, Map\ parameters) throws IOException {
````method
``` InputStream get(String urlToGet) throws IOException {
return doPrivileged(() -> {
``` in the HttpClient.java file from the GeoIP plugin.
Works.
Now if I can only get the plugin to read the config file. with the REST security settings.
````
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 3, 2024, 10:39pm UTC](https://discuss.elastic.co/t/custom-classic-plugin-plugin-security-policy-cannot-access-external-rest/354783/5 "2024-04-03T22:39:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.