# Elastic Search AllPermission security manager issue ...continued **URL:** \ **Category:** Elasticsearch\ **Created:** [December 3, 2018, 5:48am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091 "2018-12-03T05:48:46Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Vishal\_Goel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_goel/32/46581_2.png) [@Vishal\_Goel](https://discuss.elastic.co/u/Vishal_Goel)\ **Post date:** [December 3, 2018, 5:48am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/1 "2018-12-03T05:48:46Z")
Hi, This is in continuation to following post: > [@Elastic Search AllPermission security manager issue](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue/148676): > > I am running elastic search with non loop-back IP (production mode) on Windows. To run ES, I am forking it out (elasticsearch.bat) from a Java app using ProcessBuilder. However, it is giving me following error: [2018-09-15T00:04:42,617][INFO][o.e.b.BootstrapChecks] [PC-VISHALG] bound or publishing to a non-loopback address, enforcing bootstrap checks [2018-09-15T00:04:42,632][ERROR][o.e.b.Bootstrap] [PC-VISHALG] node validation exception [1] bootstrap checks failed [1]: grantin… > [2018-09-15T00:04:42,632][ERROR][o.e.b.Bootstrap] [PC-VISHALG] node validation exception > [1] bootstrap checks failed > [1]: granting the all permission effectively disables security I am getting this error while running ES (6.3.1) from local drive setup also. I am using JavaBuilder to run ES. On some machines, it run successfully but onothers it give above error (all machines are WIN 10). Ryan mentioned that it is Java permission poilcy file issue. What are the permissions that ES need to start and if I can provide them to ES in Java policy file? Thanks ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [December 3, 2018, 9:53am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/2 "2018-12-03T09:53:53Z")
you do not need to provide any sample policy file. Elasticsearch has everything included in its distribution. It seems you are trying to run with a custom policy file - you should not do this and stick to the default. The first step should be to find out if that is the case and try to disable it. ---
**Author:** ![Vishal\_Goel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_goel/32/46581_2.png) [@Vishal\_Goel](https://discuss.elastic.co/u/Vishal_Goel)\ **Post date:** [December 3, 2018, 10:08am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/3 "2018-12-03T10:08:07Z")
Thanks Alex. I don't think I am running with any custom file. Any way to find about it? I don't give any policy file during ES run. ---
**Author:** ![Vishal\_Goel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_goel/32/46581_2.png) [@Vishal\_Goel](https://discuss.elastic.co/u/Vishal_Goel)\ **Post date:** [December 5, 2018, 7:16am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/4 "2018-12-05T07:16:08Z")
Any update here please. ---
**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\ **Post date:** [December 6, 2018, 1:09am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/5 "2018-12-06T01:09:23Z")
You can check the default policy file (which elasticsearch builds upon) locations according to these java docs: [https://docs.oracle.com/javase/7/docs/technotes/guides/security/PolicyFiles.html#DefaultLocs](https://docs.oracle.com/javase/7/docs/technotes/guides/security/PolicyFiles.html#DefaultLocs) Something is granting the elasticsearch jar AllPermission, which defeats the purpose of using the SecurityManager. Do you manage your own environment, or does someone else? I have seen IT orgs do this granting via the system policy to "make things easy" before. ---
**Author:** ![Vishal\_Goel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_goel/32/46581_2.png) [@Vishal\_Goel](https://discuss.elastic.co/u/Vishal_Goel)\ **Post date:** [December 6, 2018, 5:52am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/6 "2018-12-06T05:52:40Z")
You got it right. I have .java.policy file in my user.home. How can I specify policy file during ES startup? I tried giving using "ES\_JAVA\_OPTS", "-Djava.security.policy=" + System.getProperty("java.home") + File.separator + "lib" + File.separator + "security" + File.separator + "java.policy" but it still is having issue. If i remove .java.policy from user.home, it works fine. ---
**Author:** ![Vishal\_Goel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_goel/32/46581_2.png) [@Vishal\_Goel](https://discuss.elastic.co/u/Vishal_Goel)\ **Post date:** [December 6, 2018, 6:06am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/7 "2018-12-06T06:06:01Z")
It is fixed now with following (== instaed of =): "ES\_JAVA\_OPTS" = "-Djava.security.policy==" + System.getProperty("java.home") + File.separator + "lib" + File.separator + "security" + File.separator + "java.policy" ---
**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\ **Post date:** [December 8, 2018, 12:04am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/8 "2018-12-08T00:04:41Z")
I believe using `==` works not because of any special syntax, but because the path to the policy file then looks like it begins with `=` (which is of course an invalid path), and java is lax on failures there. You are effectively disabling using your system policy by using an invalid path. ---
**Author:** ![Vishal\_Goel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_goel/32/46581_2.png) [@Vishal\_Goel](https://discuss.elastic.co/u/Vishal_Goel)\ **Post date:** [December 8, 2018, 5:24am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/9 "2018-12-08T05:24:02Z")
Ok. But when I used single = and provided java home security policy file, it still picked user.home .java.policy. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 5, 2019, 5:24am UTC](https://discuss.elastic.co/t/elastic-search-allpermission-security-manager-issue-continued/159091/10 "2019-01-05T05:24:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.