# java.net.NetPermission "specifyStreamHandler" not allowed for custom plugin **URL:** \ **Category:** Elasticsearch\ **Created:** [April 2, 2022, 1:00pm UTC](https://discuss.elastic.co/t/java-net-netpermission-specifystreamhandler-not-allowed-for-custom-plugin/301392 "2022-04-02T13:00:56Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![poanse](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@poanse](https://discuss.elastic.co/u/poanse)\ **Post date:** [April 2, 2022, 1:00pm UTC](https://discuss.elastic.co/t/java-net-netpermission-specifystreamhandler-not-allowed-for-custom-plugin/301392/1 "2022-04-02T13:00:56Z")
I presume this issue is analogous to [java.io.FilePermission is no longer allowed for custom plug-in. · Issue #69464 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/69464), but dealing with java.net.NetPermission "specifyStreamHandler" permission instead. ```auto elasticsearch --version Version: 7.17.1, Build: default/tar/e5acb99f822233d62d6444ce45a4543dc1c8059a/2022-02-23T22:20:54.153567231Z, JVM: 17.0.2 uname -a Darwin mac.local 21.2.0 Darwin Kernel Version 21.2.0: Sun Nov 28 20:28:54 PST 2021; root:xnu-8019.61.5~1/RELEASE_X86_64 x86_64 ``` We have developed a custom ML scoring plugin that uses Scala scripts to calculate features. Scala scripts are evaluated at runtime with eval. It is done more or less by the following code ```auto import scala.reflect.runtime.currentMirror import scala.tools.reflect.ToolBox val toolbox = currentMirror.mkToolBox() toolbox.eval(toolbox.parse(featureScript)) ``` wrapped in AccessController.doPrivileged. We use the following `plugin-security.policy` file: ```auto grant { permission java.net.NetPermission "specifyStreamHandler"; permission java.lang.RuntimePermission "getClassLoader"; permission java.lang.RuntimePermission "createClassLoader"; permission java.lang.RuntimePermission "accessDeclaredMembers"; permission java.lang.RuntimePermission "accessClassInPackage.jdk.*"; permission java.lang.RuntimePermission "accessClassInPackage.sun.*"; permission java.util.PropertyPermission "*", "read,write"; }; ``` It works as expected in 7.9 but fails to install with 7.17 ```auto Exception in thread "main" java.lang.IllegalArgumentException: plugin policy [...] contains illegal permission ("java.net.NetPermission" "specifyStreamHandler") in global grant at org.elasticsearch.bootstrap.PolicyUtil.validatePolicyPermissionsForJar(PolicyUtil.java:350) at org.elasticsearch.bootstrap.PolicyUtil.validatePolicyPermissions(PolicyUtil.java:360) at org.elasticsearch.bootstrap.PolicyUtil.getPluginPolicyInfo(PolicyUtil.java:371) at org.elasticsearch.plugins.cli.InstallPluginAction.installPlugin(InstallPluginAction.java:889) at org.elasticsearch.plugins.cli.InstallPluginAction.execute(InstallPluginAction.java:245) at org.elasticsearch.plugins.cli.InstallPluginCommand.execute(InstallPluginCommand.java:88) at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:95) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112) at org.elasticsearch.cli.Command.main(Command.java:77) at org.elasticsearch.plugins.cli.PluginCli.main(PluginCli.java:36) ``` If I remove this permission from `plugin-security.policy` then plugin can be installed but upon usage the following exception occurs ```auto Caused by: java.security.AccessControlException: access denied ("java.net.NetPermission" "specifyStreamHandler") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:485) ~[?:?] at java.security.AccessController.checkPermission(AccessController.java:1068) ~[?:?] at java.lang.SecurityManager.checkPermission(SecurityManager.java:416) ~[?:?] at java.net.URL.checkSpecifyHandler(URL.java:776) ~[?:?] at java.net.URL.(URL.java:609) ~[?:?] at scala.reflect.internal.util.AbstractFileClassLoader.findResource(AbstractFileClassLoader.scala:81) ~[?:?] at java.lang.ClassLoader.getResource(ClassLoader.java:1403) ~[?:?] at java.lang.ClassLoader.getResourceAsStream(ClassLoader.java:1733) ~[?:?] at scala.reflect.internal.util.RichClassLoader$.classAsStream$extension(ScalaClassLoader.scala:89) ~[?:?] at scala.reflect.internal.util.RichClassLoader$.classBytes$extension(ScalaClassLoader.scala:81) ~[?:?] at scala.reflect.internal.util.ScalaClassLoader.classBytes(ScalaClassLoader.scala:131) ~[?:?] at scala.reflect.internal.util.ScalaClassLoader.classBytes$(ScalaClassLoader.scala:131) ~[?:?] at scala.reflect.internal.util.AbstractFileClassLoader.classBytes(AbstractFileClassLoader.scala:43) ~[?:?] at scala.reflect.internal.util.AbstractFileClassLoader.findClass(AbstractFileClassLoader.scala:73) ~[?:?] at java.lang.ClassLoader.loadClass(ClassLoader.java:587) ~[?:?] at java.lang.ClassLoader.loadClass(ClassLoader.java:520) ~[?:?] at java.lang.Class.forName0(Native Method) ~[?:?] at java.lang.Class.forName(Class.java:467) ~[?:?] at scala.tools.reflect.ToolBoxFactory$ToolBoxImpl$ToolBoxGlobal.compile(ToolBoxFactory.scala:273) ~[?:?] at scala.tools.reflect.ToolBoxFactory$ToolBoxImpl.$anonfun$compile$13(ToolBoxFactory.scala:445) ~[?:?] at scala.tools.reflect.ToolBoxFactory$ToolBoxImpl$withCompilerApi$.apply(ToolBoxFactory.scala:371) ~[?:?] at scala.tools.reflect.ToolBoxFactory$ToolBoxImpl.compile(ToolBoxFactory.scala:438) ~[?:?] at scala.tools.reflect.ToolBoxFactory$ToolBoxImpl.eval(ToolBoxFactory.scala:460) ~[?:?] ``` Allowed permission are listed in `https://github.com/elastic/elasticsearch/blob/7.17/server/src/main/java/org/elasticsearch/bootstrap/PolicyUtil.java`. specifyStreamHandler is not among them. Not sure whether it is intended behaviour or a bug. Want to confirm it before opening a github issue. ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 4, 2022, 11:31am UTC](https://discuss.elastic.co/t/java-net-netpermission-specifystreamhandler-not-allowed-for-custom-plugin/301392/2 "2022-04-04T11:31:34Z")
Hey, while it might make sense to open a GitHub issue about this, the main question is, if you can probably get away from trying to load a resource via `Class.getResourceAsStream`, if that library also allows to load that resource via a system property, or specifying a different constructor allowing you to read that data via a file - hypothesizing here only, but maybe there is another way. --Alex ---
**Author:** ![poanse](https://avatars.discourse-cdn.com/v4/letter/p/d26b3c/32.png) [@poanse](https://discuss.elastic.co/u/poanse)\ **Post date:** [April 22, 2022, 3:50pm UTC](https://discuss.elastic.co/t/java-net-netpermission-specifystreamhandler-not-allowed-for-custom-plugin/301392/3 "2022-04-22T15:50:22Z")
Hi, Thank you for the quick reply and for the suggestion. We managed to solve this issue by using a custom classloader with method `Class.getResourceAsStream` overridden. Though unelegant and requiring to change a part of the mentioned library, this solution works. Have a good day! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 20, 2022, 3:50pm UTC](https://discuss.elastic.co/t/java-net-netpermission-specifystreamhandler-not-allowed-for-custom-plugin/301392/4 "2022-05-20T15:50:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.