# org.elasticsearch.ThreadPermission modifyArbitraryThreadGroup **URL:** \ **Category:** Elasticsearch\ **Created:** [March 22, 2017, 2:16am UTC](https://discuss.elastic.co/t/org-elasticsearch-threadpermission-modifyarbitrarythreadgroup/79527 "2017-03-22T02:16:00Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![elzr\_celino](https://avatars.discourse-cdn.com/v4/letter/e/8e8cbc/32.png) [@elzr\_celino](https://discuss.elastic.co/u/elzr_celino)\ **Post date:** [March 22, 2017, 2:16am UTC](https://discuss.elastic.co/t/org-elasticsearch-threadpermission-modifyarbitrarythreadgroup/79527/1 "2017-03-22T02:16:00Z")
Hi, I am trying to develop plugin for elasticsearch 5.2.2. The idea of the plugin is to listen to a JMS queue then create a document based on the received message from the queue. It will use the `Client` object passed by `Plugin.createComponents` method, so it can index documents. I can not make this work right now because I am having problem with `java.security.AccessControlException`. I have the following permissions inside my `plugin-security.policy`. ```auto grant { permission java.lang.RuntimePermission "accessClassInPackage.sun.misc"; permission java.lang.RuntimePermission "getClassLoader"; permission java.lang.RuntimePermission "setContextClassLoader"; permission org.elasticsearch.ThreadPermission "modifyArbitraryThreadGroup"; permission org.elasticsearch.ThreadPermission "modifyArbitraryThread"; }; ``` And I am calling the indexing operation via `AccessController.doPrivileged`: ```auto private Client client; public void onMessage(Message messge) { AccessController.doPrivileged(new PrivilegedAction() { //perform indexing using the client. }); } ``` But still, I am getting an error on `java.security.AccessControlException`: ```auto org.elasticsearch.transport.RemoteTransportException: [wWaQrVv][127.0.0.1:8300][indices:data/write/index[p]] Caused by: java.security.AccessControlException: access denied ("org.elasticsearch.ThreadPermission" "modifyArbitraryThreadGroup") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:1.8.0_112] at java.security.AccessController.checkPermission(AccessController.java:884) ~[?:1.8.0_112] at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) ~[?:1.8.0_112] at org.elasticsearch.SecureSM.checkThreadGroupAccess(SecureSM.java:194) ~[securesm-1.1.jar:5.2.2] at org.elasticsearch.SecureSM.checkAccess(SecureSM.java:141) ~[securesm-1.1.jar:5.2.2] at java.lang.ThreadGroup.checkAccess(ThreadGroup.java:315) ~[?:1.8.0_112] at java.lang.Thread.init(Thread.java:391) ~[?:1.8.0_112] at java.lang.Thread.init(Thread.java:349) ~[?:1.8.0_112] at java.lang.Thread.(Thread.java:675) ~[?:1.8.0_112] at org.elasticsearch.common.util.concurrent.EsExecutors$EsThreadFactory.newThread(EsExecutors.java:173) ~[elasticsearch-5.2.2.jar:5.2.2] at java.util.concurrent.ThreadPoolExecutor$Worker.(ThreadPoolExecutor.java:612) ~[?:1.8.0_112] at java.util.concurrent.ThreadPoolExecutor.addWorker(ThreadPoolExecutor.java:925) ~[?:1.8.0_112] at java.util.concurrent.ThreadPoolExecutor.execute(ThreadPoolExecutor.java:1357) ~[?:1.8.0_112] at org.elasticsearch.common.util.concurrent.EsThreadPoolExecutor.doExecute(EsThreadPoolExecutor.java:94) ~[elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.common.util.concurrent.EsThreadPoolExecutor.execute(EsThreadPoolExecutor.java:89) ~[elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.transport.TransportService.sendLocalRequest(TransportService.java:606) ~[elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.transport.TransportService.access$000(TransportService.java:72) ~[elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.transport.TransportService$3.sendRequest(TransportService.java:131) ~[elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.transport.TransportService.sendRequestInternal(TransportService.java:554) ~[elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.transport.TransportService.sendRequest(TransportService.java:485) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.transport.TransportService.sendRequest(TransportService.java:473) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.performAction(TransportReplicationAction.java:727) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.performLocalAction(TransportReplicationAction.java:646) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.support.replication.TransportReplicationAction$ReroutePhase.doRun(TransportReplicationAction.java:634) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.support.replication.TransportReplicationAction.doExecute(TransportReplicationAction.java:146) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.index.TransportIndexAction.innerExecute(TransportIndexAction.java:156) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.index.TransportIndexAction.doExecute(TransportIndexAction.java:136) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.index.TransportIndexAction.doExecute(TransportIndexAction.java:68) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:173) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:145) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:87) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.client.node.NodeClient.executeLocally(NodeClient.java:75) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:64) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:403) [elasticsearch-5.2.2.jar:5.2.2] at org.elasticsearch.client.support.AbstractClient.index(AbstractClient.java:415) [elasticsearch-5.2.2.jar:5.2.2] ... at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_112] ``` ---
**Author:** ![ywelsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ywelsch/32/7751_2.png) [@ywelsch](https://discuss.elastic.co/u/ywelsch)\ **Post date:** [March 24, 2017, 9:24am UTC](https://discuss.elastic.co/t/org-elasticsearch-threadpermission-modifyarbitrarythreadgroup/79527/2 "2017-03-24T09:24:33Z")
Why are you doing the indexing operation in a `doPrivileged` block? ---
**Author:** ![elzr\_celino](https://avatars.discourse-cdn.com/v4/letter/e/8e8cbc/32.png) [@elzr\_celino](https://discuss.elastic.co/u/elzr_celino)\ **Post date:** [March 28, 2017, 2:21am UTC](https://discuss.elastic.co/t/org-elasticsearch-threadpermission-modifyarbitrarythreadgroup/79527/3 "2017-03-28T02:21:14Z")
I thought that would fix my issue with `AccessControlException`. But still, I get the same problem. Any thoughts on how I could fix this? ``` [2017-03-28T10:15:35,506][WARN][o.h.j.client] HQ122001: Unhandled exception thrown from onMessage java.security.AccessControlException: access denied ("org.elasticsearch.ThreadPermission" "modifyArbitraryThreadGroup") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:1.8.0_112] at java.security.AccessController.checkPermission(AccessController.java:884) ~[?:1.8.0_112] at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) ~[?:1.8.0_112] at org.elasticsearch.SecureSM.checkThreadGroupAccess(SecureSM.java:194) ~[securesm-1.1.jar:5.2.2] at org.elasticsearch.SecureSM.checkAccess(SecureSM.java:141) ~[securesm-1.1.jar:5.2.2] at java.lang.ThreadGroup.checkAccess(ThreadGroup.java:315) ~[?:1.8.0_112] at java.lang.Thread.init(Thread.java:391) ~[?:1.8.0_112] at java.lang.Thread.init(Thread.java:349) ~[?:1.8.0_112] at java.lang.Thread.(Thread.java:675) ~[?:1.8.0_112] at org.elasticsearch.common.util.concurrent.EsExecutors$EsThreadFactory.newThread(EsExecutors.java:173) ~[elasticsearch-5.2.2.jar:5.2.2] ``` ---
**Author:** ![ywelsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ywelsch/32/7751_2.png) [@ywelsch](https://discuss.elastic.co/u/ywelsch)\ **Post date:** [March 28, 2017, 2:50pm UTC](https://discuss.elastic.co/t/org-elasticsearch-threadpermission-modifyarbitrarythreadgroup/79527/4 "2017-03-28T14:50:28Z")
you need to provide additional context here. A plugin that uses the client to index a document does not require to do this in a `doPrivileged` block (see e.g. Reindex plugin/module). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 25, 2017, 2:50pm UTC](https://discuss.elastic.co/t/org-elasticsearch-threadpermission-modifyarbitrarythreadgroup/79527/5 "2017-04-25T14:50:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.