# Plugin security with dynamic class loading

**URL:** <https://discuss.elastic.co/t/plugin-security-with-dynamic-class-loading/110056>\
**Category:** Elasticsearch\
**Created:** [December 3, 2017, 4:03pm UTC](https://discuss.elastic.co/t/plugin-security-with-dynamic-class-loading/110056 "2017-12-03T16:03:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shai\_Erera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shai_erera/32/13492_2.png) [@Shai\_Erera](https://discuss.elastic.co/u/Shai_Erera)\
**Post date:** [December 3, 2017, 4:03pm UTC](https://discuss.elastic.co/t/plugin-security-with-dynamic-class-loading/110056/1 "2017-12-03T16:03:18Z")

</div>

Hi. I implement a plugin for language analysis. It uses an Apache UIMA annotation framework, and for reasons I have not yet figured out why, that framework loads some .jar files dynamically. That is, the plugin packages a set of .PEAR files (think of them as ZIP), each file for a specific language, and at runtime (once) the relevant file gets expanded and the framework loads (via `UIMAClassLoader`) the set of .jars that are in the package.

No matter what permissions I set in my `plugin-security.policy`, they are not applied to the dynamically loaded jars. I've debug-traced a test and I see that `ESPolicy` (I run w/ 5.5.1, but also tested on 5.6.4) contains this code:

```auto
// check for an additional plugin permission: plugin policy is
// only consulted for its codesources.
Policy plugin = plugins.get(location.getFile());
if (plugin != null && plugin.implies(domain, permission)) {
  return true;
}

```

I believe that's the core issue I'm getting. `ESPolicy` applies the permissions I set in my `plugin-security.policy` file to my plugin's files (those in .zip?) and its dependencies. However, since those language-dynamic .jar files do not exist on the classpath at all (as far as ES concerns, `UIMAClassLoader` knows where to look for them), the permissions are not applied to them.

I am not sure what should I do next? I've tried expanding one of the .PEAR files directly under `src/main/resources`, but still, since my `pom.xml` does not reference them, they are not considered plugin files.

I also thought about registering my own `SecurityManager`, wrapping ES's (I know it's not a good idea!), but the test fails w/ failing to create a security manager, even though I put `permission java.lang.RuntimePermission "createSecurityManager";` in my plugin security file.

Has anyone created a plugin like that, which loads .jar files dynamically? Is it supported by Elasticsearch at all?

---

<div class="post-metadata">

**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\
**Post date:** [December 4, 2017, 7:34pm UTC](https://discuss.elastic.co/t/plugin-security-with-dynamic-class-loading/110056/2 "2017-12-04T19:34:15Z")

</div>

At a glance, it does not look like UIMA is setup to work with a security manager at all. It should be possible, but would require work on their end. For example, any time a PEAR loaded package needs to do something requiring SM permissions, it would need to call a method back in UIMA, which would run the call under a doPrivileged block (and the UIMA jar would have permissions for the relevant method).

---

<div class="post-metadata">

**Author:** ![Shai\_Erera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shai_erera/32/13492_2.png) [@Shai\_Erera](https://discuss.elastic.co/u/Shai_Erera)\
**Post date:** [December 5, 2017, 3:05pm UTC](https://discuss.elastic.co/t/plugin-security-with-dynamic-class-loading/110056/3 "2017-12-05T15:05:48Z")

</div>

I was able to work around the security issues by registering my own `Policy` which wraps Elastic's. The policy then grants the required permissions for the dynamically loaded .jar files.

With that, I only need to use a `doPrivileged` code in two places: (1) when expanding (installing) a .PEAR file and (2) once, when starting to process text.

I believe that if Elastic could somehow parse/respect permissions I set in `plugin-security.policy` under specific `codeBase` sections, even though those .jar files are not available on the classpath, I would not need to register my own Policy. But even with that work around, it seems to work fine thus far.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 2, 2018, 3:06pm UTC](https://discuss.elastic.co/t/plugin-security-with-dynamic-class-loading/110056/4 "2018-01-02T15:06:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.