# Security Policy: AccessControlException
**URL:** https://discuss.elastic.co/t/security-policy-accesscontrolexception/96116
**Category:** Elasticsearch
**Created:** [August 7, 2017, 1:43pm UTC](https://discuss.elastic.co/t/security-policy-accesscontrolexception/96116 "2017-08-07T13:43:35Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@daneitz](https://discuss.elastic.co/u/daneitz)
#### Post date: [August 7, 2017, 1:43pm UTC](https://discuss.elastic.co/t/security-policy-accesscontrolexception/96116/1 "2017-08-07T13:43:35Z")
I'm building a plugin for Elasticsearch and I have a need to call an external REST API. The current elasticsearch security policy is making this difficult. I get the following error:
java.security.AccessControlException: access denied ("java.net.SocketPermission" "localhost:0" "listen, resolve")
Is there parameters that I can set in the elasticsearch.yaml so it can add my url and ports to the security policy?
Thanks for the assistance.
Dave
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 7, 2017, 1:59pm UTC](https://discuss.elastic.co/t/security-policy-accesscontrolexception/96116/2 "2017-08-07T13:59:30Z")
you have to allow your plugin those kind of calls, as the java security manager blocks them by default. Elasticsearch really tries to lock down any kind of access that would allow attackers to create a channel outside of the cluster.
You can add security exceptions to the `src/main/plugin-metadata/plugin-security.policy` file in your plugin.
You can just check out the elasticsearch source and take a look at all the `plugin-security.policy` files in there, i.e. [https://github.com/elastic/elasticsearch/blob/master/core/src/main/resources/org/elasticsearch/bootstrap/security.policy](https://github.com/elastic/elasticsearch/blob/master/core/src/main/resources/org/elasticsearch/bootstrap/security.policy) (there are about a dozen, so take your time to look)
---
### Author:  [@daneitz](https://discuss.elastic.co/u/daneitz)
#### Post date: [August 7, 2017, 2:31pm UTC](https://discuss.elastic.co/t/security-policy-accesscontrolexception/96116/3 "2017-08-07T14:31:57Z")
I added a plugin-security.policy file with the necessary permissions. I'm running 5.4.1 and the issues is still present.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [August 7, 2017, 2:48pm UTC](https://discuss.elastic.co/t/security-policy-accesscontrolexception/96116/4 "2017-08-07T14:48:00Z")
In case you did not read it: [https://www.elastic.co/guide/en/elasticsearch/plugins/current/plugin-authors.html#plugin-authors-jsm](https://www.elastic.co/guide/en/elasticsearch/plugins/current/plugin-authors.html#plugin-authors-jsm)
---
### Author:  [@daneitz](https://discuss.elastic.co/u/daneitz)
#### Post date: [August 8, 2017, 11:01am UTC](https://discuss.elastic.co/t/security-policy-accesscontrolexception/96116/5 "2017-08-08T11:01:11Z")
Thank you for the assistance.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 5, 2017, 11:01am UTC](https://discuss.elastic.co/t/security-policy-accesscontrolexception/96116/6 "2017-09-05T11:01:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.