# Security policy in 2.0 breaks JConsole and VisualVM

**URL:** <https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861>\
**Category:** Elasticsearch\
**Created:** [October 23, 2015, 2:59pm UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861 "2015-10-23T14:59:51Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![otisg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otisg/32/492_2.png) [@otisg](https://discuss.elastic.co/u/otisg)\
**Post date:** [October 23, 2015, 2:59pm UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861/1 "2015-10-23T14:59:51Z")

</div>

Hi,

I'm not sure if anyone's aware of this, but the new security manager/policy in ES 2.0 completely breaks JConsole and VisualVM. By "breaks" I mean that one cannot use them to connect to ES. This worked before the security manager/policy was introduced, of course.

Is this a known issue? Seems pretty critical to me.... should I open an issue on Github?

This is what happens now:

JConsole:

java.lang.SecurityException: Expecting a javax.rmi.ssl.SslRMIClientSocketFactory RMI client socket factory in stub!  
at javax.management.remote.rmi.RMIConnector.checkStub(RMIConnector.java:1903)  
at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:295)  
at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270)  
at sun.tools.jconsole.ProxyClient.tryConnect(ProxyClient.java:357)  
at sun.tools.jconsole.ProxyClient.connect(ProxyClient.java:313)  
at sun.tools.jconsole.VMPanel$2.run(VMPanel.java:294)  
java.lang.SecurityException: attempt to add a Permission to a readonly Permissions object  
at java.security.Permissions.add(Permissions.java:126)  
at java.security.Policy$UnsupportedEmptyCollection.add(Policy.java:827)  
at sun.rmi.server.LoaderHandler.getLoaderAccessControlContext(LoaderHandler.java:1005)  
at sun.rmi.server.LoaderHandler.lookupLoader(LoaderHandler.java:881)  
at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:404)  
at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:186)  
at java.rmi.server.RMIClassLoader$2.loadClass(RMIClassLoader.java:637)  
at java.rmi.server.RMIClassLoader.loadClass(RMIClassLoader.java:264)  
at sun.rmi.server.MarshalInputStream.resolveClass(MarshalInputStream.java:214)  
...  
...

JVisualVM:  
jvisualvm: java.lang.SecurityException: attempt to add a Permission to a readonly Permissions object  
at java.security.Permissions.add(Permissions.java:126)  
at java.security.Policy$UnsupportedEmptyCollection.add(Policy.java:827)  
at sun.rmi.server.LoaderHandler.getLoaderAccessControlContext(LoaderHandler.java:1005)  
at sun.rmi.server.LoaderHandler.lookupLoader(LoaderHandler.java:881)  
at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:404)  
at sun.rmi.server.LoaderHandler.loadClass(LoaderHandler.java:186)  
at java.rmi.server.RMIClassLoader$2.loadClass(RMIClassLoader.java:637)  
at java.rmi.server.RMIClassLoader.loadClass(RMIClassLoader.java:264)  
at sun.rmi.server.MarshalInputStream.resolveClass(MarshalInputStream.java:214)  
...  
...

## Thanks, Otis

Monitoring - Log Management - Alerting - Anomaly Detection  
Elasticsearch Consulting - Support - Training - [http://sematext.com/](http://sematext.com/)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [October 23, 2015, 3:14pm UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861/2 "2015-10-23T15:14:09Z")

</div>

IMO I'd open an issue for this.

If it's only for testing purpose, a workaround could be to disable security while running tests?

---

<div class="post-metadata">

**Author:** ![otisg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otisg/32/492_2.png) [@otisg](https://discuss.elastic.co/u/otisg)\
**Post date:** [October 23, 2015, 4:08pm UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861/3 "2015-10-23T16:08:48Z")

</div>

Right, but if you need to do this in prod, then what? 😄  
When things are not working well and you need to attach to use JConsole/VisualVM, then you can't stop ES, disable the security manager, and restart..

I'll open the issue, thanks David.

## Otis

Monitoring - Log Management - Alerting - Anomaly Detection  
Elasticsearch Consulting - Support - Training - [http://sematext.com/](http://sematext.com/)

---

<div class="post-metadata">

**Author:** ![otisg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otisg/32/492_2.png) [@otisg](https://discuss.elastic.co/u/otisg)\
**Post date:** [October 23, 2015, 4:32pm UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861/4 "2015-10-23T16:32:44Z")

</div>

Opened [https://github.com/elastic/elasticsearch/issues/14268](https://github.com/elastic/elasticsearch/issues/14268) , but .... heh 😞

## Otis

Monitoring - Log Management - Alerting - Anomaly Detection  
Elasticsearch Consulting - Support - Training - [http://sematext.com/](http://sematext.com/)

---

<div class="post-metadata">

**Author:** ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante)\
**Post date:** [October 23, 2015, 7:53pm UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861/5 "2015-10-23T19:53:27Z")

</div>

Adding these lines to `org.elasticsearch.bootstrap.ESPolicy` will make a huge difference 🙂

```
@Override
public PermissionCollection getPermissions(CodeSource codesource) {
    PermissionCollection pc = template.getPermissions(codesource);
    for (Enumeration<Permission> en = dynamic.elements(); en.hasMoreElements(); ) {
        pc.add(en.nextElement());
    }
    return pc;
}
```

---

<div class="post-metadata">

**Author:** ![rmuir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rmuir/32/44949_2.png) [@rmuir](https://discuss.elastic.co/u/rmuir)\
**Post date:** [October 23, 2015, 10:53pm UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861/6 "2015-10-23T22:53:11Z")

</div>

Its never going to happen. And its total bullshit that code is trying to _add_ to the result of getPermissions, its basically trying to backdoor its way through the system.

not a chance in hell i tell you.

---

<div class="post-metadata">

**Author:** ![otisg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otisg/32/492_2.png) [@otisg](https://discuss.elastic.co/u/otisg)\
**Post date:** [October 24, 2015, 2:10am UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861/7 "2015-10-24T02:10:30Z")

</div>

Unfortunately, that's inside some ES jar, so it's not realistic to have people/ES users go in and modify ES jars...

## Otis

Monitoring - Log Management - Alerting - Anomaly Detection  
Elasticsearch Consulting - Support - Training - [http://sematext.com/](http://sematext.com/)

---

<div class="post-metadata">

**Author:** ![rmuir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rmuir/32/44949_2.png) [@rmuir](https://discuss.elastic.co/u/rmuir)\
**Post date:** [October 24, 2015, 3:07am UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861/8 "2015-10-24T03:07:23Z")

</div>

Its also not realistic for us to maintain tons of hacks indefinitely because of others bugs. In this case the JDK bug has been open for a long time and nobody cares ([https://bugs.openjdk.java.net/browse/JDK-8014008](https://bugs.openjdk.java.net/browse/JDK-8014008)). I have a PR ([https://github.com/elastic/elasticsearch/pull/14274](https://github.com/elastic/elasticsearch/pull/14274)) to workaround the bug, but I think some momentum needs to happen on that bug.

This is 100% a JDK bug and not a problem with elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:42pm UTC](https://discuss.elastic.co/t/security-policy-in-2-0-breaks-jconsole-and-visualvm/32861/9 "2017-07-05T23:42:49Z")

</div>