# Static groovy script and java security access control issue **URL:** \ **Category:** Elasticsearch\ **Created:** [April 27, 2016, 8:11am UTC](https://discuss.elastic.co/t/static-groovy-script-and-java-security-access-control-issue/48516 "2016-04-27T08:11:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![elkonaut](https://avatars.discourse-cdn.com/v4/letter/e/bc8723/32.png) [@elkonaut](https://discuss.elastic.co/u/elkonaut)\ **Post date:** [April 27, 2016, 8:11am UTC](https://discuss.elastic.co/t/static-groovy-script-and-java-security-access-control-issue/48516/1 "2016-04-27T08:11:55Z")
Hi, I want to use a groovy script: 1.) to calculate a value (this works) and 2.) to add the newly calculated value to the document using the update API The script is stored in /etc/elasticsearch/scripts and I understood that in this case I do not have to think about the Java Security Manager. Is this right? The first part of the script is working fine. However things are not working when I add the second part of the script: def url = "[http://elk:9200/testindex/testdocument/](http://elk:9200/testindex/testdocument/)" + doc['id'] + "/\_update" def json = '{ "doc": { "testvalue":"999" } }' def response = ["curl", "-X", "POST", "-H", "Content-Type: application/json", "-d", "${json}", "${url}"].execute().text Executing the script I get following error message: 1.)Output from script "reason": { "caused\_by": { "reason": "access denied ("java.io.FilePermission" "\<\>" "execute")", "type": "access\_control\_exception" }, "reason": "failed to run file script [vm\_lifetime\_deleted] using lang [groovy]", "type": "script\_exception" 2.) In /var/log/elasticsearch/elasticsearch.log [2016-04-27 10:05:12,435][DEBUG][action.search] [elk] [8] Failed to execute fetch phase RemoteTransportException[[elk][192.168.100.29:9300][indices:data/read/search[phase/fetch/id]]]; nested: ScriptException[failed to run file script [vm\_lifetime\_deleted] using lang [groovy]]; nested: AccessControlException[access denied ("java.io.FilePermission" "\<\>" "execute")]; Caused by: ScriptException[failed to run file script [vm\_lifetime\_deleted] using lang [groovy]]; nested: AccessControlException[access denied ("java.io.FilePermission" "\<\>" "execute")]; at org.elasticsearch.script.groovy.GroovyScriptEngineService$GroovyScript.run(GroovyScriptEngineService.java:320) at org.elasticsearch.search.fetch.script.ScriptFieldsFetchSubPhase.hitExecute(ScriptFieldsFetchSubPhase.java:85) at org.elasticsearch.search.fetch.FetchPhase.execute(FetchPhase.java:188) at org.elasticsearch.search.SearchService.executeFetchPhase(SearchService.java:592) at org.elasticsearch.search.action.SearchServiceTransportAction$FetchByIdTransportHandler.messageReceived(SearchServiceTransportAction.java:408) at org.elasticsearch.search.action.SearchServiceTransportAction$FetchByIdTransportHandler.messageReceived(SearchServiceTransportAction.java:405) at org.elasticsearch.transport.TransportRequestHandler.messageReceived(TransportRequestHandler.java:33) at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:75) at org.elasticsearch.transport.TransportService$4.doRun(TransportService.java:376) at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "\<\>" "execute") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) at java.security.AccessController.checkPermission(AccessController.java:884) at java.lang.SecurityManager.checkPermission(SecurityManager.java:549) at java.lang.SecurityManager.checkExec(SecurityManager.java:799) at java.lang.ProcessBuilder.start(ProcessBuilder.java:1018) at java.lang.Runtime.exec(Runtime.java:620) at java.lang.Runtime.exec(Runtime.java:485) at org.codehaus.groovy.runtime.ProcessGroovyMethods.execute(ProcessGroovyMethods.java:595) at org.codehaus.groovy.runtime.ProcessGroovyMethods.execute(ProcessGroovyMethods.java:662) at org.codehaus.groovy.runtime.dgm$895.doMethodInvoke(Unknown Source) at org.codehaus.groovy.vmplugin.v7.IndyInterface.selectMethod(IndyInterface.java:228) at 4aa35ba4549f50461ab4f8d973c9bf622b1510ec.run(4aa35ba4549f50461ab4f8d973c9bf622b1510ec:13) at org.elasticsearch.script.groovy.GroovyScriptEngineService$GroovyScript$1.run(GroovyScriptEngineService.java:313) at java.security.AccessController.doPrivileged(Native Method) at org.elasticsearch.script.groovy.GroovyScriptEngineService$GroovyScript.run(GroovyScriptEngineService.java:310) The same script works fine If I run it from within groovyConsole. In addtion, I tried to define a java.policy which grants all permissions (although this is not needed to my understanding). $JAVA\_HOME/lib/security/java.policy: grant { permission java.security.AllPermission; }; But I still get the error message. I highly appreciate any help. Cheers ---
**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\ **Post date:** [April 27, 2016, 5:14pm UTC](https://discuss.elastic.co/t/static-groovy-script-and-java-security-access-control-issue/48516/2 "2016-04-27T17:14:39Z")
Can you post your script (and perhaps an example document) so we can try to reproduce this? ---
**Author:** ![elkonaut](https://avatars.discourse-cdn.com/v4/letter/e/bc8723/32.png) [@elkonaut](https://discuss.elastic.co/u/elkonaut)\ **Post date:** [April 28, 2016, 3:55pm UTC](https://discuss.elastic.co/t/static-groovy-script-and-java-security-access-control-issue/48516/3 "2016-04-28T15:55:16Z")
Yes, following you can see the query, the script and an example document. Query: { "query" : { "query\_string" : { "query": "vm\_state:deleted OR vm\_state:active", } }, "script\_fields": { "lifetime": { "script": { "file": "vm\_lifetime\_deleted" } } }, } The script: if(doc['vm\_state'].value == "deleted") { l1 = (doc['deleted\_at'].value - doc['created\_at'].value) / (1000 \* 3600 \* 24) } else if(doc['vm\_state'].value == "active") { def d1 = new Date() l1 = (d1.getTime() - doc['created\_at']) / (1000 \* 3600 \* 24) } def url = "[http://elk:9200/openstack/openstack/](http://elk:9200/openstack/openstack/)" + doc['id'] + "/\_update" def json = '{ "doc": { "lifetime":"$l1" } }' def response = ["curl", "-X", "POST", "-H", "Content-Type: application/json", "-d", "${json}", "${url}"].execute().text lifetime = Math.round(l1 \*100)/100.0 And finally, one document: { "\_id": "123", "\_index": "openstack", "\_source": { "@timestamp": "2016-04-28T15:52:00.131Z", "@version": "1", "created\_at": "2015-04-23T09:51:14.000Z", "deleted": 123, "deleted\_at": "2015-04-23T14:16:28.000Z", "id": 123, "lifetime": 0, "memory\_mb": 4096, "vm\_state": "deleted" }, "\_type": "openstack", "\_version": 205, "found": true } ---
**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\ **Post date:** [April 28, 2016, 10:36pm UTC](https://discuss.elastic.co/t/static-groovy-script-and-java-security-access-control-issue/48516/4 "2016-04-28T22:36:37Z")
Wait, it looks like you are trying to execute a curl command from within the groovy script itself? Is this correct? If so, this is definitely not something we want to encourage! This is probably something best left to logic outside of the groovy scripting in Elasticsearch, or perhaps inplemented as a native script (see: [https://github.com/imotov/elasticsearch-native-script-example/](https://github.com/imotov/elasticsearch-native-script-example/)) ---
**Author:** ![elkonaut](https://avatars.discourse-cdn.com/v4/letter/e/bc8723/32.png) [@elkonaut](https://discuss.elastic.co/u/elkonaut)\ **Post date:** [April 29, 2016, 7:46am UTC](https://discuss.elastic.co/t/static-groovy-script-and-java-security-access-control-issue/48516/5 "2016-04-29T07:46:10Z")
Ok, I'll take a look at the script linked. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:55pm UTC](https://discuss.elastic.co/t/static-groovy-script-and-java-security-access-control-issue/48516/6 "2017-07-05T22:55:19Z")