Adds ReflectPermissions for DefaultResourceAccessControlPlugin

Signed-off-by: Darshit Chanpura <[email protected]>
opensearch-project · Dec 13, 2024 · cbbefa6 · cbbefa6
1 parent 193112b
commit cbbefa6
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/server/src/main/resources/org/opensearch/bootstrap/security.policy b/server/src/main/resources/org/opensearch/bootstrap/security.policy
@@ -52,6 +52,12 @@ grant codeBase "${codebase.opensearch}" {
   permission org.opensearch.secure_sm.ThreadContextPermission "stashWithOrigin";
 };
 
+//// Permission specific to DefaultResourceAccessControlPlugin
+grant codeBase "${codebase.opensearch}" {
+  // ReflectPermission granted only for the DefaultResourceAccessControlPlugin to allow parsing the Resources
+  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
+};
+
 //// Very special jar permissions:
 //// These are dangerous permissions that we don't want to grant to everything.