Access denied ("java.lang.RuntimePermission" "accessClassInPackage.jdk.internal.org.objectweb.asm")

SonarQube Server / Community Build
3

Thanks for posting this solution!

Rather than modifying the default.policy file, I’ve taken the security.policy from the Elasticsearch repo and added the following to the existing grant section at the end of the file (right before the last } character):

  // perms needed by sonarqube ES
  permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.org.objectweb.asm";
  permission java.lang.RuntimePermission "accessDeclaredMembers";

I assume that the policy from Elasticsearch is the right one - I found it in this blog post: Mitigate Log4j / Log4Shell in Elasticsearch (CVE-2021-44228).

I then changed sonar.properties to use this security policy in the Elasticsearch process:

sonar.search.javaAdditionalOpts=-Djava.security.policy=/opt/sonarqube/elasticsearch/config/security.policy

I did this because I figured that it was less likely to get overwritten by updates in the future and was easier to manage from my Ansible playbook. I’m posting here in case it helps someone else in the future.

3 Likes