diff --git a/libs/secure-sm/src/main/java/org/elasticsearch/secure_sm/SecureSM.java b/libs/secure-sm/src/main/java/org/elasticsearch/secure_sm/SecureSM.java index 9bcf2fa37f596..11a88f544948f 100644 --- a/libs/secure-sm/src/main/java/org/elasticsearch/secure_sm/SecureSM.java +++ b/libs/secure-sm/src/main/java/org/elasticsearch/secure_sm/SecureSM.java @@ -154,6 +154,12 @@ private void debugThreadGroups(final ThreadGroup caller, final ThreadGroup targe private static final Permission MODIFY_THREAD_PERMISSION = new RuntimePermission("modifyThread"); private static final Permission MODIFY_ARBITRARY_THREAD_PERMISSION = new ThreadPermission("modifyArbitraryThread"); + // Returns true if the given thread is an instance of the JDK's InnocuousThread. + private static boolean isInnocuousThread(Thread t) { + final Class c = t.getClass(); + return c.getModule() == Object.class.getModule() && c.getName().equals("jdk.internal.misc.InnocuousThread"); + } + protected void checkThreadAccess(Thread t) { Objects.requireNonNull(t); @@ -166,7 +172,7 @@ protected void checkThreadAccess(Thread t) { if (target == null) { return; // its a dead thread, do nothing. - } else if (source.parentOf(target) == false) { + } else if (source.parentOf(target) == false && isInnocuousThread(t) == false) { checkPermission(MODIFY_ARBITRARY_THREAD_PERMISSION); } }