Revert "attempt to fix AccessControlException (doesn't work)"

This reverts commit 1e57ca2.
jakelandis · Nov 21, 2024 · ef51ec9 · ef51ec9
1 parent 1e57ca2
commit ef51ec9
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 17 deletions.
diff --git a/.../repository-hdfs/src/main/java/org/elasticsearch/repositories/hdfs/HdfsBlobContainer.java b/.../repository-hdfs/src/main/java/org/elasticsearch/repositories/hdfs/HdfsBlobContainer.java
@@ -16,7 +16,6 @@
 import org.apache.hadoop.fs.Options;
 import org.apache.hadoop.fs.Options.CreateOpts;
 import org.apache.hadoop.fs.Path;
-import org.elasticsearch.SpecialPermission;
 import org.elasticsearch.action.ActionListener;
 import org.elasticsearch.common.blobstore.BlobContainer;
 import org.elasticsearch.common.blobstore.BlobPath;
@@ -39,9 +38,6 @@
 import java.io.OutputStream;
 import java.nio.file.FileAlreadyExistsException;
 import java.nio.file.NoSuchFileException;
-import java.security.AccessController;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
 import java.util.Collections;
 import java.util.EnumSet;
 import java.util.Iterator;
@@ -266,16 +262,8 @@ public void writeBlobAtomic(OperationPurpose purpose, String blobName, BytesRefe
 
     private void writeToPath(BytesReference bytes, Path blobPath, FileContext fileContext, EnumSet<CreateFlag> createFlags)
         throws IOException {
-        SpecialPermission.check();
-        try {
-            AccessController.doPrivileged((PrivilegedExceptionAction<Void>) () -> {
-                try (FSDataOutputStream stream = fileContext.create(blobPath, createFlags, createOpts)) {
-                    bytes.writeTo(stream);
-                }
-                return null;
-            });
-        } catch (PrivilegedActionException e) {
-            throw (IOException) e.getCause();
+        try (FSDataOutputStream stream = fileContext.create(blobPath, createFlags, createOpts)) {
+            bytes.writeTo(stream);
         }
     }
 

diff --git a/plugins/repository-hdfs/src/main/plugin-metadata/plugin-security.policy b/plugins/repository-hdfs/src/main/plugin-metadata/plugin-security.policy
@@ -69,6 +69,4 @@ grant {
   // client binds to the address returned from the host name of any principal set up as a service principal
   // org.apache.hadoop.ipc.Client.Connection.setupConnection
   permission java.net.SocketPermission "localhost:0", "listen,resolve";
-
-  permission org.elasticsearch.secure_sm.ThreadPermission, "modifyArbitraryThreadGroup";
 };
diff --git a/server/src/main/resources/org/elasticsearch/bootstrap/test-framework.policy b/server/src/main/resources/org/elasticsearch/bootstrap/test-framework.policy
@@ -129,5 +129,4 @@ grant {
   permission java.nio.file.LinkPermission "symbolic";
   // needed for keystore tests
   permission java.lang.RuntimePermission "accessUserInformation";
-  permission org.elasticsearch.secure_sm.ThreadPermission, "modifyArbitraryThreadGroup";
 };