http://bugzilla.opensuse.org/show_bug.cgi?id=1120431 Bug ID: 1120431 Summary: Java:Factory/java-11-openjdk: Bug FATAL ERROR '"java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "getClassLoader")' Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: All OS: All Status: NEW Severity: Critical Priority: P5 - None Component: 3rd party software Assignee: fstrba@suse.com Reporter: pgnet.dev@gmail.com QA Contact: bnc-team-screening@forge.provo.novell.com Found By: --- Blocker: --- I've received several clients' reports of issues with Opensuse's JDK 11 in use with ElasticSearch; using upstream's JDK 11 solves the problem. I can now reproduce: On lsb_release -rd Description: openSUSE Leap 15.0 Release: 15.0 Two Java 11 SDK's are installed: (1) pkg java-11-openjdk-headless-11.0.1.0-lp150.104.8.x86_64 from baseurl=http://download.opensuse.org/repositories/Java:/Factory/openSUSE_Leap_15.0 verifying /usr/lib64/jvm/java-11-openjdk-11/bin/java -version openjdk version "11.0.1" 2018-10-16 OpenJDK Runtime Environment (build 11.0.1+13-suse-lp150.104.8-x8664) OpenJDK 64-Bit Server VM (build 11.0.1+13-suse-lp150.104.8-x8664, mixed mode) and, (2) manual DL/install of https://download.java.net/java/GA/jdk11/13/GPL/openjdk-11.0.1_linux-x64_bin.... verifying /opt/jdk/jdk-11.0.1/bin/java -version openjdk version "11.0.1" 2018-10-16 OpenJDK Runtime Environment 18.9 (build 11.0.1+13) OpenJDK 64-Bit Server VM 18.9 (build 11.0.1+13, mixed mode) With java app "ElasticSearch" installed, elasticsearch-6.5.4-1.noarch from baseurl=https://artifacts.elastic.co/packages/6.x/yum , config of elasticsearch launch to use (1), Opensuse's JDK, /etc/sysconfig/elasticsearch ... JAVA_HOME=/usr/lib64/jvm/java-11-openjdk-11 FAILs @ "java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "getClassLoader")": ==> /var/log/elasticsearch/elasticsearch.log <== [2019-01-01T12:40:32,419][INFO ][o.e.e.NodeEnvironment ] [dev.loc] using [1] data paths, mounts [[/data (/dev/mapper/VG0-TEST)]], net usable_space [269.1gb], net total_space [295.1gb], types [ext4] [2019-01-01T12:40:32,422][INFO ][o.e.e.NodeEnvironment ] [dev.loc] heap size [990.7mb], compressed ordinary object pointers [true] [2019-01-01T12:40:32,533][INFO ][o.e.n.Node ] [dev.loc] node name [dev.loc], node ID [QP4mEe6XQR2HXfwAIedUUw] [2019-01-01T12:40:32,534][INFO ][o.e.n.Node ] [dev.loc] version[6.5.4], pid[43550], build[default/rpm/d2ef93d/2018-12-17T21:17:40.758843Z], OS[Linux/4.20.0-lp150.2.ga24f9ea-default/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/11.0.1/11.0.1+13-suse-lp150.104.8-x8664] [2019-01-01T12:40:32,534][INFO ][o.e.n.Node ] [dev.loc] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.io.tmpdir=/tmp/elasticsearch.nkCzUs46, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/data/elasticsearch, -XX:ErrorFile=/var/log/elasticsearch/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Djava.locale.providers=COMPAT, -XX:UseAVX=2, -Des.path.home=/usr/share/elasticsearch, -Des.path.conf=/usr/local/etc/elasticsearch, -Des.distribution.flavor=default, -Des.distribution.type=rpm] [2019-01-01T12:40:34,327][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [aggs-matrix-stats] [2019-01-01T12:40:34,328][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [analysis-common] [2019-01-01T12:40:34,328][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [ingest-common] [2019-01-01T12:40:34,328][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [lang-expression] [2019-01-01T12:40:34,328][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [lang-mustache] [2019-01-01T12:40:34,328][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [lang-painless] [2019-01-01T12:40:34,328][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [mapper-extras] [2019-01-01T12:40:34,328][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [parent-join] [2019-01-01T12:40:34,328][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [percolator] [2019-01-01T12:40:34,328][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [rank-eval] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [reindex] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [repository-url] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [transport-netty4] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [tribe] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-ccr] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-core] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-deprecation] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-graph] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-logstash] [2019-01-01T12:40:34,329][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-ml] [2019-01-01T12:40:34,330][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-monitoring] [2019-01-01T12:40:34,330][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-rollup] [2019-01-01T12:40:34,330][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-security] [2019-01-01T12:40:34,330][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-sql] [2019-01-01T12:40:34,330][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-upgrade] [2019-01-01T12:40:34,330][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-watcher] [2019-01-01T12:40:34,331][INFO ][o.e.p.PluginsService ] [dev.loc] no plugins loaded [2019-01-01T12:40:38,704][INFO ][o.e.x.s.a.s.FileRolesStore] [dev.loc] parsed [0] roles from file [/usr/local/etc/elasticsearch/roles.yml] [2019-01-01T12:40:38,892][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [dev.loc] fatal error in thread [main], exiting java.lang.ExceptionInInitializerError: null at org.elasticsearch.xpack.watcher.Watcher.createComponents(Watcher.java:289) ~[?:?] at org.elasticsearch.node.Node.lambda$new$11(Node.java:472) ~[elasticsearch-6.5.4.jar:6.5.4] at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:271) ~[?:?] at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1654) ~[?:?] at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484) ~[?:?] at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474) ~[?:?] at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913) ~[?:?] at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:?] at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:578) ~[?:?] at org.elasticsearch.node.Node.<init>(Node.java:475) ~[elasticsearch-6.5.4.jar:6.5.4] at org.elasticsearch.node.Node.<init>(Node.java:265) ~[elasticsearch-6.5.4.jar:6.5.4] at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:212) ~[elasticsearch-6.5.4.jar:6.5.4] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:212) ~[elasticsearch-6.5.4.jar:6.5.4] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:333) ~[elasticsearch-6.5.4.jar:6.5.4] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:136) ~[elasticsearch-6.5.4.jar:6.5.4] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:127) ~[elasticsearch-6.5.4.jar:6.5.4] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-6.5.4.jar:6.5.4] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-6.5.4.jar:6.5.4] at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-6.5.4.jar:6.5.4] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) ~[elasticsearch-6.5.4.jar:6.5.4] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:86) ~[elasticsearch-6.5.4.jar:6.5.4] Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "getClassLoader") at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:?] at java.security.AccessController.checkPermission(AccessController.java:895) ~[?:?] at java.lang.SecurityManager.checkPermission(SecurityManager.java:322) ~[?:?] at java.lang.ClassLoader.checkClassLoaderPermission(ClassLoader.java:2048) ~[?:?] at java.lang.ClassLoader.getParent(ClassLoader.java:1805) ~[?:?] at javax.activation.CommandMap.setDefaultCommandMap(CommandMap.java:110) ~[java.activation:?] at org.elasticsearch.xpack.watcher.notification.email.Account.lambda$static$0(Account.java:51) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.Account.<clinit>(Account.java:43) ~[?:?] ... 21 more But switching to (2), upstream's JDK 11, elasticsearch launch /etc/sysconfig/elasticsearch ... JAVA_HOME=/opt/jdk/jdk-11.0.1 SUCCEEDs ==> /var/log/elasticsearch/elasticsearch.log <== [2019-01-01T12:42:22,985][INFO ][o.e.e.NodeEnvironment ] [dev.loc] using [1] data paths, mounts [[/data (/dev/mapper/VG0-TEST)]], net usable_space [269.1gb], net total_space [295.1gb], types [ext4] [2019-01-01T12:42:22,989][INFO ][o.e.e.NodeEnvironment ] [dev.loc] heap size [990.7mb], compressed ordinary object pointers [true] [2019-01-01T12:42:23,082][INFO ][o.e.n.Node ] [dev.loc] node name [dev.loc], node ID [QP4mEe6XQR2HXfwAIedUUw] [2019-01-01T12:42:23,085][INFO ][o.e.n.Node ] [dev.loc] version[6.5.4], pid[43881], build[default/rpm/d2ef93d/2018-12-17T21:17:40.758843Z], OS[Linux/4.20.0-lp150.2.ga24f9ea-default/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/11.0.1/11.0.1+13] [2019-01-01T12:42:23,085][INFO ][o.e.n.Node ] [dev.loc] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.io.tmpdir=/tmp/elasticsearch.GhEozRXx, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=/data/elasticsearch, -XX:ErrorFile=/var/log/elasticsearch/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=/var/log/elasticsearch/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Djava.locale.providers=COMPAT, -XX:UseAVX=2, -Des.path.home=/usr/share/elasticsearch, -Des.path.conf=/usr/local/etc/elasticsearch, -Des.distribution.flavor=default, -Des.distribution.type=rpm] [2019-01-01T12:42:25,108][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [aggs-matrix-stats] [2019-01-01T12:42:25,108][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [analysis-common] [2019-01-01T12:42:25,108][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [ingest-common] [2019-01-01T12:42:25,108][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [lang-expression] [2019-01-01T12:42:25,108][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [lang-mustache] [2019-01-01T12:42:25,108][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [lang-painless] [2019-01-01T12:42:25,108][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [mapper-extras] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [parent-join] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [percolator] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [rank-eval] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [reindex] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [repository-url] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [transport-netty4] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [tribe] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-ccr] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-core] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-deprecation] [2019-01-01T12:42:25,109][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-graph] [2019-01-01T12:42:25,110][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-logstash] [2019-01-01T12:42:25,110][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-ml] [2019-01-01T12:42:25,110][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-monitoring] [2019-01-01T12:42:25,110][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-rollup] [2019-01-01T12:42:25,110][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-security] [2019-01-01T12:42:25,110][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-sql] [2019-01-01T12:42:25,110][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-upgrade] [2019-01-01T12:42:25,110][INFO ][o.e.p.PluginsService ] [dev.loc] loaded module [x-pack-watcher] [2019-01-01T12:42:25,111][INFO ][o.e.p.PluginsService ] [dev.loc] no plugins loaded [2019-01-01T12:42:29,660][INFO ][o.e.x.s.a.s.FileRolesStore] [dev.loc] parsed [0] roles from file [/usr/local/etc/elasticsearch/roles.yml] [2019-01-01T12:42:30,678][INFO ][o.e.x.m.j.p.l.CppLogMessageHandler] [dev.loc] [controller/43974] [Main.cc@109] controller (64 bit): Version 6.5.4 (Build b616085ef32393) Copyright (c) 2018 Elasticsearch BV [2019-01-01T12:42:31,574][DEBUG][o.e.a.ActionModule ] [dev.loc] Using REST wrapper from plugin org.elasticsearch.xpack.security.Security [2019-01-01T12:42:32,037][INFO ][o.e.d.DiscoveryModule ] [dev.loc] using discovery type [zen] and host providers [settings] [2019-01-01T12:42:33,080][INFO ][o.e.n.Node ] [dev.loc] initialized [2019-01-01T12:42:33,112][INFO ][o.e.n.Node ] [dev.loc] starting ... [2019-01-01T12:42:33,375][INFO ][o.e.t.TransportService ] [dev.loc] publish_address {127.0.0.1:9300}, bound_addresses {127.0.0.1:9300} [2019-01-01T12:42:36,586][INFO ][o.e.c.s.MasterService ] [dev.loc] zen-disco-elected-as-master ([0] nodes joined), reason: new_master {dev.loc}{QP4mEe6XQR2HXfwAIedUUw}{aq98AW3gSvm3ct5kcIjOYg}{127.0.0.1}{127.0.0.1:9300}{ml.machine_memory=16798937088, xpack.installed=true, ml.max_open_jobs=20, ml.enabled=true} [2019-01-01T12:42:36,594][INFO ][o.e.c.s.ClusterApplierService] [dev.loc] new_master {dev.loc}{QP4mEe6XQR2HXfwAIedUUw}{aq98AW3gSvm3ct5kcIjOYg}{127.0.0.1}{127.0.0.1:9300}{ml.machine_memory=16798937088, xpack.installed=true, ml.max_open_jobs=20, ml.enabled=true}, reason: apply cluster state (from master [master {dev.loc}{QP4mEe6XQR2HXfwAIedUUw}{aq98AW3gSvm3ct5kcIjOYg}{127.0.0.1}{127.0.0.1:9300}{ml.machine_memory=16798937088, xpack.installed=true, ml.max_open_jobs=20, ml.enabled=true} committed version [1] source [zen-disco-elected-as-master ([0] nodes joined)]]) [2019-01-01T12:42:36,634][INFO ][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [dev.loc] publish_address {127.0.0.1:9200}, bound_addresses {127.0.0.1:9200} [2019-01-01T12:42:36,635][INFO ][o.e.n.Node ] [dev.loc] started [2019-01-01T12:42:38,172][WARN ][o.e.x.s.a.s.m.NativeRoleMappingStore] [dev.loc] Failed to clear cache for realms [[]] [2019-01-01T12:42:38,279][INFO ][o.e.l.LicenseService ] [dev.loc] license [d14c6778-3013-494e-a442-f5d85e573021] mode [basic] - valid [2019-01-01T12:42:38,295][INFO ][o.e.g.GatewayService ] [dev.loc] recovered [8] indices into cluster_state [2019-01-01T12:42:50,786][INFO ][o.e.c.r.a.AllocationService] [dev.loc] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[mesh-group][2]] ...]). Also, launching ES with Opensuse's JDK 1.8 branch has *NO* problems; works fine. -- You are receiving this mail because: You are on the CC list for the bug.