Skip to content

SecurityManager: security exception when agent tries to access proxy settings #3074

@SylvainJuge

Description

@SylvainJuge

Describe the bug

When the SecurityManager is enabled, the agent should execute some sensitive operations in a "privileged action" and be granted
the adequate permissions in the security policy (BOTH are required).

When the agent is started with log_level=debug, it tries to read the proxy configuration (to make debugging easier), but this is not executed in a privileged action, hence triggering a security exception and breaking communication with apm server.

java.security.AccessControlException: access denied ("java.net.NetPermission" "getProxySelector")	at java.security.AccessControlContext.checkPermission(AccessControlContext.java:488) ~[?:?]	at java.security.AccessController.checkPermission(AccessController.java:1071) ~[?:?]	at java.lang.SecurityManager.checkPermission(SecurityManager.java:411) ~[?:?]	at java.net.ProxySelector.getDefault(ProxySelector.java:102) ~[?:?]	at co.elastic.apm.agent.util.UrlConnectionUtils.debugPrintProxySettings(UrlConnectionUtils.java:49) ~[elastic-apm-agent-1.36.0.jar:1.36.0]	at co.elastic.apm.agent.util.UrlConnectionUtils.openUrlConnectionThreadSafely(UrlConnectionUtils.java:40) ~[elastic-apm-agent-1.36.0.jar:1.36.0]	at co.elastic.apm.agent.report.ApmServerClient.startRequestToUrl(ApmServerClient.java:139) ~[elastic-apm-agent-1.36.0.jar:1.36.0]	at co.elastic.apm.agent.report.ApmServerClient.startRequest(ApmServerClient.java:134) ~[elastic-apm-agent-1.36.0.jar:1.36.0]	at co.elastic.apm.agent.report.AbstractIntakeApiHandler.startRequest(AbstractIntakeApiHandler.java:95) ~[elastic-apm-agent-1.36.0.jar:1.36.0] 

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions