Wrap a QatZipper() inside AccessController.doPrivileged().

Signed-off-by: Mulugeta Mammo <[email protected]>
opensearch-project · Jan 10, 2025 · 7b51b37 · 7b51b37
1 parent 7295dae
commit 7b51b37
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/src/main/java/org/opensearch/index/codec/customcodecs/QatZipperFactory.java b/src/main/java/org/opensearch/index/codec/customcodecs/QatZipperFactory.java
@@ -31,7 +31,9 @@ public class QatZipperFactory {
      * @param pmode polling mode.
      */
     public static QatZipper createInstance(Algorithm algorithm, int level, Mode mode, int retryCount, PollingMode pmode) {
-        return new QatZipper(algorithm, level, mode, retryCount, pmode);
+        return java.security.AccessController.doPrivileged(
+            (java.security.PrivilegedAction<QatZipper>) () -> new QatZipper(algorithm, level, mode, retryCount, pmode)
+        );
     }
 
     /**

diff --git a/src/main/plugin-metadata/plugin-security.policy b/src/main/plugin-metadata/plugin-security.policy
@@ -12,5 +12,4 @@ grant codeBase "${codebase.zstd-jni}" {
 
 grant codeBase "${codebase.qat-java}" {
   permission java.lang.RuntimePermission "loadLibrary.*";
-  permission org.opensearch.secure_sm.ThreadPermission "modifyArbitraryThread";
 };