apache/cassandra · error · AccessControlException

access denied: + perm

Error message

access denied: + perm

What it means

ThreadAwareSecurityManager.checkPackageAccess throws AccessControlException when a secured UDF thread attempts to load a class from a package that is not on the allowed-package whitelist. Cassandra sandboxes user-defined functions by restricting which Java packages their code can touch; any import/reflection access to a disallowed package triggers this.

Source

Thrown at src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java:249

        super.checkPermission(perm);
    }

    public void checkPermission(Permission perm, Object context)
    {
        if (isSecuredThread())
            super.checkPermission(perm, context);
    }

    public void checkPackageAccess(String pkg)
    {
        if (!isSecuredThread())
            return;

        if (!((SecurityThreadGroup) Thread.currentThread().getThreadGroup()).isPackageAllowed(pkg))
        {
            RuntimePermission perm = new RuntimePermission("accessClassInPackage." + pkg);
            throw new AccessControlException("access denied: " + perm, perm);
        }
    }
}

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Rewrite the UDF to only use classes from allowed packages (java.lang, java.math, java.nio, java.text, java.util, org.apache.cassandra.*).
2. Add the needed package to the UDF whitelist via the scripted/allowed-packages configuration for UDFs (with awareness of security implications).
3. Move the disallowed logic out of the UDF into client-side code.
4. Use a UDF language (e.g. Java with restricted imports) that avoids the offending package.

Example fix

// before (UDF body)
import java.io.File;  // AccessControlException: accessClassInPackage.java.io
File f = new File(path);
// after
// use only whitelisted APIs, e.g. operate on column values with java.lang/java.util only

// Before importing a UDF, check that all referenced packages are on the allowed list
boolean allowed = Arrays.stream(referencedPackages).allMatch(pkg -> ALLOWED_UDF_PACKAGES.stream().anyMatch(p -> pkg.equals(p) || pkg.startsWith(p + ".")));

When it happens

Trigger: UDF bytecode references a class in a package not listed in the UDF whitelist (e.g. java.io.File, arbitrary application packages). At class-linking time the JVM calls checkPackageAccess on the secured thread, and ((SecurityThreadGroup) ...).isPackageAllowed(pkg) returns false (src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java:249).

Common situations: UDFs importing utility libraries outside the allowed set; after upgrading Cassandra the default package whitelist shrank; attempts to do file/network I/O from a UDF.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• access denied: + MODIFY_THREAD_PERMISSION
• access denied: + MODIFY_THREADGROUP_PERMISSION
• Access denied
• To be able to set enable_user_defined_functions_threads: fal
• Java UDF validation failed:

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/0a12a345a8a573fe. Report an issue: GitHub.