{"record":{"id":"4e778d9556fdfe1c","repo":"SonarSource/sonarqube","slug":"unable-to-configure-could-not-get-read-access-t","errorCode":null,"errorMessage":"Unable to configure: . Could not get read access to []","messagePattern":"Unable to configure: \\. Could not get read access to \\[\\]","errorType":"validation","errorClass":"MessageException","httpStatus":null,"severity":"error","filePath":"server/sonar-main/src/main/java/org/sonar/application/es/EsSettings.java","lineNumber":156,"sourceCode":"      builder.put(\"xpack.security.autoconfiguration.enabled\", Boolean.FALSE.toString());\n      builder.put(\"xpack.security.enabled\", Boolean.FALSE.toString());\n    }\n  }\n\n  private String getFileNameFromPathProperty(ProcessProperties.Property processProperty) {\n    String processPropertyPath = props.value(processProperty.getKey());\n\n    if (processPropertyPath == null) {\n      throw new MessageException(processProperty.getKey() + \" property need to be set \" +\n        \"when using elastic search authentication\");\n    }\n    Path path = Paths.get(processPropertyPath);\n    if (!path.toFile().exists()) {\n      throw new MessageException(\"Unable to configure: \" + processProperty.getKey() + \". \"\n        + \"File specified in [\" + processPropertyPath + \"] does not exist\");\n    }\n    if (!path.toFile().canRead()) {\n      throw new MessageException(\"Unable to configure: \" + processProperty.getKey() + \". \"\n        + \"Could not get read access to [\" + processPropertyPath + \"]\");\n    }\n    return path.getFileName().toString();\n  }\n\n  private void configureNetwork(Map<String, String> builder) {\n    if (!clusterEnabled) {\n      InetAddress searchHost = resolveAddress(SEARCH_HOST);\n      int searchPort = Integer.parseInt(props.nonNullValue(SEARCH_PORT.getKey()));\n      builder.put(ES_HTTP_HOST_KEY, searchHost.getHostAddress());\n      builder.put(ES_HTTP_PORT_KEY, valueOf(searchPort));\n      builder.put(\"discovery.type\", \"single-node\");\n\n      int transportPort = Integer.parseInt(props.nonNullValue(ES_PORT.getKey()));\n\n      // we have no use of transport port in non-DCE editions\n      // but specified host must be the one listed in: discovery.seed_hosts\n      // otherwise elasticsearch cannot elect master node","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-main/src/main/java/org/sonar/application/es/EsSettings.java#L138-L174","documentation":"getFileNameFromPathProperty also verifies read permission on the configured keystore/truststore file. If path.toFile().canRead() is false it throws this MessageException reporting that read access could not be obtained for the path.","triggerScenarios":"The store file exists but the SonarQube process user lacks read permission on it (or on a parent directory), e.g. after copying files as root with restrictive modes.","commonSituations":"Certificates owned by root with 0600 while SonarQube runs as the 'sonar' user; parent directory lacking execute bit for the service account; SELinux/AppArmor blocking access.","solutions":["chown/chmod the file so the SonarQube process user can read it (e.g. chown sonar:sonar keystore.p12 && chmod 400 keystore.p12)","Grant traverse (x) permission on each parent directory of the file","Check SELinux/AppArmor policies and relabel/allow access if a MAC layer denies the read","Verify the file is a regular readable file, not a device or broken mount"],"exampleFix":"// before\n-r-------- 1 root root 4134 keystore.p12\n// after\nchown sonar:sonar /etc/sonarqube/ssl/keystore.p12\nchmod 400 /etc/sonarqube/ssl/keystore.p12","handlingStrategy":"validation","validationCode":"File f = new File(props.get(\"sonar.cluster.es.ssl.keystore.path\"));\nif (f.isFile() && !f.canRead()) throw new IllegalStateException(\"Process user cannot read: \" + f);","typeGuard":null,"tryCatchPattern":"try { esSettings.build(); } catch (MessageException e) { log.error(\"ES store unreadable: {}\", e.getMessage()); throw new ConfigurationException(e); }","preventionTips":["Run a pre-start check that reads each configured store file as the service user","Standardize ownership: chown sonar:sonar with mode 0400 for keystores","Ensure parent directories grant traverse (x) permission","Account for SELinux/AppArmor in hardened environments"],"tags":["elasticsearch","configuration","permissions","tls"],"backgroundTag":"permission-denied","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}