{"record":{"id":"53c7f9650ed2d9f1","repo":"apache/cassandra","slug":"access-denied-modify-thread-permission","errorCode":null,"errorMessage":"access denied: + MODIFY_THREAD_PERMISSION","messagePattern":"access denied: \\+ MODIFY_THREAD_PERMISSION","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java","lineNumber":194,"sourceCode":"            return false;\n        Boolean threadInitialized = initializedThread.get();\n        if (threadInitialized == null)\n        {\n            initializedThread.set(false);\n            ((SecurityThreadGroup) tg).initializeThread();\n            initializedThread.set(true);\n            threadInitialized = true;\n        }\n        return threadInitialized;\n    }\n\n    public void checkAccess(Thread t)\n    {\n        // need to override since the default implementation only checks the permission if the current thread's\n        // in the root-thread-group\n\n        if (isSecuredThread())\n            throw new AccessControlException(\"access denied: \" + MODIFY_THREAD_PERMISSION, MODIFY_THREAD_PERMISSION);\n        super.checkAccess(t);\n    }\n\n    public void checkAccess(ThreadGroup g)\n    {\n        // need to override since the default implementation only checks the permission if the current thread's\n        // in the root-thread-group\n\n        if (isSecuredThread())\n            throw new AccessControlException(\"access denied: \" + MODIFY_THREADGROUP_PERMISSION, MODIFY_THREADGROUP_PERMISSION);\n        super.checkAccess(g);\n    }\n\n    public void checkPermission(Permission perm)\n    {\n        if (!DatabaseDescriptor.enableUserDefinedFunctionsThreads() && !DatabaseDescriptor.allowExtraInsecureUDFs() && SET_SECURITY_MANAGER_PERMISSION.equals(perm))\n            throw new AccessControlException(\"Access denied\");\n","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java#L176-L212","documentation":"ThreadAwareSecurityManager overrides checkAccess(Thread) so that threads running secured UDF code are denied thread-manipulation rights even outside the root thread group (where the default SecurityManager would not check). If the current thread is a secured UDF thread, it throws AccessControlException formodifyThreadPermission instead of delegating to super.","triggerScenarios":"Code executing inside a Cassandra UDF (sandboxed secured thread) calls Thread.stop(), Thread.suspend(), Thread.resume(), Thread.interrupt() on another thread, or otherwise triggers Thread.checkAccess() while the security manager is active with UDF protection enabled.","commonSituations":"User-defined functions that try to manipulate or stop other threads; UDFs spawning/interfering with thread groups; migration of UDF code from environments without a security manager to Cassandra's sandboxed UDF execution.","solutions":["Remove thread-manipulation logic (stop/suspend/interrupt of other threads) from the UDF; UDFs must be pure computation.","Rewrite the UDF to coordinate via returned data or application-level mechanisms instead of touching threads.","If legitimate, run the code outside UDF context (a regular thread is not flagged as secured).","As a last resort for trusted environments, adjust security settings (enable_user_defined_functions_threads / allow_extra_insecure_udFs) — understand this weakens the sandbox."],"exampleFix":"// before (inside a UDF)\nsomeOtherThread.stop();\n\n// after\nreturn computeResultDirectly(); // no thread manipulation in UDFs","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    thread.checkAccess();\n} catch (AccessControlException e) {\n    logger.warn(\"Thread access denied in sandboxed UDF context: {}\", e.getMessage());\n    throw new UnsupportedOperationException(\"Thread manipulation is not permitted inside UDFs\");\n}","preventionTips":["Keep UDFs pure and side-effect free — no thread or thread-group operations","Test custom UDFs with the security manager enabled before deploying","Do not port thread-control library code into UDFs","Document that UDF code runs under ThreadAwareSecurityManager restrictions"],"tags":["security","securitymanager","udf","sandbox","accesscontrolexception"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}