{"record":{"id":"d02023b4558a68de","repo":"apache/cassandra","slug":"access-denied-modify-threadgroup-permission","errorCode":null,"errorMessage":"access denied: + MODIFY_THREADGROUP_PERMISSION","messagePattern":"access denied: \\+ MODIFY_THREADGROUP_PERMISSION","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java","lineNumber":204,"sourceCode":"    }\n\n    public void checkAccess(Thread t)\n    {\n        // need to override since the default implementation only checks the permission if the current thread's\n        // in the root-thread-group\n\n        if (isSecuredThread())\n            throw new AccessControlException(\"access denied: \" + MODIFY_THREAD_PERMISSION, MODIFY_THREAD_PERMISSION);\n        super.checkAccess(t);\n    }\n\n    public void checkAccess(ThreadGroup g)\n    {\n        // need to override since the default implementation only checks the permission if the current thread's\n        // in the root-thread-group\n\n        if (isSecuredThread())\n            throw new AccessControlException(\"access denied: \" + MODIFY_THREADGROUP_PERMISSION, MODIFY_THREADGROUP_PERMISSION);\n        super.checkAccess(g);\n    }\n\n    public void checkPermission(Permission perm)\n    {\n        if (!DatabaseDescriptor.enableUserDefinedFunctionsThreads() && !DatabaseDescriptor.allowExtraInsecureUDFs() && SET_SECURITY_MANAGER_PERMISSION.equals(perm))\n            throw new AccessControlException(\"Access denied\");\n\n        if (!isSecuredThread())\n            return;\n\n        // required by JavaDriver 2.2.0-rc3 and 3.0.0-a2 or newer\n        // code in com.datastax.driver.core.CodecUtils uses Guava stuff, which in turns requires this permission\n        // TODO: Evaluate removing this once the driver is removed as a dependency (see CASSANDRA-20326).\n        if (CHECK_MEMBER_ACCESS_PERMISSION.equals(perm))\n            return;\n\n        // Nashorn / Java 11","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java#L186-L222","documentation":"ThreadAwareSecurityManager overrides checkAccess(ThreadGroup) because the default SecurityManager only enforces the modifyThreadGroup permission for threads in the root thread group. When the current thread is a secured UDF thread attempting to access or modify a thread group, this override throws AccessControlException for modifyThreadGroupPermission to keep UDF code sandboxed.","triggerScenarios":"Code running inside a Cassandra UDF (secured thread) calls ThreadGroup methods requiring access checks — e.g. enumerating, interrupting, stopping, or setting max priority on a thread group — while the security manager is active.","commonSituations":"UDFs that inspect or manipulate thread groups for coordination or cleanup; ported library code used in UDFs that assumes unrestricted thread-group access; experimenting with concurrency inside sandboxed UDFs.","solutions":["Remove thread-group access/manipulation from the UDF; keep UDFs side-effect free.","Move the thread-group logic out of the UDF into normal application code (e.g. the client submitting queries).","Refactor the UDF to return data and let external code manage threads.","Only if explicitly accepted as insecure, consider allow_extra_insecure_udFs / related settings — this weakens the sandbox and is discouraged."],"exampleFix":"// before (inside a UDF)\nThread.currentThread().getThreadGroup().interrupt();\n\n// after\nreturn result; // manage thread groups outside UDF execution","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    threadGroup.checkAccess();\n} catch (AccessControlException e) {\n    logger.warn(\"ThreadGroup access denied in sandboxed UDF context: {}\", e.getMessage());\n    throw new UnsupportedOperationException(\"ThreadGroup manipulation is not permitted inside UDFs\");\n}","preventionTips":["Never enumerate or mutate thread groups from UDF code","Move concurrency management out of UDFs into client/application code","Enable and test the UDF security manager in CI to catch sandbox violations early","Treat any need for thread-group access from a UDF as a design smell"],"tags":["security","securitymanager","udf","threadgroup","sandbox"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}