{"record":{"id":"f44ddc42d26479a5","repo":"pinpoint-apm/pinpoint","slug":"access-fail-classname","errorCode":null,"errorMessage":"access fail, className=","messagePattern":"access fail, className=","errorType":"exception","errorClass":"InstrumentException","httpStatus":null,"severity":"error","filePath":"agent-module/profiler/src/main/java/com/navercorp/pinpoint/profiler/instrument/ASMInterceptorHolder.java","lineNumber":106,"sourceCode":"            final Class<?> clazz = loadClass(classLoader);\n            if (clazz == null) {\n                // defense code\n                throw new InstrumentException(\"not found interceptorHolderClass, className=\" + className);\n            }\n\n            final Method method = clazz.getDeclaredMethod(\"get\");\n            final Object o = method.invoke(null);\n            if (o instanceof Interceptor) {\n                return (Class<? extends Interceptor>) o.getClass();\n            } else {\n                throw new InstrumentException(\"not found interceptor, className=\" + className);\n            }\n        } catch (InvocationTargetException e) {\n            throw new InstrumentException(\"invocation fail, className=\" + className, e);\n        } catch (NoSuchMethodException e) {\n            throw new InstrumentException(\"not found 'get' method, className=\" + className, e);\n        } catch (IllegalAccessException e) {\n            throw new InstrumentException(\"access fail, className=\" + className, e);\n        }\n    }\n\n    public void init(Class<?> interceptorHolderClass, InterceptorFactory factory, Class<? extends Interceptor> interceptorClass, Object[] providedArguments, ScopeInfo scopeInfo, MethodDescriptor methodDescriptor) throws InstrumentException {\n        init(interceptorHolderClass, new InterceptorLazyLoadingSupplier(factory, interceptorClass, providedArguments, scopeInfo, methodDescriptor));\n    }\n\n    public void init(Class<?> interceptorHolderClass, Interceptor interceptor) throws InstrumentException {\n        init(interceptorHolderClass, new InterceptorSupplier(interceptor));\n    }\n\n    private void init(Class<?> interceptorHolderClass, Supplier<Interceptor> supplier) throws InstrumentException {\n        try {\n            final Method method = interceptorHolderClass.getDeclaredMethod(\"set\", Supplier.class);\n            method.invoke(null, supplier);\n        } catch (NoSuchMethodException e) {\n            throw new InstrumentException(\"not found 'set' method, className=\" + interceptorHolderClass.getName(), e);\n        } catch (IllegalAccessException e) {","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/pinpoint-apm/pinpoint/blob/744c3d3075e595656abb1ae331ad2c0e4c9eb996/agent-module/profiler/src/main/java/com/navercorp/pinpoint/profiler/instrument/ASMInterceptorHolder.java#L88-L124","documentation":"After finding the declared static 'get' method, loadInterceptorClass calls method.invoke(null). This InstrumentException wraps IllegalAccessException, thrown because the method is not accessible from the caller's context (e.g. the generated class is defined in another package/classloader without setAccessible, or a security manager/JPMS module blocks reflective access).","triggerScenarios":"Calling loadInterceptorClass when the holder class was defined in a classloader/package whose reflection access is denied — typically under a Java SecurityManager with restrictive policy, or on JDK 9+ strong encapsulation when crossing module/package boundaries.","commonSituations":"Running the agent on a locked-down application server with a SecurityManager, or attaching to a modular (JPMS) application where the generated holder lands in an unnamed module restricted from reflection.","solutions":["Grant reflective access to com.navercorp.pinpoint classes in the security policy or remove the SecurityManager restriction","Add --add-opens/--add-exports JVM flags for the affected package on JDK 9+","Confirm the holder class was defined by InterceptorDefineClassHelper into the intended classloader (bootstrap vs app)","Update the agent to a version matching your JDK (older agents may not handle strong encapsulation)"],"exampleFix":"// before (JDK 16+ strong encapsulation)\njava -jar app.jar\n// after\njava --add-opens java.base/java.lang=ALL-UNNAMED -jar app.jar","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    Class<? extends Interceptor> c = holder.loadInterceptorClass(classLoader);\n} catch (InstrumentException e) {\n    if (e.getCause() instanceof IllegalAccessException) {\n        logger.error(\"reflective access denied for {}; add --add-opens or relax SecurityManager\", holder.getClassName());\n    }\n}","preventionTips":["Avoid SecurityManager-restricted environments or whitelist pinpoint packages in policy","On JDK 9+ add --add-opens java.base/java.lang=ALL-UNNAMED when attaching","Use an agent version validated against your JDK"],"tags":["reflection","security","classloader"],"backgroundTag":"permission-denied","analyzedSha":"744c3d3075e595656abb1ae331ad2c0e4c9eb996","analyzedAt":"2026-09-07T18:48:45.289Z","contentChangedAt":"2026-09-07T18:48:45.289Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}