{"record":{"id":"f8cd3a85409d836f","repo":"apache/cassandra","slug":"access-denied-f8cd3a","errorCode":null,"errorMessage":"Access denied","messagePattern":"Access denied","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java","lineNumber":211,"sourceCode":"        if (isSecuredThread())\n            throw new AccessControlException(\"access denied: \" + MODIFY_THREAD_PERMISSION, MODIFY_THREAD_PERMISSION);\n        super.checkAccess(t);\n    }\n\n    public void checkAccess(ThreadGroup g)\n    {\n        // need to override since the default implementation only checks the permission if the current thread's\n        // in the root-thread-group\n\n        if (isSecuredThread())\n            throw new AccessControlException(\"access denied: \" + MODIFY_THREADGROUP_PERMISSION, MODIFY_THREADGROUP_PERMISSION);\n        super.checkAccess(g);\n    }\n\n    public void checkPermission(Permission perm)\n    {\n        if (!DatabaseDescriptor.enableUserDefinedFunctionsThreads() && !DatabaseDescriptor.allowExtraInsecureUDFs() && SET_SECURITY_MANAGER_PERMISSION.equals(perm))\n            throw new AccessControlException(\"Access denied\");\n\n        if (!isSecuredThread())\n            return;\n\n        // required by JavaDriver 2.2.0-rc3 and 3.0.0-a2 or newer\n        // code in com.datastax.driver.core.CodecUtils uses Guava stuff, which in turns requires this permission\n        // TODO: Evaluate removing this once the driver is removed as a dependency (see CASSANDRA-20326).\n        if (CHECK_MEMBER_ACCESS_PERMISSION.equals(perm))\n            return;\n\n        // Nashorn / Java 11\n        if (NASHORN_GLOBAL_PERMISSION.equals(perm))\n            return;\n        if (SUPPRESS_ACCESS_CHECKS_PERMISSION.equals(perm))\n            return;\n        if (DYNALINK_LOOKUP_PERMISSION.equals(perm))\n            return;\n        if (GET_CLASSLOADER_PERMISSION.equals(perm))","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java#L193-L229","documentation":"ThreadAwareSecurityManager.checkPermission throws AccessControlException(\"Access denied\") when code running in a secured UDF thread tries to set the JVM SecurityManager. This is only allowed when user-defined-function threads are enabled AND extra insecure UDF permissions are explicitly allowed. It is a deliberate sandbox guard preventing UDF code from replacing or disabling Cassandra's security manager.","triggerScenarios":"A user-defined function (or driver/Guava code invoked from a UDF thread) calls System.setSecurityManager() while enableUserDefinedFunctionsThreads is false (or allowExtraInsecureUDFs is false), so the SET_SECURITY_MANAGER_PERMISSION check in checkPermission (src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java:211) rejects it.","commonSituations":"UDFs that attempt privileged operations like installing a security manager; enabling UDFs without udf_enabled / allow_extra_insecure_udfs flags in cassandra.yaml; upgrading clusters where UDF sandboxing became stricter.","solutions":["Do not call System.setSecurityManager() from UDF code; it is forbidden by the sandbox.","If you genuinely need it, set enable_user_defined_functions_threads: true and allow_extra_insecure_udfs: true in cassandra.yaml, understanding the security risk.","Move the privileged operation out of the UDF and into application code talking to Cassandra via a client.","Run the cluster without user-defined functions if untrusted code must never execute."],"exampleFix":"// before (inside UDF)\nSystem.setSecurityManager(null); // throws AccessControlException\n// after\n// remove the call; perform privileged setup outside UDFs, or enable\n// enable_user_defined_functions_threads + allow_extra_insecure_udfs in cassandra.yaml","handlingStrategy":"try-catch","validationCode":"boolean canSetSecurityManager = DatabaseDescriptor.enableUserDefinedFunctionsThreads() && DatabaseDescriptor.allowExtraInsecureUDFs();\nif (!canSetSecurityManager) throw new IllegalStateException(\"setSecurityManager not permitted in UDF threads\");","typeGuard":null,"tryCatchPattern":"try { System.setSecurityManager(sm); } catch (AccessControlException e) { log.warn(\"SecurityManager change blocked in UDF sandbox\", e); }","preventionTips":["Never call System.setSecurityManager from UDF code","Keep UDF logic to pure computation over column values","Only enable allow_extra_insecure_udfs on trusted, non-production clusters","Review UDF source for privileged API usage before deploying"],"tags":["security","udf","sandbox","permission"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}