Ensure that plugins that utilize dumpCoverage can write to jacoco.dir when tests.security.manager is enabled

CHANGELOG.md

@@ -13,6 +13,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 ### Fixed
 - Fix unnecessary refreshes on update preparation failures ([#15261](https://github.com/opensearch-project/OpenSearch/issues/15261))
 - Fix NullPointerException in segment replicator ([#18997](https://github.com/opensearch-project/OpenSearch/pull/18997))
+- Ensure that plugins that utilize dumpCoverage can write to jacoco.dir when tests.security.manager is enabled ([#18983](https://github.com/opensearch-project/OpenSearch/pull/18983))
 
 ### Dependencies
 - Bump `com.netflix.nebula.ospackage-base` from 12.0.0 to 12.1.0 ([#19019](https://github.com/opensearch-project/OpenSearch/pull/19019))

test/framework/src/main/java/org/opensearch/bootstrap/BootstrapForTesting.java

@@ -148,6 +148,16 @@ public class BootstrapForTesting {
                 Security.addClasspathPermissions(perms);
                 // java.io.tmpdir
                 FilePermissionUtils.addDirectoryPath(perms, "java.io.tmpdir", javaTmpDir, "read,readlink,write,delete", false);
+                String jacocoDir = System.getProperty("jacoco.dir");
+                if (jacocoDir != null) {
+                    FilePermissionUtils.addDirectoryPath(
+                        perms,
+                        "jacoco.dir",
+                        PathUtils.get(jacocoDir),
+                        "read,readlink,write,delete",
+                        false
+                    );
+                }
                 // custom test config file
                 String testConfigFile = System.getProperty("tests.config");
                 if (Strings.hasLength(testConfigFile)) {