From cca827e111897193efd878ec92da3080bc4e3588 Mon Sep 17 00:00:00 2001 From: Andriy Redko Date: Tue, 17 Feb 2026 13:46:10 -0500 Subject: [PATCH] [GRPC] Add accessUnixDomainSocket permission for transport-grpc Signed-off-by: Andriy Redko --- CHANGELOG.md | 2 +- .../src/main/plugin-metadata/plugin-security.policy | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8587f69d71ff1..0cd81b0288c6d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), - Add getWrappedScorer method to ProfileScorer for plugin access to wrapped scorers ([#20548](https://github.com/opensearch-project/OpenSearch/issues/20548)) - Support expected cluster name with validation in CCS Sniff mode ([#20532](https://github.com/opensearch-project/OpenSearch/pull/20532)) - Choose the best performing node when writing with append-only index ([#20065](https://github.com/opensearch-project/OpenSearch/pull/20065)) -- Add security policy to allow `accessUnixDomainSocket` in `transport-grpc` module ([#20463](https://github.com/opensearch-project/OpenSearch/pull/20463)) +- Add security policy to allow `accessUnixDomainSocket` in `transport-grpc` module ([#20463](https://github.com/opensearch-project/OpenSearch/pull/20463), [#20649](https://github.com/opensearch-project/OpenSearch/pull/20649)) - Add range validations in query builder and field mapper ([#20497](https://github.com/opensearch-project/OpenSearch/issues/20497)) - [Workload Management] Enhance Scroll API support for autotagging ([#20151](https://github.com/opensearch-project/OpenSearch/pull/20151)) - Add indices to search request slowlog ([#20588](https://github.com/opensearch-project/OpenSearch/pull/20588)) diff --git a/modules/transport-grpc/src/main/plugin-metadata/plugin-security.policy b/modules/transport-grpc/src/main/plugin-metadata/plugin-security.policy index 394379e3d85f7..363cbc4999cd2 100644 --- a/modules/transport-grpc/src/main/plugin-metadata/plugin-security.policy +++ b/modules/transport-grpc/src/main/plugin-metadata/plugin-security.policy @@ -6,7 +6,7 @@ * compatible open source license. */ -grant codeBase "${codebase.grpc-netty-shaded}" { +grant { // for reading the system-wide configuration for the backlog of established sockets permission java.io.FilePermission "/proc/sys/net/core/somaxconn", "read";