[KAFKA-13337] Scanning for Connect plugins can fail with AccessDeniedException

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.7.1, 2.6.2, 3.1.0, 2.8.1
• Fix Version/s: 3.6.0
• Component/s: connect
• Assignee: Andras Katona
• Reporter: Tamás Héri
• Created: 30/Sep/21 15:45
• Updated: 02/Jun/23 07:46
• Resolved: 30/May/23 16:00

Description

During Connect plugin path scan, if an unreadable file/directory is found, Connect will fail with an AccessDeniedException. As the directories/files can be unreadable, it is best to skip them in this case. See referenced PR.

 

java.nio.file.AccessDeniedException: /tmp/junit8905851398112785578/plugins/.protected
	at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:116)
	at java.base/sun.nio.fs.UnixFileSystemProvider.newDirectoryStream(UnixFileSystemProvider.java:432)
	at java.base/java.nio.file.Files.newDirectoryStream(Files.java:604)
	at org.apache.kafka.connect.runtime.isolation.PluginUtils.pluginUrls(PluginUtils.java:276)
	at org.apache.kafka.connect.runtime.isolation.PluginUtilsTest.testPluginUrlsWithProtectedDirectory(PluginUtilsTest.java:481)
...

Connect server fails with the following exception, (I created an "aaa" directory only readable by root

Could not get listing for plugin path: /var/lib/kafka. Ignoring.
java.nio.file.AccessDeniedException: /var/lib/kafka/aaaa
	at sun.nio.fs.UnixException.translateToIOException(UnixException.java:84)
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
	at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
	at sun.nio.fs.UnixFileSystemProvider.newDirectoryStream(UnixFileSystemProvider.java:427)
	at java.nio.file.Files.newDirectoryStream(Files.java:589)
	at org.apache.kafka.connect.runtime.isolation.PluginUtils.pluginUrls(PluginUtils.java:231)
	at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.registerPlugin(DelegatingClassLoader.java:241)
	at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.initPluginLoader(DelegatingClassLoader.java:222)
	at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.initLoaders(DelegatingClassLoader.java:199)
	at org.apache.kafka.connect.runtime.isolation.Plugins.<init>(Plugins.java:60)
	at org.apache.kafka.connect.cli.ConnectDistributed.startConnect(ConnectDistributed.java:91)

Additional note:
Connect server would not stop normally but an extension couldn't be found because of this in my case which killed connect at later point.

Issue Links

• relates to: KAFKA-14627 Modernize Connect plugin discovery
• links to: GitHub Pull Request #11371
• links to: GitHub Pull Request #13733