elasticsearch --version shouldn't produce mbeans error

[jacobweber]

Elasticsearch version: 5.2.0, 5.4.0

Plugins installed: [x-pack]

JVM version (java -version): 1.8.0_131

OS version (uname -a if on a Unix-like system): CentOS 6.9, 2.6.32-696.3.1.el6.x86_64

Description of the problem including expected versus actual behavior:
When I run elasticsearch --version as a user other than elasticsearch, I get a "Could not register mbeans" message. Very minor, but confusing.

Steps to reproduce:

1. Install elasticsearch via yum
2. Install x-pack: /usr/share/elasticsearch/bin/elasticsearch-plugin install x-pack --batch
3. Run /usr/share/elasticsearch/bin/elasticsearch --version as a user other than root or elasticsearch.

Provide logs (if relevant):

2017-07-22 22:03:13,526 main ERROR Could not register mbeans java.security.AccessControlException: access denied ("javax.management.MBeanTrustPermission" "register")
	at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
	at java.lang.SecurityManager.checkPermission(SecurityManager.java:585)
	at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.checkMBeanTrustPermission(DefaultMBeanServerInterceptor.java:1848)
	at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.registerMBean(DefaultMBeanServerInterceptor.java:322)
	at com.sun.jmx.mbeanserver.JmxMBeanServer.registerMBean(JmxMBeanServer.java:522)
	at org.apache.logging.log4j.core.jmx.Server.register(Server.java:389)
	at org.apache.logging.log4j.core.jmx.Server.reregisterMBeansAfterReconfigure(Server.java:167)
	at org.apache.logging.log4j.core.jmx.Server.reregisterMBeansAfterReconfigure(Server.java:140)
	at org.apache.logging.log4j.core.LoggerContext.setConfiguration(LoggerContext.java:556)
	at org.apache.logging.log4j.core.LoggerContext.start(LoggerContext.java:261)
	at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:206)
	at org.apache.logging.log4j.core.config.Configurator.initialize(Configurator.java:221)
	at org.apache.logging.log4j.core.config.Configurator.initialize(Configurator.java:197)
	at org.elasticsearch.common.logging.LogConfigurator.configureStatusLogger(LogConfigurator.java:126)
	at org.elasticsearch.common.logging.LogConfigurator.configureWithoutConfig(LogConfigurator.java:68)
	at org.elasticsearch.cli.Command.main(Command.java:85)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:91)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:84)

Version: 5.4.0, Build: 780f8c4/2017-04-28T17:43:27.229Z, JVM: 1.8.0_131

If I run sudo -u elasticsearch /usr/share/elasticsearch/bin/elasticsearch --version, I don't get this error.

Seems similar to #21932, but I haven't modified the init.d script.

[tlrx]

@jacobweber I think #21932 answers your question. You installed elasticsearch using the RPM package which creates a default elasticsearch user and sets required permissions for this user on the config, logs and data directories.

When running elasticsearch --version as root or elasticsearch user, Elasticsearch looks for the jvm.options file in the configuration directory in order to initialize the logging system with the -Dlog4j2.disable.jmx=true option. If you execute the same command using a different user, then it cannot access to this jvm.options file because the current user has no read permission on the file (or its parent directory): the logger is then initialized using the default settings (in which by default JMX beans are enabled) and fails with the error you reported.

I agree the message is confusing, but I'm afraid there's not much we can do here because the exception is caught and logged in Log4j directly and is not propagated to Elasticsearch.

[jasontedor]

@tlrx has it right, closing.