Bundled Elasticsearch throws "access denied" errors on Windows installations when symbolic link is used
Platform notice: Server and Data Center only. This article only applies to Atlassian products on the Server and Data Center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Problem
When using the bundled Elasticsearch with a Bitbucket Server instance installed on Windows, if a symlink is set up anywhere on the Bitbucket Home the Elasticsearch service will not start, and the following error is thrown in the bitbucket_search.log file:
[2019-10-04T08:22:02,595][ERROR][o.e.b.Bootstreap ] [bitbucket_bundled]Exception
java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Path\to\Bitbucket_home\shared\data\nodes\0" "write")
Cause
When attempting to manipulate the contents of the shared Bitbucket home directory, the Java process is blocked because it doesn't have the appropriate permissions on the directory. This is due to the files technically belonging to a different directory because of the symbolic link that was placed on the Bitbucket Home.
Resolution
Resolution
Add the following line to the %JAVA_HOME%/lib/security/java.policy file for the JDK being used by the Elasticsearch Windows service and then restart the Elasticsearch service:
permission java.io.FilePermission "C:\\Path\\to\\Bitbucket_home\\shared-", "read,write,delete,execute";
Be sure to replace the token C:\\Path\\to\\Bitbucket_home\\shared with the actual path to the "shared" directory in your Bitbucket home, while also being sure to not remove the hyphen at the end of this path.