Skip to content

Commit 77f30d9

Browse files
moschemosche
authored
Add entitlement checks for java.io stream classes (elastic#122406) (elastic#122843)
1 parent 93c5bac commit 77f30d9

File tree

8 files changed

+291
-0
lines changed

8 files changed

+291
-0
lines changed

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
package org.elasticsearch.entitlement.bridge;
1111

1212
import java.io.File;
13+
import java.io.FileDescriptor;
1314
import java.io.FileFilter;
1415
import java.io.FilenameFilter;
1516
import java.io.InputStream;
@@ -510,14 +511,54 @@ public interface EntitlementChecker {
510511

511512
void check$java_io_File$setWritable(Class<?> callerClass, File file, boolean writable, boolean ownerOnly);
512513

514+
void check$java_io_FileInputStream$(Class<?> callerClass, File file);
515+
516+
void check$java_io_FileInputStream$(Class<?> callerClass, FileDescriptor fd);
517+
518+
void check$java_io_FileInputStream$(Class<?> callerClass, String name);
519+
513520
void check$java_io_FileOutputStream$(Class<?> callerClass, File file);
514521

515522
void check$java_io_FileOutputStream$(Class<?> callerClass, File file, boolean append);
516523

524+
void check$java_io_FileOutputStream$(Class<?> callerClass, FileDescriptor fd);
525+
517526
void check$java_io_FileOutputStream$(Class<?> callerClass, String name);
518527

519528
void check$java_io_FileOutputStream$(Class<?> callerClass, String name, boolean append);
520529

530+
void check$java_io_FileReader$(Class<?> callerClass, File file);
531+
532+
void check$java_io_FileReader$(Class<?> callerClass, File file, Charset charset);
533+
534+
void check$java_io_FileReader$(Class<?> callerClass, FileDescriptor fd);
535+
536+
void check$java_io_FileReader$(Class<?> callerClass, String name);
537+
538+
void check$java_io_FileReader$(Class<?> callerClass, String name, Charset charset);
539+
540+
void check$java_io_FileWriter$(Class<?> callerClass, File file);
541+
542+
void check$java_io_FileWriter$(Class<?> callerClass, File file, boolean append);
543+
544+
void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset);
545+
546+
void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset, boolean append);
547+
548+
void check$java_io_FileWriter$(Class<?> callerClass, FileDescriptor fd);
549+
550+
void check$java_io_FileWriter$(Class<?> callerClass, String name);
551+
552+
void check$java_io_FileWriter$(Class<?> callerClass, String name, boolean append);
553+
554+
void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset);
555+
556+
void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset, boolean append);
557+
558+
void check$java_io_RandomAccessFile$(Class<?> callerClass, String name, String mode);
559+
560+
void check$java_io_RandomAccessFile$(Class<?> callerClass, File file, String mode);
561+
521562
void check$java_util_Scanner$(Class<?> callerClass, File source);
522563

523564
void check$java_util_Scanner$(Class<?> callerClass, File source, String charsetName);

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,22 @@
1313
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
1414

1515
import java.io.File;
16+
import java.io.FileDescriptor;
17+
import java.io.FileInputStream;
1618
import java.io.FileNotFoundException;
1719
import java.io.FileOutputStream;
20+
import java.io.FileReader;
21+
import java.io.FileWriter;
1822
import java.io.IOException;
23+
import java.io.RandomAccessFile;
1924
import java.nio.charset.StandardCharsets;
2025
import java.nio.file.Files;
2126
import java.nio.file.Path;
2227
import java.nio.file.Paths;
2328
import java.nio.file.attribute.UserPrincipal;
2429
import java.util.Scanner;
2530

31+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;
2632
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
2733

2834
@SuppressForbidden(reason = "Explicitly checking APIs that are forbidden")
@@ -216,6 +222,21 @@ static void createScannerFileWithCharsetName() throws FileNotFoundException {
216222
new Scanner(readFile().toFile(), "UTF-8");
217223
}
218224

225+
@EntitlementTest(expectedAccess = PLUGINS)
226+
static void createFileInputStreamFile() throws IOException {
227+
new FileInputStream(readFile().toFile()).close();
228+
}
229+
230+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
231+
static void createFileInputStreamFileDescriptor() throws IOException {
232+
new FileInputStream(FileDescriptor.in).close();
233+
}
234+
235+
@EntitlementTest(expectedAccess = PLUGINS)
236+
static void createFileInputStreamString() throws IOException {
237+
new FileInputStream(readFile().toString()).close();
238+
}
239+
219240
@EntitlementTest(expectedAccess = PLUGINS)
220241
static void createFileOutputStreamString() throws IOException {
221242
new FileOutputStream(readWriteFile().toString()).close();
@@ -236,6 +257,96 @@ static void createFileOutputStreamFileWithAppend() throws IOException {
236257
new FileOutputStream(readWriteFile().toFile(), false).close();
237258
}
238259

260+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
261+
static void createFileOutputStreamFileDescriptor() throws IOException {
262+
new FileOutputStream(FileDescriptor.out).close();
263+
}
264+
265+
@EntitlementTest(expectedAccess = PLUGINS)
266+
static void createFileReaderFile() throws IOException {
267+
new FileReader(readFile().toFile()).close();
268+
}
269+
270+
@EntitlementTest(expectedAccess = PLUGINS)
271+
static void createFileReaderFileCharset() throws IOException {
272+
new FileReader(readFile().toFile(), StandardCharsets.UTF_8).close();
273+
}
274+
275+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
276+
static void createFileReaderFileDescriptor() throws IOException {
277+
new FileReader(FileDescriptor.in).close();
278+
}
279+
280+
@EntitlementTest(expectedAccess = PLUGINS)
281+
static void createFileReaderString() throws IOException {
282+
new FileReader(readFile().toString()).close();
283+
}
284+
285+
@EntitlementTest(expectedAccess = PLUGINS)
286+
static void createFileReaderStringCharset() throws IOException {
287+
new FileReader(readFile().toString(), StandardCharsets.UTF_8).close();
288+
}
289+
290+
@EntitlementTest(expectedAccess = PLUGINS)
291+
static void createFileWriterFile() throws IOException {
292+
new FileWriter(readWriteFile().toFile()).close();
293+
}
294+
295+
@EntitlementTest(expectedAccess = PLUGINS)
296+
static void createFileWriterFileWithAppend() throws IOException {
297+
new FileWriter(readWriteFile().toFile(), false).close();
298+
}
299+
300+
@EntitlementTest(expectedAccess = PLUGINS)
301+
static void createFileWriterFileCharsetWithAppend() throws IOException {
302+
new FileWriter(readWriteFile().toFile(), StandardCharsets.UTF_8, false).close();
303+
}
304+
305+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
306+
static void createFileWriterFileDescriptor() throws IOException {
307+
new FileWriter(FileDescriptor.out).close();
308+
}
309+
310+
@EntitlementTest(expectedAccess = PLUGINS)
311+
static void createFileWriterString() throws IOException {
312+
new FileWriter(readWriteFile().toString()).close();
313+
}
314+
315+
@EntitlementTest(expectedAccess = PLUGINS)
316+
static void createFileWriterStringWithAppend() throws IOException {
317+
new FileWriter(readWriteFile().toString(), false).close();
318+
}
319+
320+
@EntitlementTest(expectedAccess = PLUGINS)
321+
static void createFileWriterStringCharset() throws IOException {
322+
new FileWriter(readWriteFile().toString(), StandardCharsets.UTF_8).close();
323+
}
324+
325+
@EntitlementTest(expectedAccess = PLUGINS)
326+
static void createFileWriterStringCharsetWithAppend() throws IOException {
327+
new FileWriter(readWriteFile().toString(), StandardCharsets.UTF_8, false).close();
328+
}
329+
330+
@EntitlementTest(expectedAccess = PLUGINS)
331+
static void createRandomAccessFileStringRead() throws IOException {
332+
new RandomAccessFile(readFile().toString(), "r").close();
333+
}
334+
335+
@EntitlementTest(expectedAccess = PLUGINS)
336+
static void createRandomAccessFileStringReadWrite() throws IOException {
337+
new RandomAccessFile(readWriteFile().toString(), "rw").close();
338+
}
339+
340+
@EntitlementTest(expectedAccess = PLUGINS)
341+
static void createRandomAccessFileRead() throws IOException {
342+
new RandomAccessFile(readFile().toFile(), "r").close();
343+
}
344+
345+
@EntitlementTest(expectedAccess = PLUGINS)
346+
static void createRandomAccessFileReadWrite() throws IOException {
347+
new RandomAccessFile(readWriteFile().toFile(), "rw").close();
348+
}
349+
239350
@EntitlementTest(expectedAccess = PLUGINS)
240351
static void filesGetOwner() throws IOException {
241352
Files.getOwner(readFile());

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import org.elasticsearch.entitlement.runtime.policy.PolicyManager;
1515

1616
import java.io.File;
17+
import java.io.FileDescriptor;
1718
import java.io.FileFilter;
1819
import java.io.FilenameFilter;
1920
import java.io.IOException;
@@ -1016,6 +1017,21 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
10161017
policyManager.checkFileWrite(callerClass, file);
10171018
}
10181019

1020+
@Override
1021+
public void check$java_io_FileInputStream$(Class<?> callerClass, File file) {
1022+
policyManager.checkFileRead(callerClass, file);
1023+
}
1024+
1025+
@Override
1026+
public void check$java_io_FileInputStream$(Class<?> callerClass, FileDescriptor fd) {
1027+
policyManager.checkFileDescriptorRead(callerClass);
1028+
}
1029+
1030+
@Override
1031+
public void check$java_io_FileInputStream$(Class<?> callerClass, String name) {
1032+
policyManager.checkFileRead(callerClass, new File(name));
1033+
}
1034+
10191035
@Override
10201036
public void check$java_io_FileOutputStream$(Class<?> callerClass, String name) {
10211037
policyManager.checkFileWrite(callerClass, new File(name));
@@ -1036,6 +1052,99 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
10361052
policyManager.checkFileWrite(callerClass, file);
10371053
}
10381054

1055+
@Override
1056+
public void check$java_io_FileOutputStream$(Class<?> callerClass, FileDescriptor fd) {
1057+
policyManager.checkFileDescriptorWrite(callerClass);
1058+
}
1059+
1060+
@Override
1061+
public void check$java_io_FileReader$(Class<?> callerClass, File file) {
1062+
policyManager.checkFileRead(callerClass, file);
1063+
}
1064+
1065+
@Override
1066+
public void check$java_io_FileReader$(Class<?> callerClass, File file, Charset charset) {
1067+
policyManager.checkFileRead(callerClass, file);
1068+
}
1069+
1070+
@Override
1071+
public void check$java_io_FileReader$(Class<?> callerClass, FileDescriptor fd) {
1072+
policyManager.checkFileDescriptorRead(callerClass);
1073+
}
1074+
1075+
@Override
1076+
public void check$java_io_FileReader$(Class<?> callerClass, String name) {
1077+
policyManager.checkFileRead(callerClass, new File(name));
1078+
}
1079+
1080+
@Override
1081+
public void check$java_io_FileReader$(Class<?> callerClass, String name, Charset charset) {
1082+
policyManager.checkFileRead(callerClass, new File(name));
1083+
}
1084+
1085+
@Override
1086+
public void check$java_io_FileWriter$(Class<?> callerClass, File file) {
1087+
policyManager.checkFileWrite(callerClass, file);
1088+
}
1089+
1090+
@Override
1091+
public void check$java_io_FileWriter$(Class<?> callerClass, File file, boolean append) {
1092+
policyManager.checkFileWrite(callerClass, file);
1093+
}
1094+
1095+
@Override
1096+
public void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset) {
1097+
policyManager.checkFileWrite(callerClass, file);
1098+
}
1099+
1100+
@Override
1101+
public void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset, boolean append) {
1102+
policyManager.checkFileWrite(callerClass, file);
1103+
}
1104+
1105+
@Override
1106+
public void check$java_io_FileWriter$(Class<?> callerClass, FileDescriptor fd) {
1107+
policyManager.checkFileDescriptorWrite(callerClass);
1108+
}
1109+
1110+
@Override
1111+
public void check$java_io_FileWriter$(Class<?> callerClass, String name) {
1112+
policyManager.checkFileWrite(callerClass, new File(name));
1113+
}
1114+
1115+
@Override
1116+
public void check$java_io_FileWriter$(Class<?> callerClass, String name, boolean append) {
1117+
policyManager.checkFileWrite(callerClass, new File(name));
1118+
}
1119+
1120+
@Override
1121+
public void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset) {
1122+
policyManager.checkFileWrite(callerClass, new File(name));
1123+
}
1124+
1125+
@Override
1126+
public void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset, boolean append) {
1127+
policyManager.checkFileWrite(callerClass, new File(name));
1128+
}
1129+
1130+
@Override
1131+
public void check$java_io_RandomAccessFile$(Class<?> callerClass, String name, String mode) {
1132+
if (mode.equals("r")) {
1133+
policyManager.checkFileRead(callerClass, new File(name));
1134+
} else {
1135+
policyManager.checkFileWrite(callerClass, new File(name));
1136+
}
1137+
}
1138+
1139+
@Override
1140+
public void check$java_io_RandomAccessFile$(Class<?> callerClass, File file, String mode) {
1141+
if (mode.equals("r")) {
1142+
policyManager.checkFileRead(callerClass, file);
1143+
} else {
1144+
policyManager.checkFileWrite(callerClass, file);
1145+
}
1146+
}
1147+
10391148
@Override
10401149
public void check$java_util_Scanner$(Class<?> callerClass, File source) {
10411150
policyManager.checkFileRead(callerClass, source);

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -304,6 +304,14 @@ public void checkFileWrite(Class<?> callerClass, Path path) {
304304
}
305305
}
306306

307+
public void checkFileDescriptorRead(Class<?> callerClass) {
308+
neverEntitled(callerClass, () -> "read file descriptor");
309+
}
310+
311+
public void checkFileDescriptorWrite(Class<?> callerClass) {
312+
neverEntitled(callerClass, () -> "write file descriptor");
313+
}
314+
307315
/**
308316
* Invoked when we try to get an arbitrary {@code FileAttributeView} class. Such a class can modify attributes, like owner etc.;
309317
* we could think about introducing checks for each of the operations, but for now we over-approximate this and simply deny when it is

‎modules/ingest-geoip/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
com.maxmind.db:
2+
- files:
3+
- relative_path: "ingest-geoip/"
4+
relative_to: "config"
5+
mode: "read_write"

‎modules/repository-s3/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
11
ALL-UNNAMED:
22
- manage_threads
33
- outbound_network
4+
- files:
5+
- relative_path: "repository-s3/aws-web-identity-token-file"
6+
relative_to: "config"
7+
mode: "read"

‎x-pack/plugin/blob-cache/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
org.elasticsearch.blobcache:
2+
- files:
3+
- relative_path: "shared_snapshot_cache"
4+
relative_to: "data"
5+
mode: "read_write"

‎x-pack/plugin/watcher/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,10 @@
11
ALL-UNNAMED:
22
- manage_threads
3+
- files:
4+
- relative_path: ".mime.types"
5+
relative_to: "home"
6+
mode: "read"
7+
- relative_path: ".mailcap"
8+
relative_to: "home"
9+
mode: "read"
10+

0 commit comments

Comments
 (0)