Skip to content

Commit e2bde8a

Browse files
moscherjernst
mosche
and
rjernst
authored
Instrument methods on File that require read permissions (elastic#122544) (elastic#122862)
This commit adds instrumentation for File methods that require read permissions. see elastic#122109 for the write side (cherry picked from commit bf1cbb0) # Conflicts: # x-pack/plugin/security/src/main/plugin-metadata/entitlement-policy.yaml Co-authored-by: Ryan Ernst <[email protected]>
1 parent aaa09e1 commit e2bde8a

File tree

6 files changed

+187
-0
lines changed

6 files changed

+187
-0
lines changed

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@
1010
package org.elasticsearch.entitlement.bridge;
1111

1212
import java.io.File;
13+
import java.io.FileFilter;
14+
import java.io.FilenameFilter;
1315
import java.io.InputStream;
1416
import java.io.PrintStream;
1517
import java.io.PrintWriter;
@@ -450,6 +452,12 @@ public interface EntitlementChecker {
450452
//
451453

452454
// old io (ie File)
455+
void check$java_io_File$canExecute(Class<?> callerClass, File file);
456+
457+
void check$java_io_File$canRead(Class<?> callerClass, File file);
458+
459+
void check$java_io_File$canWrite(Class<?> callerClass, File file);
460+
453461
void check$java_io_File$createNewFile(Class<?> callerClass, File file);
454462

455463
void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix, File directory);
@@ -458,6 +466,28 @@ public interface EntitlementChecker {
458466

459467
void check$java_io_File$deleteOnExit(Class<?> callerClass, File file);
460468

469+
void check$java_io_File$exists(Class<?> callerClass, File file);
470+
471+
void check$java_io_File$isDirectory(Class<?> callerClass, File file);
472+
473+
void check$java_io_File$isFile(Class<?> callerClass, File file);
474+
475+
void check$java_io_File$isHidden(Class<?> callerClass, File file);
476+
477+
void check$java_io_File$lastModified(Class<?> callerClass, File file);
478+
479+
void check$java_io_File$length(Class<?> callerClass, File file);
480+
481+
void check$java_io_File$list(Class<?> callerClass, File file);
482+
483+
void check$java_io_File$list(Class<?> callerClass, File file, FilenameFilter filter);
484+
485+
void check$java_io_File$listFiles(Class<?> callerClass, File file);
486+
487+
void check$java_io_File$listFiles(Class<?> callerClass, File file, FileFilter filter);
488+
489+
void check$java_io_File$listFiles(Class<?> callerClass, File file, FilenameFilter filter);
490+
461491
void check$java_io_File$mkdir(Class<?> callerClass, File file);
462492

463493
void check$java_io_File$mkdirs(Class<?> callerClass, File file);

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,21 @@ static Path readWriteFile() {
4646
return testRootDir.resolve("read_write_file");
4747
}
4848

49+
@EntitlementTest(expectedAccess = PLUGINS)
50+
static void fileCanExecute() throws IOException {
51+
readFile().toFile().canExecute();
52+
}
53+
54+
@EntitlementTest(expectedAccess = PLUGINS)
55+
static void fileCanRead() throws IOException {
56+
readFile().toFile().canRead();
57+
}
58+
59+
@EntitlementTest(expectedAccess = PLUGINS)
60+
static void fileCanWrite() throws IOException {
61+
readFile().toFile().canWrite();
62+
}
63+
4964
@EntitlementTest(expectedAccess = PLUGINS)
5065
static void fileCreateNewFile() throws IOException {
5166
readWriteDir().resolve("new_file").toFile().createNewFile();
@@ -70,6 +85,61 @@ static void fileDeleteOnExit() throws IOException {
7085
toDelete.toFile().deleteOnExit();
7186
}
7287

88+
@EntitlementTest(expectedAccess = PLUGINS)
89+
static void fileExists() throws IOException {
90+
readFile().toFile().exists();
91+
}
92+
93+
@EntitlementTest(expectedAccess = PLUGINS)
94+
static void fileIsDirectory() throws IOException {
95+
readFile().toFile().isDirectory();
96+
}
97+
98+
@EntitlementTest(expectedAccess = PLUGINS)
99+
static void fileIsFile() throws IOException {
100+
readFile().toFile().isFile();
101+
}
102+
103+
@EntitlementTest(expectedAccess = PLUGINS)
104+
static void fileIsHidden() throws IOException {
105+
readFile().toFile().isHidden();
106+
}
107+
108+
@EntitlementTest(expectedAccess = PLUGINS)
109+
static void fileLastModified() throws IOException {
110+
readFile().toFile().lastModified();
111+
}
112+
113+
@EntitlementTest(expectedAccess = PLUGINS)
114+
static void fileLength() throws IOException {
115+
readFile().toFile().length();
116+
}
117+
118+
@EntitlementTest(expectedAccess = PLUGINS)
119+
static void fileList() throws IOException {
120+
readDir().toFile().list();
121+
}
122+
123+
@EntitlementTest(expectedAccess = PLUGINS)
124+
static void fileListWithFilter() throws IOException {
125+
readDir().toFile().list((dir, name) -> true);
126+
}
127+
128+
@EntitlementTest(expectedAccess = PLUGINS)
129+
static void fileListFiles() throws IOException {
130+
readDir().toFile().listFiles();
131+
}
132+
133+
@EntitlementTest(expectedAccess = PLUGINS)
134+
static void fileListFilesWithFileFilter() throws IOException {
135+
readDir().toFile().listFiles(pathname -> true);
136+
}
137+
138+
@EntitlementTest(expectedAccess = PLUGINS)
139+
static void fileListFilesWithFilenameFilter() throws IOException {
140+
readDir().toFile().listFiles((dir, name) -> true);
141+
}
142+
73143
@EntitlementTest(expectedAccess = PLUGINS)
74144
static void fileMkdir() throws IOException {
75145
Path mkdir = readWriteDir().resolve("mkdir");

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
import org.elasticsearch.entitlement.runtime.policy.PolicyManager;
1515

1616
import java.io.File;
17+
import java.io.FileFilter;
18+
import java.io.FilenameFilter;
1719
import java.io.IOException;
1820
import java.io.InputStream;
1921
import java.io.PrintStream;
@@ -868,6 +870,21 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
868870

869871
// old io (ie File)
870872

873+
@Override
874+
public void check$java_io_File$canExecute(Class<?> callerClass, File file) {
875+
policyManager.checkFileRead(callerClass, file);
876+
}
877+
878+
@Override
879+
public void check$java_io_File$canRead(Class<?> callerClass, File file) {
880+
policyManager.checkFileRead(callerClass, file);
881+
}
882+
883+
@Override
884+
public void check$java_io_File$canWrite(Class<?> callerClass, File file) {
885+
policyManager.checkFileRead(callerClass, file);
886+
}
887+
871888
@Override
872889
public void check$java_io_File$createNewFile(Class<?> callerClass, File file) {
873890
policyManager.checkFileWrite(callerClass, file);
@@ -888,6 +905,61 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
888905
policyManager.checkFileWrite(callerClass, file);
889906
}
890907

908+
@Override
909+
public void check$java_io_File$exists(Class<?> callerClass, File file) {
910+
policyManager.checkFileRead(callerClass, file);
911+
}
912+
913+
@Override
914+
public void check$java_io_File$isDirectory(Class<?> callerClass, File file) {
915+
policyManager.checkFileRead(callerClass, file);
916+
}
917+
918+
@Override
919+
public void check$java_io_File$isFile(Class<?> callerClass, File file) {
920+
policyManager.checkFileRead(callerClass, file);
921+
}
922+
923+
@Override
924+
public void check$java_io_File$isHidden(Class<?> callerClass, File file) {
925+
policyManager.checkFileRead(callerClass, file);
926+
}
927+
928+
@Override
929+
public void check$java_io_File$lastModified(Class<?> callerClass, File file) {
930+
policyManager.checkFileRead(callerClass, file);
931+
}
932+
933+
@Override
934+
public void check$java_io_File$length(Class<?> callerClass, File file) {
935+
policyManager.checkFileRead(callerClass, file);
936+
}
937+
938+
@Override
939+
public void check$java_io_File$list(Class<?> callerClass, File file) {
940+
policyManager.checkFileRead(callerClass, file);
941+
}
942+
943+
@Override
944+
public void check$java_io_File$list(Class<?> callerClass, File file, FilenameFilter filter) {
945+
policyManager.checkFileRead(callerClass, file);
946+
}
947+
948+
@Override
949+
public void check$java_io_File$listFiles(Class<?> callerClass, File file) {
950+
policyManager.checkFileRead(callerClass, file);
951+
}
952+
953+
@Override
954+
public void check$java_io_File$listFiles(Class<?> callerClass, File file, FileFilter filter) {
955+
policyManager.checkFileRead(callerClass, file);
956+
}
957+
958+
@Override
959+
public void check$java_io_File$listFiles(Class<?> callerClass, File file, FilenameFilter filter) {
960+
policyManager.checkFileRead(callerClass, file);
961+
}
962+
891963
@Override
892964
public void check$java_io_File$mkdir(Class<?> callerClass, File file) {
893965
policyManager.checkFileWrite(callerClass, file);

‎modules/repository-azure/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
11
io.netty.common:
22
- outbound_network
33
- manage_threads
4+
- files:
5+
- path: "/etc/os-release"
6+
mode: "read"
7+
- path: "/usr/lib/os-release"
8+
mode: "read"

‎modules/transport-netty4/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,8 @@ io.netty.common:
66
- inbound_network
77
- outbound_network
88
- manage_threads
9+
- files:
10+
- path: "/etc/os-release"
11+
mode: "read"
12+
- path: "/usr/lib/os-release"
13+
mode: "read"

‎x-pack/plugin/security/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@ io.netty.common:
88
- manage_threads
99
- inbound_network
1010
- outbound_network
11+
- files:
12+
- path: "/etc/os-release"
13+
mode: "read"
14+
- path: "/usr/lib/os-release"
15+
mode: "read"
1116
org.opensaml.xmlsec.impl:
1217
- write_system_properties:
1318
properties:

0 commit comments

Comments
 (0)