Skip to content

Commit 0815989

Browse files
Mikep86Mikep86
committed
Merge branch 'main' into semantic-text_bit-vector-tests
2 parents a438ad8 + e843849 commit 0815989

File tree

65 files changed

+2009
-957
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+2009
-957
lines changed

‎build-conventions/src/main/java/org/elasticsearch/gradle/internal/conventions/EclipseConventionPlugin.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import org.gradle.api.Plugin;
1616
import org.gradle.api.Project;
1717
import org.gradle.api.Transformer;
18+
import org.gradle.api.invocation.Gradle;
1819
import org.gradle.api.plugins.JavaBasePlugin;
1920
import org.gradle.api.plugins.JavaPluginExtension;
2021
import org.gradle.api.tasks.Copy;
@@ -38,6 +39,15 @@ public class EclipseConventionPlugin implements Plugin<Project> {
3839
@Override
3940
public void apply(Project project) {
4041
project.getPlugins().apply(EclipsePlugin.class);
42+
Gradle gradle = project.getGradle();
43+
44+
boolean isEclipse = project.getProviders().systemProperty("eclipse.launcher").isPresent() || // Gradle launched from Eclipse
45+
project.getProviders().systemProperty("eclipse.application").isPresent() || // Gradle launched from the Eclipse compiler server
46+
gradle.getStartParameter().getTaskNames().contains("eclipse") || // Gradle launched from the command line to do eclipse stuff
47+
gradle.getStartParameter().getTaskNames().contains("cleanEclipse");
48+
// for eclipse ide specific hacks...
49+
project.getExtensions().add("isEclipse", isEclipse);
50+
4151
EclipseModel eclipseModel = project.getExtensions().getByType(EclipseModel.class);
4252
EclipseProject eclipseProject = eclipseModel.getProject();
4353

‎build.gradle‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -247,15 +247,6 @@ allprojects {
247247
}
248248
}
249249

250-
// injecting groovy property variables into all projects
251-
project.ext {
252-
// for ide hacks...
253-
isEclipse = providers.systemProperty("eclipse.launcher").isPresent() || // Detects gradle launched from Eclipse's IDE
254-
providers.systemProperty("eclipse.application").isPresent() || // Detects gradle launched from the Eclipse compiler server
255-
gradle.startParameter.taskNames.contains('eclipse') || // Detects gradle launched from the command line to do eclipse stuff
256-
gradle.startParameter.taskNames.contains('cleanEclipse')
257-
}
258-
259250
ext.bwc_tests_enabled = bwc_tests_enabled
260251

261252
// eclipse configuration

‎docs/changelog/121827.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
pr: 121827
2+
summary: Updates to allow using Cohere binary embedding response in semantic search
3+
queries
4+
area: Machine Learning
5+
type: bug
6+
issues: []

‎docs/changelog/122886.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
pr: 122886
2+
summary: Add support to VALUES aggregation for spatial types
3+
area: ES|QL
4+
type: bug
5+
issues:
6+
- 122413

‎docs/changelog/122999.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 122999
2+
summary: Store arrays offsets for ip fields natively with synthetic source
3+
area: Mapping
4+
type: enhancement
5+
issues: []

‎docs/changelog/123079.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 123079
2+
summary: Register `IngestGeoIpMetadata` as a NamedXContent
3+
area: Ingest Node
4+
type: bug
5+
issues: []

‎docs/changelog/123346.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
pr: 123346
2+
summary: Reduce license checks in `LicensedWriteLoadForecaster`
3+
area: CRUD
4+
type: bug
5+
issues:
6+
- 123247

‎docs/reference/esql/functions/kibana/definition/values.json‎

Lines changed: 48 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/EntitlementBootstrap.java‎

Lines changed: 13 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,17 @@
1414
import com.sun.tools.attach.AttachNotSupportedException;
1515
import com.sun.tools.attach.VirtualMachine;
1616

17-
import org.elasticsearch.core.CheckedConsumer;
1817
import org.elasticsearch.core.SuppressForbidden;
1918
import org.elasticsearch.entitlement.initialization.EntitlementInitialization;
20-
import org.elasticsearch.entitlement.runtime.api.NotEntitledException;
2119
import org.elasticsearch.entitlement.runtime.policy.Policy;
2220
import org.elasticsearch.logging.LogManager;
2321
import org.elasticsearch.logging.Logger;
2422

2523
import java.io.IOException;
26-
import java.lang.reflect.InvocationTargetException;
2724
import java.nio.file.Files;
2825
import java.nio.file.Path;
2926
import java.util.Map;
27+
import java.util.Set;
3028
import java.util.function.Function;
3129
import java.util.stream.Stream;
3230

@@ -44,7 +42,9 @@ public record BootstrapArgs(
4442
Path configDir,
4543
Path libDir,
4644
Path logsDir,
47-
Path tempDir
45+
Path tempDir,
46+
Path pidFile,
47+
Set<Class<?>> suppressFailureLogClasses
4848
) {
4949
public BootstrapArgs {
5050
requireNonNull(pluginPolicies);
@@ -60,6 +60,7 @@ public record BootstrapArgs(
6060
requireNonNull(libDir);
6161
requireNonNull(logsDir);
6262
requireNonNull(tempDir);
63+
requireNonNull(suppressFailureLogClasses);
6364
}
6465
}
6566

@@ -83,6 +84,8 @@ public static BootstrapArgs bootstrapArgs() {
8384
* @param libDir the lib directory for Elasticsearch
8485
* @param tempDir the temp directory for Elasticsearch
8586
* @param logsDir the log directory for Elasticsearch
87+
* @param pidFile path to a pid file for Elasticsearch, or {@code null} if one was not specified
88+
* @param suppressFailureLogClasses classes for which we do not need or want to log Entitlements failures
8689
*/
8790
public static void bootstrap(
8891
Map<String, Policy> pluginPolicies,
@@ -94,7 +97,9 @@ public static void bootstrap(
9497
Path configDir,
9598
Path libDir,
9699
Path logsDir,
97-
Path tempDir
100+
Path tempDir,
101+
Path pidFile,
102+
Set<Class<?>> suppressFailureLogClasses
98103
) {
99104
logger.debug("Loading entitlement agent");
100105
if (EntitlementBootstrap.bootstrapArgs != null) {
@@ -110,11 +115,12 @@ public static void bootstrap(
110115
configDir,
111116
libDir,
112117
logsDir,
113-
tempDir
118+
tempDir,
119+
pidFile,
120+
suppressFailureLogClasses
114121
);
115122
exportInitializationToAgent();
116123
loadAgent(findAgentJar());
117-
selfTest();
118124
}
119125

120126
@SuppressForbidden(reason = "The VirtualMachine API is the only way to attach a java agent dynamically")
@@ -160,50 +166,5 @@ private static String findAgentJar() {
160166
}
161167
}
162168

163-
/**
164-
* Attempt a few sensitive operations to ensure that some are permitted and some are forbidden.
165-
* <p>
166-
*
167-
* This serves two purposes:
168-
*
169-
* <ol>
170-
* <li>
171-
* a smoke test to make sure the entitlements system is not completely broken, and
172-
* </li>
173-
* <li>
174-
* an early test of certain important operations so they don't fail later on at an awkward time.
175-
* </li>
176-
* </ol>
177-
*
178-
* @throws IllegalStateException if the entitlements system can't prevent an unauthorized action of our choosing
179-
*/
180-
private static void selfTest() {
181-
ensureCannotStartProcess(ProcessBuilder::start);
182-
// Try again with reflection
183-
ensureCannotStartProcess(EntitlementBootstrap::reflectiveStartProcess);
184-
}
185-
186-
private static void ensureCannotStartProcess(CheckedConsumer<ProcessBuilder, ?> startProcess) {
187-
try {
188-
// The command doesn't matter; it doesn't even need to exist
189-
startProcess.accept(new ProcessBuilder(""));
190-
} catch (NotEntitledException e) {
191-
logger.debug("Success: Entitlement protection correctly prevented process creation");
192-
return;
193-
} catch (Exception e) {
194-
throw new IllegalStateException("Failed entitlement protection self-test", e);
195-
}
196-
throw new IllegalStateException("Entitlement protection self-test was incorrectly permitted");
197-
}
198-
199-
private static void reflectiveStartProcess(ProcessBuilder pb) throws Exception {
200-
try {
201-
var start = ProcessBuilder.class.getMethod("start");
202-
start.invoke(pb);
203-
} catch (InvocationTargetException e) {
204-
throw (Exception) e.getCause();
205-
}
206-
}
207-
208169
private static final Logger logger = LogManager.getLogger(EntitlementBootstrap.class);
209170
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 42 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@
6767
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.BaseDir.SHARED_REPO;
6868
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ;
6969
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ_WRITE;
70+
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Platform.LINUX;
7071

7172
/**
7273
* Called by the agent during {@code agentmain} to configure the entitlement system,
@@ -147,6 +148,36 @@ private static PolicyManager createPolicyManager() {
147148
);
148149

149150
List<Scope> serverScopes = new ArrayList<>();
151+
List<FileData> serverModuleFileDatas = new ArrayList<>();
152+
Collections.addAll(
153+
serverModuleFileDatas,
154+
// Base ES directories
155+
FileData.ofPath(bootstrapArgs.configDir(), READ),
156+
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
157+
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE),
158+
FileData.ofRelativePath(Path.of(""), SHARED_REPO, READ_WRITE),
159+
160+
// OS release on Linux
161+
FileData.ofPath(Path.of("/etc/os-release"), READ).withPlatform(LINUX),
162+
FileData.ofPath(Path.of("/etc/system-release"), READ).withPlatform(LINUX),
163+
FileData.ofPath(Path.of("/usr/lib/os-release"), READ).withPlatform(LINUX),
164+
// read max virtual memory areas
165+
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ).withPlatform(LINUX),
166+
FileData.ofPath(Path.of("/proc/meminfo"), READ).withPlatform(LINUX),
167+
// load averages on Linux
168+
FileData.ofPath(Path.of("/proc/loadavg"), READ).withPlatform(LINUX),
169+
// control group stats on Linux. cgroup v2 stats are in an unpredicable
170+
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
171+
// read access to the entire directory hierarchy.
172+
FileData.ofPath(Path.of("/proc/self/cgroup"), READ).withPlatform(LINUX),
173+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ).withPlatform(LINUX),
174+
// // io stats on Linux
175+
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ).withPlatform(LINUX),
176+
FileData.ofPath(Path.of("/proc/diskstats"), READ).withPlatform(LINUX)
177+
);
178+
if (bootstrapArgs.pidFile() != null) {
179+
serverModuleFileDatas.add(FileData.ofPath(bootstrapArgs.pidFile(), READ_WRITE));
180+
}
150181
Collections.addAll(
151182
serverScopes,
152183
new Scope(
@@ -172,34 +203,7 @@ private static PolicyManager createPolicyManager() {
172203
new OutboundNetworkEntitlement(),
173204
new LoadNativeLibrariesEntitlement(),
174205
new ManageThreadsEntitlement(),
175-
new FilesEntitlement(
176-
List.of(
177-
// Base ES directories
178-
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
179-
FileData.ofPath(bootstrapArgs.configDir(), READ),
180-
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
181-
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE),
182-
FileData.ofRelativePath(Path.of(""), SHARED_REPO, READ_WRITE),
183-
184-
// OS release on Linux
185-
FileData.ofPath(Path.of("/etc/os-release"), READ),
186-
FileData.ofPath(Path.of("/etc/system-release"), READ),
187-
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
188-
// read max virtual memory areas
189-
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
190-
FileData.ofPath(Path.of("/proc/meminfo"), READ),
191-
// load averages on Linux
192-
FileData.ofPath(Path.of("/proc/loadavg"), READ),
193-
// control group stats on Linux. cgroup v2 stats are in an unpredicable
194-
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
195-
// read access to the entire directory hierarchy.
196-
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
197-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
198-
// // io stats on Linux
199-
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
200-
FileData.ofPath(Path.of("/proc/diskstats"), READ)
201-
)
202-
)
206+
new FilesEntitlement(serverModuleFileDatas)
203207
)
204208
),
205209
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
@@ -210,19 +214,18 @@ private static PolicyManager createPolicyManager() {
210214
new LoadNativeLibrariesEntitlement(),
211215
new ManageThreadsEntitlement(),
212216
new FilesEntitlement(
213-
List.of(
214-
FileData.ofPath(bootstrapArgs.configDir(), READ),
215-
FileData.ofPath(bootstrapArgs.tempDir(), READ),
216-
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE)
217-
)
217+
List.of(FileData.ofPath(bootstrapArgs.configDir(), READ), FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE))
218218
)
219219
)
220220
),
221221
new Scope(
222222
"org.apache.lucene.misc",
223223
List.of(new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE))))
224224
),
225-
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
225+
new Scope(
226+
"org.apache.logging.log4j.core",
227+
List.of(new ManageThreadsEntitlement(), new FilesEntitlement(List.of(FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE))))
228+
),
226229
new Scope(
227230
"org.elasticsearch.nativeaccess",
228231
List.of(
@@ -255,7 +258,9 @@ private static PolicyManager createPolicyManager() {
255258
new FilesEntitlement(
256259
List.of(
257260
FileData.ofPath(Path.of("/co/elastic/apm/agent/"), READ),
258-
FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ)
261+
FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ),
262+
FileData.ofPath(Path.of("/proc/meminfo"), READ),
263+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ)
259264
)
260265
)
261266
);
@@ -267,7 +272,8 @@ private static PolicyManager createPolicyManager() {
267272
resolver,
268273
AGENTS_PACKAGE_NAME,
269274
ENTITLEMENTS_MODULE,
270-
pathLookup
275+
pathLookup,
276+
bootstrapArgs.suppressFailureLogClasses()
271277
);
272278
}
273279

0 commit comments

Comments
 (0)