Skip to content

Commit 0953768

Browse files
prdoyleprdoyle
committed
Merge remote-tracking branch 'upstream/main' into simple-thread-properties
2 parents 7a4ba3c + d1bbc4c commit 0953768

File tree

14 files changed

+258
-54
lines changed

14 files changed

+258
-54
lines changed

‎docs/changelog/122272.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
pr: 122272
2+
summary: "[Inference API] Rename `model_id` prop to model in EIS sparse inference\
3+
\ request body"
4+
area: Inference
5+
type: enhancement
6+
issues: []

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -502,6 +502,36 @@ public interface EntitlementChecker {
502502
//
503503

504504
// old io (ie File)
505+
void check$java_io_File$createNewFile(Class<?> callerClass, File file);
506+
507+
void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix, File directory);
508+
509+
void check$java_io_File$delete(Class<?> callerClass, File file);
510+
511+
void check$java_io_File$deleteOnExit(Class<?> callerClass, File file);
512+
513+
void check$java_io_File$mkdir(Class<?> callerClass, File file);
514+
515+
void check$java_io_File$mkdirs(Class<?> callerClass, File file);
516+
517+
void check$java_io_File$renameTo(Class<?> callerClass, File file, File dest);
518+
519+
void check$java_io_File$setExecutable(Class<?> callerClass, File file, boolean executable);
520+
521+
void check$java_io_File$setExecutable(Class<?> callerClass, File file, boolean executable, boolean ownerOnly);
522+
523+
void check$java_io_File$setLastModified(Class<?> callerClass, File file, long time);
524+
525+
void check$java_io_File$setReadable(Class<?> callerClass, File file, boolean readable);
526+
527+
void check$java_io_File$setReadable(Class<?> callerClass, File file, boolean readable, boolean ownerOnly);
528+
529+
void check$java_io_File$setReadOnly(Class<?> callerClass, File file);
530+
531+
void check$java_io_File$setWritable(Class<?> callerClass, File file, boolean writable);
532+
533+
void check$java_io_File$setWritable(Class<?> callerClass, File file, boolean writable, boolean ownerOnly);
534+
505535
void check$java_io_FileOutputStream$(Class<?> callerClass, File file);
506536

507537
void check$java_io_FileOutputStream$(Class<?> callerClass, File file, boolean append);

‎libs/entitlement/qa/entitled-plugin/src/main/java/org/elasticsearch/entitlement/qa/entitled/EntitledActions.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,8 @@ private EntitledActions() {}
2020
public static UserPrincipal getFileOwner(Path path) throws IOException {
2121
return Files.getOwner(path);
2222
}
23+
24+
public static void createFile(Path path) throws IOException {
25+
Files.createFile(path);
26+
}
2327
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import org.elasticsearch.core.SuppressForbidden;
1313
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
1414

15+
import java.io.File;
1516
import java.io.FileNotFoundException;
1617
import java.io.FileOutputStream;
1718
import java.io.IOException;
@@ -45,6 +46,91 @@ static Path readWriteFile() {
4546
return testRootDir.resolve("read_write_file");
4647
}
4748

49+
@EntitlementTest(expectedAccess = PLUGINS)
50+
static void fileCreateNewFile() throws IOException {
51+
readWriteDir().resolve("new_file").toFile().createNewFile();
52+
}
53+
54+
@EntitlementTest(expectedAccess = PLUGINS)
55+
static void fileCreateTempFile() throws IOException {
56+
File.createTempFile("prefix", "suffix", readWriteDir().toFile());
57+
}
58+
59+
@EntitlementTest(expectedAccess = PLUGINS)
60+
static void fileDelete() throws IOException {
61+
Path toDelete = readWriteDir().resolve("to_delete");
62+
EntitledActions.createFile(toDelete);
63+
toDelete.toFile().delete();
64+
}
65+
66+
@EntitlementTest(expectedAccess = PLUGINS)
67+
static void fileDeleteOnExit() throws IOException {
68+
Path toDelete = readWriteDir().resolve("to_delete_on_exit");
69+
EntitledActions.createFile(toDelete);
70+
toDelete.toFile().deleteOnExit();
71+
}
72+
73+
@EntitlementTest(expectedAccess = PLUGINS)
74+
static void fileMkdir() throws IOException {
75+
Path mkdir = readWriteDir().resolve("mkdir");
76+
mkdir.toFile().mkdir();
77+
}
78+
79+
@EntitlementTest(expectedAccess = PLUGINS)
80+
static void fileMkdirs() throws IOException {
81+
Path mkdir = readWriteDir().resolve("mkdirs");
82+
mkdir.toFile().mkdirs();
83+
}
84+
85+
@EntitlementTest(expectedAccess = PLUGINS)
86+
static void fileRenameTo() throws IOException {
87+
Path toRename = readWriteDir().resolve("to_rename");
88+
EntitledActions.createFile(toRename);
89+
toRename.toFile().renameTo(readWriteDir().resolve("renamed").toFile());
90+
}
91+
92+
@EntitlementTest(expectedAccess = PLUGINS)
93+
static void fileSetExecutable() throws IOException {
94+
readWriteFile().toFile().setExecutable(false);
95+
}
96+
97+
@EntitlementTest(expectedAccess = PLUGINS)
98+
static void fileSetExecutableOwner() throws IOException {
99+
readWriteFile().toFile().setExecutable(false, false);
100+
}
101+
102+
@EntitlementTest(expectedAccess = PLUGINS)
103+
static void fileSetLastModified() throws IOException {
104+
readWriteFile().toFile().setLastModified(System.currentTimeMillis());
105+
}
106+
107+
@EntitlementTest(expectedAccess = PLUGINS)
108+
static void fileSetReadable() throws IOException {
109+
readWriteFile().toFile().setReadable(true);
110+
}
111+
112+
@EntitlementTest(expectedAccess = PLUGINS)
113+
static void fileSetReadableOwner() throws IOException {
114+
readWriteFile().toFile().setReadable(true, false);
115+
}
116+
117+
@EntitlementTest(expectedAccess = PLUGINS)
118+
static void fileSetReadOnly() throws IOException {
119+
Path readOnly = readWriteDir().resolve("read_only");
120+
EntitledActions.createFile(readOnly);
121+
readOnly.toFile().setReadOnly();
122+
}
123+
124+
@EntitlementTest(expectedAccess = PLUGINS)
125+
static void fileSetWritable() throws IOException {
126+
readWriteFile().toFile().setWritable(true);
127+
}
128+
129+
@EntitlementTest(expectedAccess = PLUGINS)
130+
static void fileSetWritableOwner() throws IOException {
131+
readWriteFile().toFile().setWritable(true, false);
132+
}
133+
48134
@EntitlementTest(expectedAccess = PLUGINS)
49135
static void createScannerFile() throws FileNotFoundException {
50136
new Scanner(readFile().toFile());

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/EntitlementBootstrap.java‎

Lines changed: 0 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
import com.sun.tools.attach.VirtualMachine;
1616

1717
import org.elasticsearch.core.CheckedConsumer;
18-
import org.elasticsearch.core.CheckedSupplier;
1918
import org.elasticsearch.core.SuppressForbidden;
2019
import org.elasticsearch.entitlement.initialization.EntitlementInitialization;
2120
import org.elasticsearch.entitlement.runtime.api.NotEntitledException;
@@ -27,7 +26,6 @@
2726
import java.lang.reflect.InvocationTargetException;
2827
import java.nio.file.Files;
2928
import java.nio.file.Path;
30-
import java.nio.file.attribute.FileAttribute;
3129
import java.util.Map;
3230
import java.util.function.Function;
3331

@@ -149,11 +147,8 @@ private static String findAgentJar() {
149147
*/
150148
private static void selfTest() {
151149
ensureCannotStartProcess(ProcessBuilder::start);
152-
ensureCanCreateTempFile(EntitlementBootstrap::createTempFile);
153-
154150
// Try again with reflection
155151
ensureCannotStartProcess(EntitlementBootstrap::reflectiveStartProcess);
156-
ensureCanCreateTempFile(EntitlementBootstrap::reflectiveCreateTempFile);
157152
}
158153

159154
private static void ensureCannotStartProcess(CheckedConsumer<ProcessBuilder, ?> startProcess) {
@@ -169,31 +164,6 @@ private static void ensureCannotStartProcess(CheckedConsumer<ProcessBuilder, ?>
169164
throw new IllegalStateException("Entitlement protection self-test was incorrectly permitted");
170165
}
171166

172-
@SuppressForbidden(reason = "accesses jvm default tempdir as a self-test")
173-
private static void ensureCanCreateTempFile(CheckedSupplier<Path, ?> createTempFile) {
174-
try {
175-
Path p = createTempFile.get();
176-
p.toFile().deleteOnExit();
177-
178-
// Make an effort to clean up the file immediately; also, deleteOnExit leaves the file if the JVM exits abnormally.
179-
try {
180-
Files.delete(p);
181-
} catch (IOException ignored) {
182-
// Can be caused by virus scanner
183-
}
184-
} catch (NotEntitledException e) {
185-
throw new IllegalStateException("Entitlement protection self-test was incorrectly forbidden", e);
186-
} catch (Exception e) {
187-
throw new IllegalStateException("Unable to perform entitlement protection self-test", e);
188-
}
189-
logger.debug("Success: Entitlement protection correctly permitted temp file creation");
190-
}
191-
192-
@SuppressForbidden(reason = "accesses jvm default tempdir as a self-test")
193-
private static Path createTempFile() throws Exception {
194-
return Files.createTempFile(null, null);
195-
}
196-
197167
private static void reflectiveStartProcess(ProcessBuilder pb) throws Exception {
198168
try {
199169
var start = ProcessBuilder.class.getMethod("start");
@@ -203,10 +173,5 @@ private static void reflectiveStartProcess(ProcessBuilder pb) throws Exception {
203173
}
204174
}
205175

206-
private static Path reflectiveCreateTempFile() throws Exception {
207-
return (Path) Files.class.getMethod("createTempFile", String.class, String.class, FileAttribute[].class)
208-
.invoke(null, null, null, new FileAttribute<?>[0]);
209-
}
210-
211176
private static final Logger logger = LogManager.getLogger(EntitlementBootstrap.class);
212177
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424
import org.elasticsearch.entitlement.runtime.policy.entitlements.CreateClassLoaderEntitlement;
2525
import org.elasticsearch.entitlement.runtime.policy.entitlements.Entitlement;
2626
import org.elasticsearch.entitlement.runtime.policy.entitlements.ExitVMEntitlement;
27+
import org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement;
28+
import org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.FileData;
2729
import org.elasticsearch.entitlement.runtime.policy.entitlements.InboundNetworkEntitlement;
2830
import org.elasticsearch.entitlement.runtime.policy.entitlements.LoadNativeLibrariesEntitlement;
2931
import org.elasticsearch.entitlement.runtime.policy.entitlements.ManageThreadsEntitlement;
@@ -40,6 +42,7 @@
4042
import java.nio.file.Path;
4143
import java.nio.file.spi.FileSystemProvider;
4244
import java.util.ArrayList;
45+
import java.util.Arrays;
4346
import java.util.HashMap;
4447
import java.util.List;
4548
import java.util.Map;
@@ -48,6 +51,8 @@
4851
import java.util.stream.Stream;
4952
import java.util.stream.StreamSupport;
5053

54+
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ_WRITE;
55+
5156
/**
5257
* Called by the agent during {@code agentmain} to configure the entitlement system,
5358
* instantiate and configure an {@link EntitlementChecker},
@@ -122,6 +127,7 @@ private static Class<?>[] findClassesToRetransform(Class<?>[] loadedClasses, Set
122127

123128
private static PolicyManager createPolicyManager() {
124129
Map<String, Policy> pluginPolicies = EntitlementBootstrap.bootstrapArgs().pluginPolicies();
130+
Path[] dataDirs = EntitlementBootstrap.bootstrapArgs().dataDirs();
125131

126132
// TODO(ES-10031): Decide what goes in the elasticsearch default policy and extend it
127133
var serverPolicy = new Policy(
@@ -145,7 +151,13 @@ private static PolicyManager createPolicyManager() {
145151
new Scope("io.netty.transport", List.of(new InboundNetworkEntitlement(), new OutboundNetworkEntitlement())),
146152
new Scope("org.apache.lucene.core", List.of(new LoadNativeLibrariesEntitlement(), new ManageThreadsEntitlement())),
147153
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
148-
new Scope("org.elasticsearch.nativeaccess", List.of(new LoadNativeLibrariesEntitlement()))
154+
new Scope(
155+
"org.elasticsearch.nativeaccess",
156+
List.of(
157+
new LoadNativeLibrariesEntitlement(),
158+
new FilesEntitlement(Arrays.stream(dataDirs).map(d -> new FileData(d.toString(), READ_WRITE)).toList())
159+
)
160+
)
149161
)
150162
);
151163
// agents run without a module, so this is a special hack for the apm agent

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -942,6 +942,82 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
942942

943943
// old io (ie File)
944944

945+
@Override
946+
public void check$java_io_File$createNewFile(Class<?> callerClass, File file) {
947+
policyManager.checkFileWrite(callerClass, file);
948+
}
949+
950+
@Override
951+
public void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix, File directory) {
952+
policyManager.checkFileWrite(callerClass, directory);
953+
}
954+
955+
@Override
956+
public void check$java_io_File$delete(Class<?> callerClass, File file) {
957+
policyManager.checkFileWrite(callerClass, file);
958+
}
959+
960+
@Override
961+
public void check$java_io_File$deleteOnExit(Class<?> callerClass, File file) {
962+
policyManager.checkFileWrite(callerClass, file);
963+
}
964+
965+
@Override
966+
public void check$java_io_File$mkdir(Class<?> callerClass, File file) {
967+
policyManager.checkFileWrite(callerClass, file);
968+
}
969+
970+
@Override
971+
public void check$java_io_File$mkdirs(Class<?> callerClass, File file) {
972+
policyManager.checkFileWrite(callerClass, file);
973+
}
974+
975+
@Override
976+
public void check$java_io_File$renameTo(Class<?> callerClass, File file, File dest) {
977+
policyManager.checkFileRead(callerClass, file);
978+
policyManager.checkFileWrite(callerClass, dest);
979+
}
980+
981+
@Override
982+
public void check$java_io_File$setExecutable(Class<?> callerClass, File file, boolean executable) {
983+
policyManager.checkFileWrite(callerClass, file);
984+
}
985+
986+
@Override
987+
public void check$java_io_File$setExecutable(Class<?> callerClass, File file, boolean executable, boolean ownerOnly) {
988+
policyManager.checkFileWrite(callerClass, file);
989+
}
990+
991+
@Override
992+
public void check$java_io_File$setLastModified(Class<?> callerClass, File file, long time) {
993+
policyManager.checkFileWrite(callerClass, file);
994+
}
995+
996+
@Override
997+
public void check$java_io_File$setReadable(Class<?> callerClass, File file, boolean readable) {
998+
policyManager.checkFileWrite(callerClass, file);
999+
}
1000+
1001+
@Override
1002+
public void check$java_io_File$setReadable(Class<?> callerClass, File file, boolean readable, boolean ownerOnly) {
1003+
policyManager.checkFileWrite(callerClass, file);
1004+
}
1005+
1006+
@Override
1007+
public void check$java_io_File$setReadOnly(Class<?> callerClass, File file) {
1008+
policyManager.checkFileWrite(callerClass, file);
1009+
}
1010+
1011+
@Override
1012+
public void check$java_io_File$setWritable(Class<?> callerClass, File file, boolean writable) {
1013+
policyManager.checkFileWrite(callerClass, file);
1014+
}
1015+
1016+
@Override
1017+
public void check$java_io_File$setWritable(Class<?> callerClass, File file, boolean writable, boolean ownerOnly) {
1018+
policyManager.checkFileWrite(callerClass, file);
1019+
}
1020+
9451021
@Override
9461022
public void check$java_io_FileOutputStream$(Class<?> callerClass, String name) {
9471023
policyManager.checkFileWrite(callerClass, new File(name));

‎muted-tests.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -374,8 +374,6 @@ tests:
374374
- class: org.elasticsearch.xpack.security.authz.IndexAliasesTests
375375
method: testRemoveIndex
376376
issue: https://github.com/elastic/elasticsearch/issues/122221
377-
- class: org.elasticsearch.xpack.migrate.action.ReindexDatastreamIndexTransportActionIT
378-
issue: https://github.com/elastic/elasticsearch/issues/121737
379377
- class: org.elasticsearch.xpack.esql.action.EsqlActionBreakerIT
380378
method: testGroupingMultiValueByOrdinals
381379
issue: https://github.com/elastic/elasticsearch/issues/122228
@@ -399,6 +397,13 @@ tests:
399397
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
400398
method: test {yaml=reference/alias/line_260}
401399
issue: https://github.com/elastic/elasticsearch/issues/122343
400+
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
401+
method: test {yaml=reference/snapshot-restore/apis/get-snapshot-api/line_488}
402+
issue: https://github.com/elastic/elasticsearch/issues/121611
403+
- class: org.elasticsearch.repositories.blobstore.testkit.analyze.SecureHdfsRepositoryAnalysisRestIT
404+
issue: https://github.com/elastic/elasticsearch/issues/122377
405+
- class: org.elasticsearch.repositories.blobstore.testkit.analyze.HdfsRepositoryAnalysisRestIT
406+
issue: https://github.com/elastic/elasticsearch/issues/122378
402407

403408
# Examples:
404409
#

‎x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/external/request/elastic/ElasticInferenceServiceSparseEmbeddingsRequestEntity.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ public record ElasticInferenceServiceSparseEmbeddingsRequestEntity(
2323
) implements ToXContentObject {
2424

2525
private static final String INPUT_FIELD = "input";
26-
private static final String MODEL_ID_FIELD = "model_id";
26+
private static final String MODEL_FIELD = "model";
2727
private static final String USAGE_CONTEXT = "usage_context";
2828

2929
public ElasticInferenceServiceSparseEmbeddingsRequestEntity {
@@ -42,7 +42,7 @@ public XContentBuilder toXContent(XContentBuilder builder, Params params) throws
4242

4343
builder.endArray();
4444

45-
builder.field(MODEL_ID_FIELD, modelId);
45+
builder.field(MODEL_FIELD, modelId);
4646

4747
// optional field
4848
if ((usageContext == ElasticInferenceServiceUsageContext.UNSPECIFIED) == false) {

0 commit comments

Comments
 (0)