Skip to content

Commit 1116b90

Browse files
ldematteldematte
committed
Merge remote-tracking branch 'upstream/main' into entitlements/files-policy-base-dir
2 parents 3d4532d + d1bbc4c commit 1116b90

File tree

34 files changed

+642
-161
lines changed

34 files changed

+642
-161
lines changed

‎docs/changelog/122066.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 122066
2+
summary: Adding elser default endpoint for EIS
3+
area: Machine Learning
4+
type: enhancement
5+
issues: []

‎docs/changelog/122257.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 122257
2+
summary: Revive inlinestats
3+
area: ES|QL
4+
type: bug
5+
issues: []

‎docs/changelog/122272.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
pr: 122272
2+
summary: "[Inference API] Rename `model_id` prop to model in EIS sparse inference\
3+
\ request body"
4+
area: Inference
5+
type: enhancement
6+
issues: []

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@
5050
import java.nio.channels.SocketChannel;
5151
import java.nio.channels.spi.SelectorProvider;
5252
import java.nio.charset.Charset;
53+
import java.nio.file.FileStore;
5354
import java.nio.file.LinkOption;
5455
import java.nio.file.OpenOption;
5556
import java.nio.file.Path;
@@ -500,6 +501,36 @@ public interface EntitlementChecker {
500501
//
501502

502503
// old io (ie File)
504+
void check$java_io_File$createNewFile(Class<?> callerClass, File file);
505+
506+
void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix, File directory);
507+
508+
void check$java_io_File$delete(Class<?> callerClass, File file);
509+
510+
void check$java_io_File$deleteOnExit(Class<?> callerClass, File file);
511+
512+
void check$java_io_File$mkdir(Class<?> callerClass, File file);
513+
514+
void check$java_io_File$mkdirs(Class<?> callerClass, File file);
515+
516+
void check$java_io_File$renameTo(Class<?> callerClass, File file, File dest);
517+
518+
void check$java_io_File$setExecutable(Class<?> callerClass, File file, boolean executable);
519+
520+
void check$java_io_File$setExecutable(Class<?> callerClass, File file, boolean executable, boolean ownerOnly);
521+
522+
void check$java_io_File$setLastModified(Class<?> callerClass, File file, long time);
523+
524+
void check$java_io_File$setReadable(Class<?> callerClass, File file, boolean readable);
525+
526+
void check$java_io_File$setReadable(Class<?> callerClass, File file, boolean readable, boolean ownerOnly);
527+
528+
void check$java_io_File$setReadOnly(Class<?> callerClass, File file);
529+
530+
void check$java_io_File$setWritable(Class<?> callerClass, File file, boolean writable);
531+
532+
void check$java_io_File$setWritable(Class<?> callerClass, File file, boolean writable, boolean ownerOnly);
533+
503534
void check$java_io_FileOutputStream$(Class<?> callerClass, File file);
504535

505536
void check$java_io_FileOutputStream$(Class<?> callerClass, File file, boolean append);
@@ -523,4 +554,23 @@ public interface EntitlementChecker {
523554

524555
// file system providers
525556
void checkNewInputStream(Class<?> callerClass, FileSystemProvider that, Path path, OpenOption... options);
557+
558+
// file store
559+
void checkGetFileStoreAttributeView(Class<?> callerClass, FileStore that, Class<?> type);
560+
561+
void checkGetAttribute(Class<?> callerClass, FileStore that, String attribute);
562+
563+
void checkGetBlockSize(Class<?> callerClass, FileStore that);
564+
565+
void checkGetTotalSpace(Class<?> callerClass, FileStore that);
566+
567+
void checkGetUnallocatedSpace(Class<?> callerClass, FileStore that);
568+
569+
void checkGetUsableSpace(Class<?> callerClass, FileStore that);
570+
571+
void checkIsReadOnly(Class<?> callerClass, FileStore that);
572+
573+
void checkName(Class<?> callerClass, FileStore that);
574+
575+
void checkType(Class<?> callerClass, FileStore that);
526576
}

‎libs/entitlement/qa/entitled-plugin/src/main/java/org/elasticsearch/entitlement/qa/entitled/EntitledActions.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,8 @@ static void System_clearProperty(String key) {
2727
public static UserPrincipal getFileOwner(Path path) throws IOException {
2828
return Files.getOwner(path);
2929
}
30+
31+
public static void createFile(Path path) throws IOException {
32+
Files.createFile(path);
33+
}
3034
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 91 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import org.elasticsearch.core.SuppressForbidden;
1313
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
1414

15+
import java.io.File;
1516
import java.io.FileNotFoundException;
1617
import java.io.FileOutputStream;
1718
import java.io.IOException;
@@ -27,24 +28,109 @@
2728
@SuppressForbidden(reason = "Explicitly checking APIs that are forbidden")
2829
class FileCheckActions {
2930

30-
private static Path testRootDir = Paths.get(System.getProperty("es.entitlements.testdir"));
31+
static Path testRootDir = Paths.get(System.getProperty("es.entitlements.testdir"));
3132

32-
private static Path readDir() {
33+
static Path readDir() {
3334
return testRootDir.resolve("read_dir");
3435
}
3536

36-
private static Path readWriteDir() {
37+
static Path readWriteDir() {
3738
return testRootDir.resolve("read_write_dir");
3839
}
3940

40-
private static Path readFile() {
41+
static Path readFile() {
4142
return testRootDir.resolve("read_file");
4243
}
4344

44-
private static Path readWriteFile() {
45+
static Path readWriteFile() {
4546
return testRootDir.resolve("read_write_file");
4647
}
4748

49+
@EntitlementTest(expectedAccess = PLUGINS)
50+
static void fileCreateNewFile() throws IOException {
51+
readWriteDir().resolve("new_file").toFile().createNewFile();
52+
}
53+
54+
@EntitlementTest(expectedAccess = PLUGINS)
55+
static void fileCreateTempFile() throws IOException {
56+
File.createTempFile("prefix", "suffix", readWriteDir().toFile());
57+
}
58+
59+
@EntitlementTest(expectedAccess = PLUGINS)
60+
static void fileDelete() throws IOException {
61+
Path toDelete = readWriteDir().resolve("to_delete");
62+
EntitledActions.createFile(toDelete);
63+
toDelete.toFile().delete();
64+
}
65+
66+
@EntitlementTest(expectedAccess = PLUGINS)
67+
static void fileDeleteOnExit() throws IOException {
68+
Path toDelete = readWriteDir().resolve("to_delete_on_exit");
69+
EntitledActions.createFile(toDelete);
70+
toDelete.toFile().deleteOnExit();
71+
}
72+
73+
@EntitlementTest(expectedAccess = PLUGINS)
74+
static void fileMkdir() throws IOException {
75+
Path mkdir = readWriteDir().resolve("mkdir");
76+
mkdir.toFile().mkdir();
77+
}
78+
79+
@EntitlementTest(expectedAccess = PLUGINS)
80+
static void fileMkdirs() throws IOException {
81+
Path mkdir = readWriteDir().resolve("mkdirs");
82+
mkdir.toFile().mkdirs();
83+
}
84+
85+
@EntitlementTest(expectedAccess = PLUGINS)
86+
static void fileRenameTo() throws IOException {
87+
Path toRename = readWriteDir().resolve("to_rename");
88+
EntitledActions.createFile(toRename);
89+
toRename.toFile().renameTo(readWriteDir().resolve("renamed").toFile());
90+
}
91+
92+
@EntitlementTest(expectedAccess = PLUGINS)
93+
static void fileSetExecutable() throws IOException {
94+
readWriteFile().toFile().setExecutable(false);
95+
}
96+
97+
@EntitlementTest(expectedAccess = PLUGINS)
98+
static void fileSetExecutableOwner() throws IOException {
99+
readWriteFile().toFile().setExecutable(false, false);
100+
}
101+
102+
@EntitlementTest(expectedAccess = PLUGINS)
103+
static void fileSetLastModified() throws IOException {
104+
readWriteFile().toFile().setLastModified(System.currentTimeMillis());
105+
}
106+
107+
@EntitlementTest(expectedAccess = PLUGINS)
108+
static void fileSetReadable() throws IOException {
109+
readWriteFile().toFile().setReadable(true);
110+
}
111+
112+
@EntitlementTest(expectedAccess = PLUGINS)
113+
static void fileSetReadableOwner() throws IOException {
114+
readWriteFile().toFile().setReadable(true, false);
115+
}
116+
117+
@EntitlementTest(expectedAccess = PLUGINS)
118+
static void fileSetReadOnly() throws IOException {
119+
Path readOnly = readWriteDir().resolve("read_only");
120+
EntitledActions.createFile(readOnly);
121+
readOnly.toFile().setReadOnly();
122+
}
123+
124+
@EntitlementTest(expectedAccess = PLUGINS)
125+
static void fileSetWritable() throws IOException {
126+
readWriteFile().toFile().setWritable(true);
127+
}
128+
129+
@EntitlementTest(expectedAccess = PLUGINS)
130+
static void fileSetWritableOwner() throws IOException {
131+
readWriteFile().toFile().setWritable(true, false);
132+
}
133+
48134
@EntitlementTest(expectedAccess = PLUGINS)
49135
static void createScannerFile() throws FileNotFoundException {
50136
new Scanner(readFile().toFile());

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileStoreActions.java‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.qa.test;
11+
12+
import java.io.IOException;
13+
import java.nio.file.Files;
14+
import java.nio.file.attribute.FileStoreAttributeView;
15+
16+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;
17+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.SERVER_ONLY;
18+
19+
class FileStoreActions {
20+
21+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
22+
static void checkGetFileStoreAttributeView() throws IOException {
23+
Files.getFileStore(FileCheckActions.readWriteFile()).getFileStoreAttributeView(FileStoreAttributeView.class);
24+
}
25+
26+
@EntitlementTest(expectedAccess = SERVER_ONLY)
27+
static void checkGetAttribute() throws IOException {
28+
try {
29+
Files.getFileStore(FileCheckActions.readFile()).getAttribute("zfs:compression");
30+
} catch (UnsupportedOperationException e) {
31+
// It's OK if the attribute view is not available or it does not support reading the attribute
32+
}
33+
}
34+
35+
@EntitlementTest(expectedAccess = SERVER_ONLY)
36+
static void checkGetBlockSize() throws IOException {
37+
Files.getFileStore(FileCheckActions.readWriteFile()).getBlockSize();
38+
}
39+
40+
@EntitlementTest(expectedAccess = SERVER_ONLY)
41+
static void checkGetTotalSpace() throws IOException {
42+
Files.getFileStore(FileCheckActions.readWriteFile()).getTotalSpace();
43+
}
44+
45+
@EntitlementTest(expectedAccess = SERVER_ONLY)
46+
static void checkGetUnallocatedSpace() throws IOException {
47+
Files.getFileStore(FileCheckActions.readWriteFile()).getUnallocatedSpace();
48+
}
49+
50+
@EntitlementTest(expectedAccess = SERVER_ONLY)
51+
static void checkGetUsableSpace() throws IOException {
52+
Files.getFileStore(FileCheckActions.readFile()).getUsableSpace();
53+
}
54+
55+
@EntitlementTest(expectedAccess = SERVER_ONLY)
56+
static void checkIsReadOnly() throws IOException {
57+
Files.getFileStore(FileCheckActions.readFile()).isReadOnly();
58+
}
59+
60+
@EntitlementTest(expectedAccess = SERVER_ONLY)
61+
static void checkName() throws IOException {
62+
Files.getFileStore(FileCheckActions.readFile()).name();
63+
}
64+
65+
@EntitlementTest(expectedAccess = SERVER_ONLY)
66+
static void checkType() throws IOException {
67+
Files.getFileStore(FileCheckActions.readFile()).type();
68+
}
69+
70+
private FileStoreActions() {}
71+
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,8 @@ static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
185185
getTestEntries(FileCheckActions.class),
186186
getTestEntries(SpiActions.class),
187187
getTestEntries(SystemActions.class),
188-
getTestEntries(NativeActions.class)
188+
getTestEntries(NativeActions.class),
189+
getTestEntries(FileStoreActions.class)
189190
)
190191
.flatMap(Function.identity())
191192
.filter(entry -> entry.getValue().fromJavaVersion() == null || Runtime.version().feature() >= entry.getValue().fromJavaVersion())

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/EntitlementBootstrap.java‎

Lines changed: 0 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
import com.sun.tools.attach.VirtualMachine;
1616

1717
import org.elasticsearch.core.CheckedConsumer;
18-
import org.elasticsearch.core.CheckedSupplier;
1918
import org.elasticsearch.core.SuppressForbidden;
2019
import org.elasticsearch.entitlement.initialization.EntitlementInitialization;
2120
import org.elasticsearch.entitlement.runtime.api.NotEntitledException;
@@ -27,7 +26,6 @@
2726
import java.lang.reflect.InvocationTargetException;
2827
import java.nio.file.Files;
2928
import java.nio.file.Path;
30-
import java.nio.file.attribute.FileAttribute;
3129
import java.util.Map;
3230
import java.util.function.Function;
3331

@@ -149,11 +147,8 @@ private static String findAgentJar() {
149147
*/
150148
private static void selfTest() {
151149
ensureCannotStartProcess(ProcessBuilder::start);
152-
ensureCanCreateTempFile(EntitlementBootstrap::createTempFile);
153-
154150
// Try again with reflection
155151
ensureCannotStartProcess(EntitlementBootstrap::reflectiveStartProcess);
156-
ensureCanCreateTempFile(EntitlementBootstrap::reflectiveCreateTempFile);
157152
}
158153

159154
private static void ensureCannotStartProcess(CheckedConsumer<ProcessBuilder, ?> startProcess) {
@@ -169,31 +164,6 @@ private static void ensureCannotStartProcess(CheckedConsumer<ProcessBuilder, ?>
169164
throw new IllegalStateException("Entitlement protection self-test was incorrectly permitted");
170165
}
171166

172-
@SuppressForbidden(reason = "accesses jvm default tempdir as a self-test")
173-
private static void ensureCanCreateTempFile(CheckedSupplier<Path, ?> createTempFile) {
174-
try {
175-
Path p = createTempFile.get();
176-
p.toFile().deleteOnExit();
177-
178-
// Make an effort to clean up the file immediately; also, deleteOnExit leaves the file if the JVM exits abnormally.
179-
try {
180-
Files.delete(p);
181-
} catch (IOException ignored) {
182-
// Can be caused by virus scanner
183-
}
184-
} catch (NotEntitledException e) {
185-
throw new IllegalStateException("Entitlement protection self-test was incorrectly forbidden", e);
186-
} catch (Exception e) {
187-
throw new IllegalStateException("Unable to perform entitlement protection self-test", e);
188-
}
189-
logger.debug("Success: Entitlement protection correctly permitted temp file creation");
190-
}
191-
192-
@SuppressForbidden(reason = "accesses jvm default tempdir as a self-test")
193-
private static Path createTempFile() throws Exception {
194-
return Files.createTempFile(null, null);
195-
}
196-
197167
private static void reflectiveStartProcess(ProcessBuilder pb) throws Exception {
198168
try {
199169
var start = ProcessBuilder.class.getMethod("start");
@@ -203,10 +173,5 @@ private static void reflectiveStartProcess(ProcessBuilder pb) throws Exception {
203173
}
204174
}
205175

206-
private static Path reflectiveCreateTempFile() throws Exception {
207-
return (Path) Files.class.getMethod("createTempFile", String.class, String.class, FileAttribute[].class)
208-
.invoke(null, null, null, new FileAttribute<?>[0]);
209-
}
210-
211176
private static final Logger logger = LogManager.getLogger(EntitlementBootstrap.class);
212177
}

0 commit comments

Comments
 (0)