Skip to content

Commit 34266ad

Browse files
moschemosche
committed
conditional fips policy
1 parent 372b8a1 commit 34266ad

File tree

1 file changed

+74
-72
lines changed

1 file changed

+74
-72
lines changed

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 74 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -53,10 +53,10 @@
5353
import java.nio.file.spi.FileSystemProvider;
5454
import java.util.ArrayList;
5555
import java.util.Arrays;
56+
import java.util.Collections;
5657
import java.util.HashMap;
5758
import java.util.List;
5859
import java.util.Map;
59-
import java.util.Optional;
6060
import java.util.Set;
6161
import java.util.concurrent.ExecutorService;
6262
import java.util.function.Function;
@@ -138,82 +138,84 @@ private static PolicyManager createPolicyManager() {
138138
var pathLookup = new PathLookup(getUserHome(), bootstrapArgs.configDir(), bootstrapArgs.dataDirs(), bootstrapArgs.tempDir());
139139
Path logsDir = EntitlementBootstrap.bootstrapArgs().logsDir();
140140

141-
// TODO(ES-10031): Decide what goes in the elasticsearch default policy and extend it
142-
var serverPolicy = new Policy(
143-
"server",
144-
List.of(
145-
new Scope("org.elasticsearch.base", List.of(new CreateClassLoaderEntitlement())),
146-
new Scope("org.elasticsearch.xcontent", List.of(new CreateClassLoaderEntitlement())),
147-
new Scope(
148-
"org.elasticsearch.server",
149-
List.of(
150-
new ExitVMEntitlement(),
151-
new ReadStoreAttributesEntitlement(),
152-
new CreateClassLoaderEntitlement(),
153-
new InboundNetworkEntitlement(),
154-
new OutboundNetworkEntitlement(),
155-
new LoadNativeLibrariesEntitlement(),
156-
new ManageThreadsEntitlement(),
157-
new FilesEntitlement(
158-
Stream.concat(
159-
Stream.of(
160-
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
161-
FileData.ofPath(bootstrapArgs.configDir(), READ),
162-
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
163-
// OS release on Linux
164-
FileData.ofPath(Path.of("/etc/os-release"), READ),
165-
FileData.ofPath(Path.of("/etc/system-release"), READ),
166-
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
167-
// read max virtual memory areas
168-
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
169-
FileData.ofPath(Path.of("/proc/meminfo"), READ),
170-
// load averages on Linux
171-
FileData.ofPath(Path.of("/proc/loadavg"), READ),
172-
// control group stats on Linux. cgroup v2 stats are in an unpredicable
173-
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
174-
// read access to the entire directory hierarchy.
175-
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
176-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
177-
// // io stats on Linux
178-
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
179-
FileData.ofPath(Path.of("/proc/diskstats"), READ)
180-
),
181-
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ))
182-
).toList()
183-
)
184-
)
185-
),
186-
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
187-
new Scope("io.netty.transport", List.of(new InboundNetworkEntitlement(), new OutboundNetworkEntitlement())),
188-
new Scope(
189-
"org.apache.lucene.core",
190-
List.of(
191-
new LoadNativeLibrariesEntitlement(),
192-
new ManageThreadsEntitlement(),
193-
new FilesEntitlement(
194-
Stream.concat(
195-
Stream.of(FileData.ofPath(bootstrapArgs.configDir(), READ)),
196-
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ_WRITE))
197-
).toList()
198-
)
199-
)
200-
),
201-
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
202-
new Scope(
203-
"org.elasticsearch.nativeaccess",
204-
List.of(
205-
new LoadNativeLibrariesEntitlement(),
206-
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
141+
List<Scope> serverScopes = new ArrayList<>();
142+
Collections.addAll(
143+
serverScopes,
144+
new Scope("org.elasticsearch.base", List.of(new CreateClassLoaderEntitlement())),
145+
new Scope("org.elasticsearch.xcontent", List.of(new CreateClassLoaderEntitlement())),
146+
new Scope(
147+
"org.elasticsearch.server",
148+
List.of(
149+
new ExitVMEntitlement(),
150+
new ReadStoreAttributesEntitlement(),
151+
new CreateClassLoaderEntitlement(),
152+
new InboundNetworkEntitlement(),
153+
new OutboundNetworkEntitlement(),
154+
new LoadNativeLibrariesEntitlement(),
155+
new ManageThreadsEntitlement(),
156+
new FilesEntitlement(
157+
Stream.concat(
158+
Stream.of(
159+
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
160+
FileData.ofPath(bootstrapArgs.configDir(), READ),
161+
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
162+
// OS release on Linux
163+
FileData.ofPath(Path.of("/etc/os-release"), READ),
164+
FileData.ofPath(Path.of("/etc/system-release"), READ),
165+
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
166+
// read max virtual memory areas
167+
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
168+
FileData.ofPath(Path.of("/proc/meminfo"), READ),
169+
// load averages on Linux
170+
FileData.ofPath(Path.of("/proc/loadavg"), READ),
171+
// control group stats on Linux. cgroup v2 stats are in an unpredicable
172+
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
173+
// read access to the entire directory hierarchy.
174+
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
175+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
176+
// // io stats on Linux
177+
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
178+
FileData.ofPath(Path.of("/proc/diskstats"), READ)
179+
),
180+
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ))
181+
).toList()
207182
)
208-
),
209-
new Scope(
210-
"org.bouncycastle.fips.tls",
211-
List.of(
212-
new FilesEntitlement(Optional.ofNullable(trustStorePath()).stream().map(ts -> FileData.ofPath(ts, READ)).toList())
183+
)
184+
),
185+
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
186+
new Scope("io.netty.transport", List.of(new InboundNetworkEntitlement(), new OutboundNetworkEntitlement())),
187+
new Scope(
188+
"org.apache.lucene.core",
189+
List.of(
190+
new LoadNativeLibrariesEntitlement(),
191+
new ManageThreadsEntitlement(),
192+
new FilesEntitlement(
193+
Stream.concat(
194+
Stream.of(FileData.ofPath(bootstrapArgs.configDir(), READ)),
195+
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ_WRITE))
196+
).toList()
213197
)
214198
)
199+
),
200+
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
201+
new Scope(
202+
"org.elasticsearch.nativeaccess",
203+
List.of(
204+
new LoadNativeLibrariesEntitlement(),
205+
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
206+
)
215207
)
216208
);
209+
210+
Path trustStorePath = trustStorePath();
211+
if (trustStorePath != null) {
212+
serverScopes.add(
213+
new Scope("org.bouncycastle.fips.tls", List.of(new FilesEntitlement(List.of(FileData.ofPath(trustStorePath, READ)))))
214+
);
215+
}
216+
217+
// TODO(ES-10031): Decide what goes in the elasticsearch default policy and extend it
218+
var serverPolicy = new Policy("server", serverScopes);
217219
// agents run without a module, so this is a special hack for the apm agent
218220
// this should be removed once https://github.com/elastic/elasticsearch/issues/109335 is completed
219221
List<Entitlement> agentEntitlements = List.of(new CreateClassLoaderEntitlement(), new ManageThreadsEntitlement());

0 commit comments

Comments
 (0)