Skip to content

Commit 35bdc0c

Browse files
ldematteldematte
committed
Merge remote-tracking branch 'upstream/main' into entitlements/nio-files-1
2 parents 013e649 + b181164 commit 35bdc0c

File tree

56 files changed

+1730
-422
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+1730
-422
lines changed

‎build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/RestrictedBuildApiService.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,6 @@ private static ListMultimap<Class<?>, String> createLegacyRestTestBasePluginUsag
9393
map.put(LegacyRestTestBasePlugin.class, ":x-pack:qa:smoke-test-security-with-mustache");
9494
map.put(LegacyRestTestBasePlugin.class, ":x-pack:qa:xpack-prefix-rest-compat");
9595
map.put(LegacyRestTestBasePlugin.class, ":modules:ingest-geoip:qa:file-based-update");
96-
map.put(LegacyRestTestBasePlugin.class, ":plugins:discovery-ec2:qa:amazon-ec2");
9796
map.put(LegacyRestTestBasePlugin.class, ":plugins:discovery-gce:qa:gce");
9897
map.put(LegacyRestTestBasePlugin.class, ":x-pack:qa:multi-cluster-search-security:legacy-with-basic-license");
9998
map.put(LegacyRestTestBasePlugin.class, ":x-pack:qa:multi-cluster-search-security:legacy-with-full-license");

‎docs/changelog/121784.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 121784
2+
summary: Optionally allow text similarity reranking to fail
3+
area: Search
4+
type: enhancement
5+
issues: []

‎docs/changelog/121971.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 121971
2+
summary: Do not fetch reserved roles from native store when Get Role API is called
3+
area: Authorization
4+
type: enhancement
5+
issues: []

‎docs/changelog/122640.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 122640
2+
summary: Fix redact processor arraycopy bug
3+
area: Ingest Node
4+
type: bug
5+
issues: []

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@
6262
import java.nio.file.OpenOption;
6363
import java.nio.file.Path;
6464
import java.nio.file.attribute.BasicFileAttributes;
65+
import java.nio.file.WatchEvent;
66+
import java.nio.file.WatchService;
6567
import java.nio.file.attribute.FileAttribute;
6668
import java.nio.file.attribute.FileAttributeView;
6769
import java.nio.file.attribute.FileTime;
@@ -829,6 +831,19 @@ void checkNewByteChannel(
829831

830832
void checkType(Class<?> callerClass, FileStore that);
831833

834+
// path
835+
void checkPathToRealPath(Class<?> callerClass, Path that, LinkOption... options);
836+
837+
void checkPathRegister(Class<?> callerClass, Path that, WatchService watcher, WatchEvent.Kind<?>... events);
838+
839+
void checkPathRegister(
840+
Class<?> callerClass,
841+
Path that,
842+
WatchService watcher,
843+
WatchEvent.Kind<?>[] events,
844+
WatchEvent.Modifier... modifiers
845+
);
846+
832847
////////////////////
833848
//
834849
// Thread management
@@ -849,5 +864,4 @@ void checkNewByteChannel(
849864
void check$java_lang_Thread$setUncaughtExceptionHandler(Class<?> callerClass, Thread thread, Thread.UncaughtExceptionHandler ueh);
850865

851866
void check$java_lang_ThreadGroup$setMaxPriority(Class<?> callerClass, ThreadGroup threadGroup, int pri);
852-
853867
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/PathActions.java‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.qa.test;
11+
12+
import java.io.IOException;
13+
import java.nio.file.FileSystems;
14+
import java.nio.file.LinkOption;
15+
import java.nio.file.WatchEvent;
16+
17+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
18+
19+
class PathActions {
20+
21+
@EntitlementTest(expectedAccess = PLUGINS)
22+
static void checkToRealPath() throws IOException {
23+
FileCheckActions.readFile().toRealPath();
24+
}
25+
26+
@EntitlementTest(expectedAccess = PLUGINS)
27+
static void checkToRealPathNoFollow() throws IOException {
28+
FileCheckActions.readFile().toRealPath(LinkOption.NOFOLLOW_LINKS);
29+
}
30+
31+
@SuppressWarnings("rawtypes")
32+
@EntitlementTest(expectedAccess = PLUGINS)
33+
static void checkRegister() throws IOException {
34+
try (var watchService = FileSystems.getDefault().newWatchService()) {
35+
FileCheckActions.readFile().register(watchService, new WatchEvent.Kind[0]);
36+
} catch (IllegalArgumentException e) {
37+
// intentionally no events registered
38+
}
39+
}
40+
41+
@SuppressWarnings("rawtypes")
42+
@EntitlementTest(expectedAccess = PLUGINS)
43+
static void checkRegisterWithModifiers() throws IOException {
44+
try (var watchService = FileSystems.getDefault().newWatchService()) {
45+
FileCheckActions.readFile().register(watchService, new WatchEvent.Kind[0], new WatchEvent.Modifier[0]);
46+
} catch (IllegalArgumentException e) {
47+
// intentionally no events registered
48+
}
49+
}
50+
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,7 @@ static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
191191
getTestEntries(NativeActions.class),
192192
getTestEntries(NioFilesActions.class),
193193
getTestEntries(NioFileSystemActions.class),
194+
getTestEntries(PathActions.class),
194195
getTestEntries(SpiActions.class),
195196
getTestEntries(SystemActions.class)
196197
)

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 51 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,12 @@
4646
import java.nio.file.LinkOption;
4747
import java.nio.file.OpenOption;
4848
import java.nio.file.Path;
49+
import java.nio.file.WatchEvent;
50+
import java.nio.file.WatchService;
4951
import java.nio.file.attribute.FileAttribute;
5052
import java.nio.file.spi.FileSystemProvider;
5153
import java.util.ArrayList;
54+
import java.util.Arrays;
5255
import java.util.HashMap;
5356
import java.util.List;
5457
import java.util.Map;
@@ -96,6 +99,7 @@ public static void initialize(Instrumentation inst) throws Exception {
9699
Stream.of(
97100
fileSystemProviderChecks(),
98101
fileStoreChecks(),
102+
pathChecks(),
99103
Stream.of(
100104
INSTRUMENTATION_SERVICE.lookupImplementationMethod(
101105
SelectorProvider.class,
@@ -150,21 +154,26 @@ private static PolicyManager createPolicyManager() {
150154
new FilesEntitlement(
151155
List.of(
152156
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
153-
FileData.ofPath(bootstrapArgs.configDir(), READ_WRITE),
157+
FileData.ofPath(bootstrapArgs.configDir(), READ),
154158
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
155-
// for OsProbe
159+
160+
// OS release on Linux
156161
FileData.ofPath(Path.of("/etc/os-release"), READ),
157-
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
158162
FileData.ofPath(Path.of("/etc/system-release"), READ),
163+
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
164+
// read max virtual memory areas
165+
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
159166
FileData.ofPath(Path.of("/proc/meminfo"), READ),
160-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
161-
FileData.ofPath(Path.of("/proc/self/"), READ),
167+
// load averages on Linux
162168
FileData.ofPath(Path.of("/proc/loadavg"), READ),
163-
// for BootstrapCheck
164-
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
165-
// for ESFileStore
169+
// control group stats on Linux. cgroup v2 stats are in an unpredicable
170+
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
171+
// read access to the entire directory hierarchy.
172+
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
173+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
174+
// // io stats on Linux
166175
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
167-
FileData.ofPath(Path.of("/proc/diskstats"), READ),
176+
FileData.ofPath(Path.of("/proc/diskstats"), READ)
168177

169178
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)
170179
)
@@ -178,7 +187,12 @@ private static PolicyManager createPolicyManager() {
178187
List.of(
179188
new LoadNativeLibrariesEntitlement(),
180189
new ManageThreadsEntitlement(),
181-
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
190+
new FilesEntitlement(
191+
List.of(
192+
FileData.ofPath(bootstrapArgs.configDir(), READ),
193+
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)
194+
)
195+
)
182196
)
183197
),
184198
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
@@ -294,6 +308,33 @@ public InstrumentationService.InstrumentationInfo of(String methodName, Class<?>
294308
});
295309
}
296310

311+
private static Stream<InstrumentationService.InstrumentationInfo> pathChecks() {
312+
var pathClasses = StreamSupport.stream(FileSystems.getDefault().getRootDirectories().spliterator(), false)
313+
.map(Path::getClass)
314+
.distinct();
315+
return pathClasses.flatMap(pathClass -> {
316+
InstrumentationInfoFactory instrumentation = (String methodName, Class<?>... parameterTypes) -> INSTRUMENTATION_SERVICE
317+
.lookupImplementationMethod(
318+
Path.class,
319+
methodName,
320+
pathClass,
321+
EntitlementChecker.class,
322+
"checkPath" + Character.toUpperCase(methodName.charAt(0)) + methodName.substring(1),
323+
parameterTypes
324+
);
325+
326+
try {
327+
return Stream.of(
328+
instrumentation.of("toRealPath", LinkOption[].class),
329+
instrumentation.of("register", WatchService.class, WatchEvent.Kind[].class),
330+
instrumentation.of("register", WatchService.class, WatchEvent.Kind[].class, WatchEvent.Modifier[].class)
331+
);
332+
} catch (NoSuchMethodException | ClassNotFoundException e) {
333+
throw new RuntimeException(e);
334+
}
335+
});
336+
}
337+
297338
/**
298339
* Returns the "most recent" checker class compatible with the current runtime Java version.
299340
* For checkers, we have (optionally) version specific classes, each with a prefix (e.g. Java23).

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import org.elasticsearch.entitlement.runtime.policy.PolicyManager;
1515

1616
import java.io.File;
17+
import java.io.IOException;
1718
import java.io.InputStream;
1819
import java.io.OutputStream;
1920
import java.io.PrintStream;
@@ -61,12 +62,15 @@
6162
import java.nio.file.CopyOption;
6263
import java.nio.file.DirectoryStream;
6364
import java.nio.file.FileStore;
65+
import java.nio.file.Files;
6466
import java.nio.file.FileVisitOption;
6567
import java.nio.file.FileVisitor;
6668
import java.nio.file.LinkOption;
6769
import java.nio.file.OpenOption;
6870
import java.nio.file.Path;
6971
import java.nio.file.StandardOpenOption;
72+
import java.nio.file.WatchEvent;
73+
import java.nio.file.WatchService;
7074
import java.nio.file.attribute.BasicFileAttributes;
7175
import java.nio.file.attribute.FileAttribute;
7276
import java.nio.file.attribute.FileAttributeView;
@@ -1794,4 +1798,38 @@ public void checkName(Class<?> callerClass, FileStore that) {
17941798
public void checkType(Class<?> callerClass, FileStore that) {
17951799
policyManager.checkReadStoreAttributes(callerClass);
17961800
}
1801+
1802+
@Override
1803+
public void checkPathToRealPath(Class<?> callerClass, Path that, LinkOption... options) {
1804+
boolean followLinks = true;
1805+
for (LinkOption option : options) {
1806+
if (option == LinkOption.NOFOLLOW_LINKS) {
1807+
followLinks = false;
1808+
}
1809+
}
1810+
if (followLinks) {
1811+
try {
1812+
policyManager.checkFileRead(callerClass, Files.readSymbolicLink(that));
1813+
} catch (IOException | UnsupportedOperationException e) {
1814+
// that is not a link, or unrelated IOException or unsupported
1815+
}
1816+
}
1817+
policyManager.checkFileRead(callerClass, that);
1818+
}
1819+
1820+
@Override
1821+
public void checkPathRegister(Class<?> callerClass, Path that, WatchService watcher, WatchEvent.Kind<?>... events) {
1822+
policyManager.checkFileRead(callerClass, that);
1823+
}
1824+
1825+
@Override
1826+
public void checkPathRegister(
1827+
Class<?> callerClass,
1828+
Path that,
1829+
WatchService watcher,
1830+
WatchEvent.Kind<?>[] events,
1831+
WatchEvent.Modifier... modifiers
1832+
) {
1833+
policyManager.checkFileRead(callerClass, that);
1834+
}
17971835
}

0 commit comments

Comments
 (0)