Entitlements reporting mode

Author: prdoyle

libs/entitlement/qa/entitled-plugin/src/main/java/org/elasticsearch/entitlement/qa/entitled/EntitledPlugin.java

@@ -27,7 +27,7 @@ public class EntitledPlugin extends Plugin implements ExtensiblePlugin {
      */
     public static void selfTest() {
         selfTestEntitled();
-        selfTestNotEntitled();
+        // selfTestNotEntitled();
     }
 
     private static void selfTestEntitled() {

libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsDeniedIT.java

@@ -14,7 +14,9 @@
 
 import org.elasticsearch.entitlement.qa.test.RestEntitlementsCheckAction;
 import org.junit.ClassRule;
+import org.junit.Ignore;
 
+@Ignore
 public class EntitlementsDeniedIT extends AbstractEntitlementsIT {
 
     @ClassRule

libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsDeniedNonModularIT.java

@@ -14,7 +14,9 @@
 
 import org.elasticsearch.entitlement.qa.test.RestEntitlementsCheckAction;
 import org.junit.ClassRule;
+import org.junit.Ignore;
 
+@Ignore
 public class EntitlementsDeniedNonModularIT extends AbstractEntitlementsIT {
 
     @ClassRule

libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/EntitlementBootstrap.java

@@ -84,7 +84,7 @@ public static void bootstrap(
         EntitlementBootstrap.bootstrapArgs = new BootstrapArgs(pluginPolicies, pluginResolver, dataDirs, configDir, tempDir);
         exportInitializationToAgent();
         loadAgent(findAgentJar());
-        selfTest();
+        // selfTest();
     }
 
     @SuppressForbidden(reason = "The VirtualMachine API is the only way to attach a java agent dynamically")

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java

@@ -43,6 +43,7 @@
 import java.util.stream.Stream;
 
 import static java.lang.StackWalker.Option.RETAIN_CLASS_REFERENCE;
+import static java.util.Collections.newSetFromMap;
 import static java.util.Objects.requireNonNull;
 import static java.util.function.Predicate.not;
 import static java.util.stream.Collectors.groupingBy;
@@ -376,10 +377,19 @@ public void checkWriteProperty(Class<?> callerClass, String property) {
         );
     }
 
+    @SuppressForbidden(reason = "I'll print to stderr and you can't stop me")
     private static void notEntitled(String message) {
-        throw new NotEntitledException(message);
+        if (true) {
+            if (ALREADY_REPORTED.add(message)) {
+                System.err.println(message);
+            }
+        } else {
+            throw new NotEntitledException(message);
+        }
     }
 
+    private static final Set<String> ALREADY_REPORTED = newSetFromMap(new ConcurrentHashMap<>());
+
     public void checkManageThreadsEntitlement(Class<?> callerClass) {
         checkEntitlementPresent(callerClass, ManageThreadsEntitlement.class);
     }