Skip to content

Commit 69f6520

Browse files
ldematteldematte
authored
[Entitlements] Validation checks on paths (#126852)
With this PR we restrict the paths we allow access to, forbidding plugins to specify/request entitlements for reading or writing to specific protected directories. I added this validation to EntitlementInitialization, as I wanted to fail fast and this is the earliest occurrence where we have all we need: PathLookup to resolve relative paths, policies (for plugins, server, agents) and the Paths for the specific directories we want to protect. Relates to ES-10918
1 parent 4c9c824 commit 69f6520

File tree

8 files changed

+309
-24
lines changed

8 files changed

+309
-24
lines changed

‎docs/changelog/126852.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 126852
2+
summary: "Validation checks on paths allowed for 'files' entitlements. Restrict the paths we allow access to, forbidding plugins to specify/request entitlements for reading or writing to specific protected directories."
3+
area: Infra/Core
4+
type: enhancement
5+
issues: []

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
import org.elasticsearch.core.Booleans;
1313
import org.elasticsearch.core.PathUtils;
14+
import org.elasticsearch.core.Strings;
1415
import org.elasticsearch.core.internal.provider.ProviderLocator;
1516
import org.elasticsearch.entitlement.bootstrap.EntitlementBootstrap;
1617
import org.elasticsearch.entitlement.bridge.EntitlementChecker;
@@ -20,6 +21,7 @@
2021
import org.elasticsearch.entitlement.instrumentation.MethodKey;
2122
import org.elasticsearch.entitlement.instrumentation.Transformer;
2223
import org.elasticsearch.entitlement.runtime.api.ElasticsearchEntitlementChecker;
24+
import org.elasticsearch.entitlement.runtime.policy.FileAccessTree;
2325
import org.elasticsearch.entitlement.runtime.policy.PathLookup;
2426
import org.elasticsearch.entitlement.runtime.policy.Policy;
2527
import org.elasticsearch.entitlement.runtime.policy.PolicyManager;
@@ -56,6 +58,7 @@
5658
import java.nio.file.attribute.FileAttribute;
5759
import java.nio.file.spi.FileSystemProvider;
5860
import java.util.ArrayList;
61+
import java.util.Arrays;
5962
import java.util.Collections;
6063
import java.util.HashMap;
6164
import java.util.List;
@@ -315,6 +318,16 @@ private static PolicyManager createPolicyManager() {
315318
)
316319
)
317320
);
321+
322+
validateFilesEntitlements(
323+
pluginPolicies,
324+
pathLookup,
325+
bootstrapArgs.configDir(),
326+
bootstrapArgs.pluginsDir(),
327+
bootstrapArgs.modulesDir(),
328+
bootstrapArgs.libDir()
329+
);
330+
318331
return new PolicyManager(
319332
serverPolicy,
320333
agentEntitlements,
@@ -328,6 +341,81 @@ private static PolicyManager createPolicyManager() {
328341
);
329342
}
330343

344+
private static Set<Path> pathSet(Path... paths) {
345+
return Arrays.stream(paths).map(x -> x.toAbsolutePath().normalize()).collect(Collectors.toUnmodifiableSet());
346+
}
347+
348+
// package visible for tests
349+
static void validateFilesEntitlements(
350+
Map<String, Policy> pluginPolicies,
351+
PathLookup pathLookup,
352+
Path configDir,
353+
Path pluginsDir,
354+
Path modulesDir,
355+
Path libDir
356+
) {
357+
var readAccessForbidden = pathSet(pluginsDir, modulesDir, libDir);
358+
var writeAccessForbidden = pathSet(configDir);
359+
for (var pluginPolicy : pluginPolicies.entrySet()) {
360+
for (var scope : pluginPolicy.getValue().scopes()) {
361+
var filesEntitlement = scope.entitlements()
362+
.stream()
363+
.filter(x -> x instanceof FilesEntitlement)
364+
.map(x -> ((FilesEntitlement) x))
365+
.findFirst();
366+
if (filesEntitlement.isPresent()) {
367+
var fileAccessTree = FileAccessTree.withoutExclusivePaths(filesEntitlement.get(), pathLookup, null);
368+
validateReadFilesEntitlements(pluginPolicy.getKey(), scope.moduleName(), fileAccessTree, readAccessForbidden);
369+
validateWriteFilesEntitlements(pluginPolicy.getKey(), scope.moduleName(), fileAccessTree, writeAccessForbidden);
370+
}
371+
}
372+
}
373+
}
374+
375+
private static IllegalArgumentException buildValidationException(
376+
String componentName,
377+
String moduleName,
378+
Path forbiddenPath,
379+
FilesEntitlement.Mode mode
380+
) {
381+
return new IllegalArgumentException(
382+
Strings.format(
383+
"policy for module [%s] in [%s] has an invalid file entitlement. Any path under [%s] is forbidden for mode [%s].",
384+
moduleName,
385+
componentName,
386+
forbiddenPath,
387+
mode
388+
)
389+
);
390+
}
391+
392+
private static void validateReadFilesEntitlements(
393+
String componentName,
394+
String moduleName,
395+
FileAccessTree fileAccessTree,
396+
Set<Path> readForbiddenPaths
397+
) {
398+
399+
for (Path forbiddenPath : readForbiddenPaths) {
400+
if (fileAccessTree.canRead(forbiddenPath)) {
401+
throw buildValidationException(componentName, moduleName, forbiddenPath, READ);
402+
}
403+
}
404+
}
405+
406+
private static void validateWriteFilesEntitlements(
407+
String componentName,
408+
String moduleName,
409+
FileAccessTree fileAccessTree,
410+
Set<Path> writeForbiddenPaths
411+
) {
412+
for (Path forbiddenPath : writeForbiddenPaths) {
413+
if (fileAccessTree.canWrite(forbiddenPath)) {
414+
throw buildValidationException(componentName, moduleName, forbiddenPath, READ_WRITE);
415+
}
416+
}
417+
}
418+
331419
private static Path getUserHome() {
332420
String userHome = System.getProperty("user.home");
333421
if (userHome == null) {

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTree.java‎

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -111,12 +111,9 @@ static void validateExclusivePaths(List<ExclusivePath> exclusivePaths) {
111111
private final String[] readPaths;
112112
private final String[] writePaths;
113113

114-
private FileAccessTree(
114+
private static String[] buildUpdatedAndSortedExclusivePaths(
115115
String componentName,
116116
String moduleName,
117-
FilesEntitlement filesEntitlement,
118-
PathLookup pathLookup,
119-
Path componentPath,
120117
List<ExclusivePath> exclusivePaths
121118
) {
122119
List<String> updatedExclusivePaths = new ArrayList<>();
@@ -125,7 +122,11 @@ private FileAccessTree(
125122
updatedExclusivePaths.add(exclusivePath.path());
126123
}
127124
}
125+
updatedExclusivePaths.sort(PATH_ORDER);
126+
return updatedExclusivePaths.toArray(new String[0]);
127+
}
128128

129+
private FileAccessTree(FilesEntitlement filesEntitlement, PathLookup pathLookup, Path componentPath, String[] sortedExclusivePaths) {
129130
List<String> readPaths = new ArrayList<>();
130131
List<String> writePaths = new ArrayList<>();
131132
BiConsumer<Path, Mode> addPath = (path, mode) -> {
@@ -177,11 +178,10 @@ private FileAccessTree(
177178
Path jdk = Paths.get(System.getProperty("java.home"));
178179
addPathAndMaybeLink.accept(jdk.resolve("conf"), Mode.READ);
179180

180-
updatedExclusivePaths.sort(PATH_ORDER);
181181
readPaths.sort(PATH_ORDER);
182182
writePaths.sort(PATH_ORDER);
183183

184-
this.exclusivePaths = updatedExclusivePaths.toArray(new String[0]);
184+
this.exclusivePaths = sortedExclusivePaths;
185185
this.readPaths = pruneSortedPaths(readPaths).toArray(new String[0]);
186186
this.writePaths = pruneSortedPaths(writePaths).toArray(new String[0]);
187187
}
@@ -203,22 +203,38 @@ static List<String> pruneSortedPaths(List<String> paths) {
203203
return prunedReadPaths;
204204
}
205205

206-
public static FileAccessTree of(
206+
static FileAccessTree of(
207207
String componentName,
208208
String moduleName,
209209
FilesEntitlement filesEntitlement,
210210
PathLookup pathLookup,
211211
@Nullable Path componentPath,
212212
List<ExclusivePath> exclusivePaths
213213
) {
214-
return new FileAccessTree(componentName, moduleName, filesEntitlement, pathLookup, componentPath, exclusivePaths);
214+
return new FileAccessTree(
215+
filesEntitlement,
216+
pathLookup,
217+
componentPath,
218+
buildUpdatedAndSortedExclusivePaths(componentName, moduleName, exclusivePaths)
219+
);
220+
}
221+
222+
/**
223+
* A special factory method to create a FileAccessTree with no ExclusivePaths, e.g. for quick validation or for default file access
224+
*/
225+
public static FileAccessTree withoutExclusivePaths(
226+
FilesEntitlement filesEntitlement,
227+
PathLookup pathLookup,
228+
@Nullable Path componentPath
229+
) {
230+
return new FileAccessTree(filesEntitlement, pathLookup, componentPath, new String[0]);
215231
}
216232

217-
boolean canRead(Path path) {
233+
public boolean canRead(Path path) {
218234
return checkPath(normalizePath(path), readPaths);
219235
}
220236

221-
boolean canWrite(Path path) {
237+
public boolean canWrite(Path path) {
222238
return checkPath(normalizePath(path), writePaths);
223239
}
224240

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -101,18 +101,13 @@ public <E extends Entitlement> Stream<E> getEntitlements(Class<E> entitlementCla
101101
}
102102
}
103103

104-
private FileAccessTree getDefaultFileAccess(String componentName, Path componentPath) {
105-
return FileAccessTree.of(componentName, UNKNOWN_COMPONENT_NAME, FilesEntitlement.EMPTY, pathLookup, componentPath, List.of());
104+
private FileAccessTree getDefaultFileAccess(Path componentPath) {
105+
return FileAccessTree.withoutExclusivePaths(FilesEntitlement.EMPTY, pathLookup, componentPath);
106106
}
107107

108108
// pkg private for testing
109109
ModuleEntitlements defaultEntitlements(String componentName, Path componentPath, String moduleName) {
110-
return new ModuleEntitlements(
111-
componentName,
112-
Map.of(),
113-
getDefaultFileAccess(componentName, componentPath),
114-
getLogger(componentName, moduleName)
115-
);
110+
return new ModuleEntitlements(componentName, Map.of(), getDefaultFileAccess(componentPath), getLogger(componentName, moduleName));
116111
}
117112

118113
// pkg private for testing

0 commit comments

Comments
 (0)