Skip to content

Commit 7437105

Browse files
prdoyleprdoyle
authored
Miscellaneous java.base file entitlements (#122906) (#122959)
* java.base entitlements * SuppressForbidden, and add a missing test * Revert logging back to commented-out printlns * Merge FileCheckActions and rename for overloads * Remove stray logger * Remove more traces of logging change * Remove more traces of logging
1 parent 48048d4 commit 7437105

File tree

4 files changed

+293
-16
lines changed

4 files changed

+293
-16
lines changed

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@
6666
import java.nio.file.attribute.FileAttribute;
6767
import java.nio.file.attribute.UserPrincipal;
6868
import java.nio.file.spi.FileSystemProvider;
69+
import java.security.KeyStore;
70+
import java.security.Provider;
6971
import java.security.cert.CertStoreParameters;
7072
import java.util.List;
7173
import java.util.Locale;
@@ -621,12 +623,50 @@ public interface EntitlementChecker {
621623

622624
void check$java_io_RandomAccessFile$(Class<?> callerClass, File file, String mode);
623625

626+
void check$java_security_KeyStore$$getInstance(Class<?> callerClass, File file, char[] password);
627+
628+
void check$java_security_KeyStore$$getInstance(Class<?> callerClass, File file, KeyStore.LoadStoreParameter param);
629+
630+
void check$java_security_KeyStore$Builder$$newInstance(Class<?> callerClass, File file, KeyStore.ProtectionParameter protection);
631+
632+
void check$java_security_KeyStore$Builder$$newInstance(
633+
Class<?> callerClass,
634+
String type,
635+
Provider provider,
636+
File file,
637+
KeyStore.ProtectionParameter protection
638+
);
639+
624640
void check$java_util_Scanner$(Class<?> callerClass, File source);
625641

626642
void check$java_util_Scanner$(Class<?> callerClass, File source, String charsetName);
627643

628644
void check$java_util_Scanner$(Class<?> callerClass, File source, Charset charset);
629645

646+
void check$java_util_jar_JarFile$(Class<?> callerClass, String name);
647+
648+
void check$java_util_jar_JarFile$(Class<?> callerClass, String name, boolean verify);
649+
650+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file);
651+
652+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify);
653+
654+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify, int mode);
655+
656+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify, int mode, Runtime.Version version);
657+
658+
void check$java_util_zip_ZipFile$(Class<?> callerClass, String name);
659+
660+
void check$java_util_zip_ZipFile$(Class<?> callerClass, String name, Charset charset);
661+
662+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file);
663+
664+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, int mode);
665+
666+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, Charset charset);
667+
668+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, int mode, Charset charset);
669+
630670
// nio
631671
void check$java_nio_file_Files$$getOwner(Class<?> callerClass, Path path, LinkOption... options);
632672

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 147 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99

1010
package org.elasticsearch.entitlement.qa.test;
1111

12+
import org.elasticsearch.core.CheckedRunnable;
1213
import org.elasticsearch.core.SuppressForbidden;
1314
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
1415

@@ -26,12 +27,22 @@
2627
import java.nio.file.Path;
2728
import java.nio.file.Paths;
2829
import java.nio.file.attribute.UserPrincipal;
30+
import java.security.GeneralSecurityException;
31+
import java.security.KeyStore;
2932
import java.util.Scanner;
30-
33+
import java.util.jar.JarFile;
34+
import java.util.zip.ZipException;
35+
import java.util.zip.ZipFile;
36+
37+
import static java.nio.charset.Charset.defaultCharset;
38+
import static java.util.zip.ZipFile.OPEN_DELETE;
39+
import static java.util.zip.ZipFile.OPEN_READ;
40+
import static org.elasticsearch.entitlement.qa.entitled.EntitledActions.createTempFileForWrite;
3141
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;
3242
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
3343

3444
@SuppressForbidden(reason = "Explicitly checking APIs that are forbidden")
45+
@SuppressWarnings("unused") // Called via reflection
3546
class FileCheckActions {
3647

3748
static Path testRootDir = Paths.get(System.getProperty("es.entitlements.testdir"));
@@ -207,21 +218,6 @@ static void fileSetWritableOwner() throws IOException {
207218
readWriteFile().toFile().setWritable(true, false);
208219
}
209220

210-
@EntitlementTest(expectedAccess = PLUGINS)
211-
static void createScannerFile() throws FileNotFoundException {
212-
new Scanner(readFile().toFile());
213-
}
214-
215-
@EntitlementTest(expectedAccess = PLUGINS)
216-
static void createScannerFileWithCharset() throws IOException {
217-
new Scanner(readFile().toFile(), StandardCharsets.UTF_8);
218-
}
219-
220-
@EntitlementTest(expectedAccess = PLUGINS)
221-
static void createScannerFileWithCharsetName() throws FileNotFoundException {
222-
new Scanner(readFile().toFile(), "UTF-8");
223-
}
224-
225221
@EntitlementTest(expectedAccess = PLUGINS)
226222
static void createFileInputStreamFile() throws IOException {
227223
new FileInputStream(readFile().toFile()).close();
@@ -363,5 +359,140 @@ static void filesSetOwner() throws IOException {
363359
Files.setOwner(readWriteFile(), owner); // set to existing owner, just trying to execute the method
364360
}
365361

362+
@EntitlementTest(expectedAccess = PLUGINS)
363+
static void keystoreGetInstance_FileCharArray() throws IOException {
364+
try {
365+
KeyStore.getInstance(readFile().toFile(), new char[0]);
366+
} catch (GeneralSecurityException expected) {
367+
return;
368+
}
369+
throw new AssertionError("Expected an exception");
370+
}
371+
372+
@EntitlementTest(expectedAccess = PLUGINS)
373+
static void keystoreGetInstance_FileLoadStoreParameter() throws IOException {
374+
try {
375+
KeyStore.LoadStoreParameter loadStoreParameter = () -> null;
376+
KeyStore.getInstance(readFile().toFile(), loadStoreParameter);
377+
} catch (GeneralSecurityException expected) {
378+
return;
379+
}
380+
throw new AssertionError("Expected an exception");
381+
}
382+
383+
@EntitlementTest(expectedAccess = PLUGINS)
384+
static void keystoreBuilderNewInstance() {
385+
try {
386+
KeyStore.Builder.newInstance("", null, readFile().toFile(), null);
387+
} catch (NullPointerException expected) {
388+
return;
389+
}
390+
throw new AssertionError("Expected an exception");
391+
}
392+
393+
@EntitlementTest(expectedAccess = PLUGINS)
394+
static void zipFile_String() throws IOException {
395+
expectZipException(() -> new ZipFile(readFile().toString()).close());
396+
}
397+
398+
@EntitlementTest(expectedAccess = PLUGINS)
399+
static void zipFile_StringCharset() throws IOException {
400+
expectZipException(() -> new ZipFile(readFile().toString(), defaultCharset()).close());
401+
}
402+
403+
@EntitlementTest(expectedAccess = PLUGINS)
404+
static void zipFile_File() throws IOException {
405+
expectZipException(() -> new ZipFile(readFile().toFile()).close());
406+
}
407+
408+
@EntitlementTest(expectedAccess = PLUGINS)
409+
static void zipFile_FileCharset() throws IOException {
410+
expectZipException(() -> new ZipFile(readFile().toFile(), defaultCharset()).close());
411+
}
412+
413+
@EntitlementTest(expectedAccess = PLUGINS)
414+
static void zipFile_FileReadOnly() throws IOException {
415+
expectZipException(() -> new ZipFile(readFile().toFile(), OPEN_READ).close());
416+
}
417+
418+
@EntitlementTest(expectedAccess = PLUGINS)
419+
static void zipFile_FileReadAndDelete() throws IOException {
420+
expectZipException(() -> new ZipFile(createTempFileForWrite().toFile(), OPEN_READ | OPEN_DELETE).close());
421+
}
422+
423+
@EntitlementTest(expectedAccess = PLUGINS)
424+
static void zipFile_ReadOnlyCharset() throws IOException {
425+
expectZipException(() -> new ZipFile(readFile().toFile(), OPEN_READ, defaultCharset()).close());
426+
}
427+
428+
@EntitlementTest(expectedAccess = PLUGINS)
429+
static void zipFile_ReadAndDeleteCharset() throws IOException {
430+
expectZipException(() -> new ZipFile(createTempFileForWrite().toFile(), OPEN_READ | OPEN_DELETE, defaultCharset()).close());
431+
}
432+
433+
@EntitlementTest(expectedAccess = PLUGINS)
434+
static void jarFile_String() throws IOException {
435+
expectZipException(() -> new JarFile(readFile().toString()).close());
436+
}
437+
438+
@EntitlementTest(expectedAccess = PLUGINS)
439+
static void jarFile_StringBoolean() throws IOException {
440+
expectZipException(() -> new JarFile(readFile().toString(), false).close());
441+
}
442+
443+
@EntitlementTest(expectedAccess = PLUGINS)
444+
static void jarFile_FileReadOnly() throws IOException {
445+
expectZipException(() -> new JarFile(readFile().toFile(), false, OPEN_READ).close());
446+
}
447+
448+
@EntitlementTest(expectedAccess = PLUGINS)
449+
static void jarFile_FileReadAndDelete() throws IOException {
450+
expectZipException(() -> new JarFile(createTempFileForWrite().toFile(), false, OPEN_READ | OPEN_DELETE).close());
451+
}
452+
453+
@EntitlementTest(expectedAccess = PLUGINS)
454+
static void jarFile_FileBooleanReadOnlyVersion() throws IOException {
455+
expectZipException(() -> new JarFile(readFile().toFile(), false, OPEN_READ, Runtime.version()).close());
456+
}
457+
458+
@EntitlementTest(expectedAccess = PLUGINS)
459+
static void jarFile_FileBooleanReadAndDeleteOnlyVersion() throws IOException {
460+
expectZipException(() -> new JarFile(createTempFileForWrite().toFile(), false, OPEN_READ | OPEN_DELETE, Runtime.version()).close());
461+
}
462+
463+
@EntitlementTest(expectedAccess = PLUGINS)
464+
static void jarFile_File() throws IOException {
465+
expectZipException(() -> new JarFile(readFile().toFile()).close());
466+
}
467+
468+
@EntitlementTest(expectedAccess = PLUGINS)
469+
static void jarFileFileBoolean() throws IOException {
470+
expectZipException(() -> new JarFile(readFile().toFile(), false).close());
471+
}
472+
473+
private static void expectZipException(CheckedRunnable<IOException> action) throws IOException {
474+
try {
475+
action.run();
476+
} catch (ZipException expected) {
477+
return;
478+
}
479+
throw new AssertionError("Expected an exception");
480+
}
481+
482+
@EntitlementTest(expectedAccess = PLUGINS)
483+
static void createScannerFile() throws FileNotFoundException {
484+
new Scanner(readFile().toFile());
485+
}
486+
487+
@EntitlementTest(expectedAccess = PLUGINS)
488+
static void createScannerFileWithCharset() throws IOException {
489+
new Scanner(readFile().toFile(), StandardCharsets.UTF_8);
490+
}
491+
492+
@EntitlementTest(expectedAccess = PLUGINS)
493+
static void createScannerFileWithCharsetName() throws FileNotFoundException {
494+
new Scanner(readFile().toFile(), "UTF-8");
495+
}
496+
366497
private FileCheckActions() {}
367498
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,8 @@
7474
import java.nio.file.attribute.FileAttribute;
7575
import java.nio.file.attribute.UserPrincipal;
7676
import java.nio.file.spi.FileSystemProvider;
77+
import java.security.KeyStore;
78+
import java.security.Provider;
7779
import java.security.cert.CertStoreParameters;
7880
import java.util.List;
7981
import java.util.Locale;
@@ -1232,6 +1234,36 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
12321234
}
12331235
}
12341236

1237+
@Override
1238+
public void check$java_security_KeyStore$$getInstance(Class<?> callerClass, File file, char[] password) {
1239+
policyManager.checkFileRead(callerClass, file);
1240+
}
1241+
1242+
@Override
1243+
public void check$java_security_KeyStore$$getInstance(Class<?> callerClass, File file, KeyStore.LoadStoreParameter param) {
1244+
policyManager.checkFileRead(callerClass, file);
1245+
}
1246+
1247+
@Override
1248+
public void check$java_security_KeyStore$Builder$$newInstance(
1249+
Class<?> callerClass,
1250+
File file,
1251+
KeyStore.ProtectionParameter protection
1252+
) {
1253+
policyManager.checkFileRead(callerClass, file);
1254+
}
1255+
1256+
@Override
1257+
public void check$java_security_KeyStore$Builder$$newInstance(
1258+
Class<?> callerClass,
1259+
String type,
1260+
Provider provider,
1261+
File file,
1262+
KeyStore.ProtectionParameter protection
1263+
) {
1264+
policyManager.checkFileRead(callerClass, file);
1265+
}
1266+
12351267
@Override
12361268
public void check$java_util_Scanner$(Class<?> callerClass, File source) {
12371269
policyManager.checkFileRead(callerClass, source);
@@ -1247,6 +1279,66 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
12471279
policyManager.checkFileRead(callerClass, source);
12481280
}
12491281

1282+
@Override
1283+
public void check$java_util_jar_JarFile$(Class<?> callerClass, String name) {
1284+
policyManager.checkFileRead(callerClass, new File(name));
1285+
}
1286+
1287+
@Override
1288+
public void check$java_util_jar_JarFile$(Class<?> callerClass, String name, boolean verify) {
1289+
policyManager.checkFileRead(callerClass, new File(name));
1290+
}
1291+
1292+
@Override
1293+
public void check$java_util_jar_JarFile$(Class<?> callerClass, File file) {
1294+
policyManager.checkFileRead(callerClass, file);
1295+
}
1296+
1297+
@Override
1298+
public void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify) {
1299+
policyManager.checkFileRead(callerClass, file);
1300+
}
1301+
1302+
@Override
1303+
public void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify, int mode) {
1304+
policyManager.checkFileWithZipMode(callerClass, file, mode);
1305+
}
1306+
1307+
@Override
1308+
public void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify, int mode, Runtime.Version version) {
1309+
policyManager.checkFileWithZipMode(callerClass, file, mode);
1310+
}
1311+
1312+
@Override
1313+
public void check$java_util_zip_ZipFile$(Class<?> callerClass, String name) {
1314+
policyManager.checkFileRead(callerClass, new File(name));
1315+
}
1316+
1317+
@Override
1318+
public void check$java_util_zip_ZipFile$(Class<?> callerClass, String name, Charset charset) {
1319+
policyManager.checkFileRead(callerClass, new File(name));
1320+
}
1321+
1322+
@Override
1323+
public void check$java_util_zip_ZipFile$(Class<?> callerClass, File file) {
1324+
policyManager.checkFileRead(callerClass, file);
1325+
}
1326+
1327+
@Override
1328+
public void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, int mode) {
1329+
policyManager.checkFileWithZipMode(callerClass, file, mode);
1330+
}
1331+
1332+
@Override
1333+
public void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, Charset charset) {
1334+
policyManager.checkFileRead(callerClass, file);
1335+
}
1336+
1337+
@Override
1338+
public void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, int mode, Charset charset) {
1339+
policyManager.checkFileWithZipMode(callerClass, file, mode);
1340+
}
1341+
12501342
// nio
12511343

12521344
@Override

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,8 @@
4848
import static java.util.function.Predicate.not;
4949
import static java.util.stream.Collectors.groupingBy;
5050
import static java.util.stream.Collectors.toUnmodifiableMap;
51+
import static java.util.zip.ZipFile.OPEN_DELETE;
52+
import static java.util.zip.ZipFile.OPEN_READ;
5153

5254
public class PolicyManager {
5355
private static final Logger logger = LogManager.getLogger(PolicyManager.class);
@@ -304,6 +306,18 @@ public void checkFileWrite(Class<?> callerClass, Path path) {
304306
}
305307
}
306308

309+
@SuppressForbidden(reason = "Explicitly checking File apis")
310+
public void checkFileWithZipMode(Class<?> callerClass, File file, int zipMode) {
311+
assert zipMode == OPEN_READ || zipMode == (OPEN_READ | OPEN_DELETE);
312+
if ((zipMode & OPEN_DELETE) == OPEN_DELETE) {
313+
// This needs both read and write, but we happen to know that checkFileWrite
314+
// actually checks both.
315+
checkFileWrite(callerClass, file);
316+
} else {
317+
checkFileRead(callerClass, file);
318+
}
319+
}
320+
307321
public void checkFileDescriptorRead(Class<?> callerClass) {
308322
neverEntitled(callerClass, () -> "read file descriptor");
309323
}

0 commit comments

Comments
 (0)