Skip to content

Commit 77dbb79

Browse files
moschemosche
committed
Add entitlement checks for java.io stream classes
1 parent 99c5398 commit 77dbb79

File tree

4 files changed

+269
-0
lines changed

4 files changed

+269
-0
lines changed

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
package org.elasticsearch.entitlement.bridge;
1111

1212
import java.io.File;
13+
import java.io.FileDescriptor;
1314
import java.io.InputStream;
1415
import java.io.PrintStream;
1516
import java.io.PrintWriter;
@@ -531,14 +532,54 @@ public interface EntitlementChecker {
531532

532533
void check$java_io_File$setWritable(Class<?> callerClass, File file, boolean writable, boolean ownerOnly);
533534

535+
void check$java_io_FileInputStream$(Class<?> callerClass, File file);
536+
537+
void check$java_io_FileInputStream$(Class<?> callerClass, FileDescriptor fd);
538+
539+
void check$java_io_FileInputStream$(Class<?> callerClass, String name);
540+
534541
void check$java_io_FileOutputStream$(Class<?> callerClass, File file);
535542

536543
void check$java_io_FileOutputStream$(Class<?> callerClass, File file, boolean append);
537544

545+
void check$java_io_FileOutputStream$(Class<?> callerClass, FileDescriptor fd);
546+
538547
void check$java_io_FileOutputStream$(Class<?> callerClass, String name);
539548

540549
void check$java_io_FileOutputStream$(Class<?> callerClass, String name, boolean append);
541550

551+
void check$java_io_FileReader$(Class<?> callerClass, File file);
552+
553+
void check$java_io_FileReader$(Class<?> callerClass, File file, Charset charset);
554+
555+
void check$java_io_FileReader$(Class<?> callerClass, FileDescriptor fd);
556+
557+
void check$java_io_FileReader$(Class<?> callerClass, String name);
558+
559+
void check$java_io_FileReader$(Class<?> callerClass, String name, Charset charset);
560+
561+
void check$java_io_FileWriter$(Class<?> callerClass, File file);
562+
563+
void check$java_io_FileWriter$(Class<?> callerClass, File file, boolean append);
564+
565+
void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset);
566+
567+
void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset, boolean append);
568+
569+
void check$java_io_FileWriter$(Class<?> callerClass, FileDescriptor fd);
570+
571+
void check$java_io_FileWriter$(Class<?> callerClass, String name);
572+
573+
void check$java_io_FileWriter$(Class<?> callerClass, String name, boolean append);
574+
575+
void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset);
576+
577+
void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset, boolean append);
578+
579+
void check$java_io_RandomAccessFile$(Class<?> callerClass, String name, String mode);
580+
581+
void check$java_io_RandomAccessFile$(Class<?> callerClass, File file, String mode);
582+
542583
void check$java_util_Scanner$(Class<?> callerClass, File source);
543584

544585
void check$java_util_Scanner$(Class<?> callerClass, File source, String charsetName);

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,22 @@
1313
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
1414

1515
import java.io.File;
16+
import java.io.FileDescriptor;
17+
import java.io.FileInputStream;
1618
import java.io.FileNotFoundException;
1719
import java.io.FileOutputStream;
20+
import java.io.FileReader;
21+
import java.io.FileWriter;
1822
import java.io.IOException;
23+
import java.io.RandomAccessFile;
1924
import java.nio.charset.StandardCharsets;
2025
import java.nio.file.Files;
2126
import java.nio.file.Path;
2227
import java.nio.file.Paths;
2328
import java.nio.file.attribute.UserPrincipal;
2429
import java.util.Scanner;
2530

31+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;
2632
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
2733

2834
@SuppressForbidden(reason = "Explicitly checking APIs that are forbidden")
@@ -146,6 +152,21 @@ static void createScannerFileWithCharsetName() throws FileNotFoundException {
146152
new Scanner(readFile().toFile(), "UTF-8");
147153
}
148154

155+
@EntitlementTest(expectedAccess = PLUGINS)
156+
static void createFileInputStreamFile() throws IOException {
157+
new FileInputStream(readFile().toFile()).close();
158+
}
159+
160+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
161+
static void createFileInputStreamFileDescriptor() throws IOException {
162+
new FileInputStream(FileDescriptor.in).close();
163+
}
164+
165+
@EntitlementTest(expectedAccess = PLUGINS)
166+
static void createFileInputStreamString() throws IOException {
167+
new FileInputStream(readFile().toString()).close();
168+
}
169+
149170
@EntitlementTest(expectedAccess = PLUGINS)
150171
static void createFileOutputStreamString() throws IOException {
151172
new FileOutputStream(readWriteFile().toString()).close();
@@ -166,6 +187,96 @@ static void createFileOutputStreamFileWithAppend() throws IOException {
166187
new FileOutputStream(readWriteFile().toFile(), false).close();
167188
}
168189

190+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
191+
static void createFileOutputStreamFileDescriptor() throws IOException {
192+
new FileOutputStream(FileDescriptor.out).close();
193+
}
194+
195+
@EntitlementTest(expectedAccess = PLUGINS)
196+
static void createFileReaderFile() throws IOException {
197+
new FileReader(readFile().toFile()).close();
198+
}
199+
200+
@EntitlementTest(expectedAccess = PLUGINS)
201+
static void createFileReaderFileCharset() throws IOException {
202+
new FileReader(readFile().toFile(), StandardCharsets.UTF_8).close();
203+
}
204+
205+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
206+
static void createFileReaderFileDescriptor() throws IOException {
207+
new FileReader(FileDescriptor.in).close();
208+
}
209+
210+
@EntitlementTest(expectedAccess = PLUGINS)
211+
static void createFileReaderString() throws IOException {
212+
new FileReader(readFile().toString()).close();
213+
}
214+
215+
@EntitlementTest(expectedAccess = PLUGINS)
216+
static void createFileReaderStringCharset() throws IOException {
217+
new FileReader(readFile().toString(), StandardCharsets.UTF_8).close();
218+
}
219+
220+
@EntitlementTest(expectedAccess = PLUGINS)
221+
static void createFileWriterFile() throws IOException {
222+
new FileWriter(readWriteFile().toFile()).close();
223+
}
224+
225+
@EntitlementTest(expectedAccess = PLUGINS)
226+
static void createFileWriterFileWithAppend() throws IOException {
227+
new FileWriter(readWriteFile().toFile(), false).close();
228+
}
229+
230+
@EntitlementTest(expectedAccess = PLUGINS)
231+
static void createFileWriterFileCharsetWithAppend() throws IOException {
232+
new FileWriter(readWriteFile().toFile(), StandardCharsets.UTF_8, false).close();
233+
}
234+
235+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
236+
static void createFileWriterFileDescriptor() throws IOException {
237+
new FileWriter(FileDescriptor.out).close();
238+
}
239+
240+
@EntitlementTest(expectedAccess = PLUGINS)
241+
static void createFileWriterString() throws IOException {
242+
new FileWriter(readWriteFile().toString()).close();
243+
}
244+
245+
@EntitlementTest(expectedAccess = PLUGINS)
246+
static void createFileWriterStringWithAppend() throws IOException {
247+
new FileWriter(readWriteFile().toString(), false).close();
248+
}
249+
250+
@EntitlementTest(expectedAccess = PLUGINS)
251+
static void createFileWriterStringCharset() throws IOException {
252+
new FileWriter(readWriteFile().toString(), StandardCharsets.UTF_8).close();
253+
}
254+
255+
@EntitlementTest(expectedAccess = PLUGINS)
256+
static void createFileWriterStringCharsetWithAppend() throws IOException {
257+
new FileWriter(readWriteFile().toString(), StandardCharsets.UTF_8, false).close();
258+
}
259+
260+
@EntitlementTest(expectedAccess = PLUGINS)
261+
static void createRandomAccessFileStringRead() throws IOException {
262+
new RandomAccessFile(readFile().toString(), "r").close();
263+
}
264+
265+
@EntitlementTest(expectedAccess = PLUGINS)
266+
static void createRandomAccessFileStringReadWrite() throws IOException {
267+
new RandomAccessFile(readWriteFile().toString(), "rw").close();
268+
}
269+
270+
@EntitlementTest(expectedAccess = PLUGINS)
271+
static void createRandomAccessFileRead() throws IOException {
272+
new RandomAccessFile(readFile().toFile(), "r").close();
273+
}
274+
275+
@EntitlementTest(expectedAccess = PLUGINS)
276+
static void createRandomAccessFileReadWrite() throws IOException {
277+
new RandomAccessFile(readWriteFile().toFile(), "rw").close();
278+
}
279+
169280
@EntitlementTest(expectedAccess = PLUGINS)
170281
static void filesGetOwner() throws IOException {
171282
Files.getOwner(readFile());

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import org.elasticsearch.entitlement.runtime.policy.PolicyManager;
1515

1616
import java.io.File;
17+
import java.io.FileDescriptor;
1718
import java.io.InputStream;
1819
import java.io.PrintStream;
1920
import java.io.PrintWriter;
@@ -1017,6 +1018,21 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
10171018
policyManager.checkFileWrite(callerClass, file);
10181019
}
10191020

1021+
@Override
1022+
public void check$java_io_FileInputStream$(Class<?> callerClass, File file) {
1023+
policyManager.checkFileRead(callerClass, file);
1024+
}
1025+
1026+
@Override
1027+
public void check$java_io_FileInputStream$(Class<?> callerClass, FileDescriptor fd) {
1028+
policyManager.checkFileDescriptorRead(callerClass);
1029+
}
1030+
1031+
@Override
1032+
public void check$java_io_FileInputStream$(Class<?> callerClass, String name) {
1033+
policyManager.checkFileRead(callerClass, new File(name));
1034+
}
1035+
10201036
@Override
10211037
public void check$java_io_FileOutputStream$(Class<?> callerClass, String name) {
10221038
policyManager.checkFileWrite(callerClass, new File(name));
@@ -1037,6 +1053,99 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
10371053
policyManager.checkFileWrite(callerClass, file);
10381054
}
10391055

1056+
@Override
1057+
public void check$java_io_FileOutputStream$(Class<?> callerClass, FileDescriptor fd) {
1058+
policyManager.checkFileDescriptorWrite(callerClass);
1059+
}
1060+
1061+
@Override
1062+
public void check$java_io_FileReader$(Class<?> callerClass, File file) {
1063+
policyManager.checkFileRead(callerClass, file);
1064+
}
1065+
1066+
@Override
1067+
public void check$java_io_FileReader$(Class<?> callerClass, File file, Charset charset) {
1068+
policyManager.checkFileRead(callerClass, file);
1069+
}
1070+
1071+
@Override
1072+
public void check$java_io_FileReader$(Class<?> callerClass, FileDescriptor fd) {
1073+
policyManager.checkFileDescriptorRead(callerClass);
1074+
}
1075+
1076+
@Override
1077+
public void check$java_io_FileReader$(Class<?> callerClass, String name) {
1078+
policyManager.checkFileRead(callerClass, new File(name));
1079+
}
1080+
1081+
@Override
1082+
public void check$java_io_FileReader$(Class<?> callerClass, String name, Charset charset) {
1083+
policyManager.checkFileRead(callerClass, new File(name));
1084+
}
1085+
1086+
@Override
1087+
public void check$java_io_FileWriter$(Class<?> callerClass, File file) {
1088+
policyManager.checkFileWrite(callerClass, file);
1089+
}
1090+
1091+
@Override
1092+
public void check$java_io_FileWriter$(Class<?> callerClass, File file, boolean append) {
1093+
policyManager.checkFileWrite(callerClass, file);
1094+
}
1095+
1096+
@Override
1097+
public void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset) {
1098+
policyManager.checkFileWrite(callerClass, file);
1099+
}
1100+
1101+
@Override
1102+
public void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset, boolean append) {
1103+
policyManager.checkFileWrite(callerClass, file);
1104+
}
1105+
1106+
@Override
1107+
public void check$java_io_FileWriter$(Class<?> callerClass, FileDescriptor fd) {
1108+
policyManager.checkFileDescriptorWrite(callerClass);
1109+
}
1110+
1111+
@Override
1112+
public void check$java_io_FileWriter$(Class<?> callerClass, String name) {
1113+
policyManager.checkFileWrite(callerClass, new File(name));
1114+
}
1115+
1116+
@Override
1117+
public void check$java_io_FileWriter$(Class<?> callerClass, String name, boolean append) {
1118+
policyManager.checkFileWrite(callerClass, new File(name));
1119+
}
1120+
1121+
@Override
1122+
public void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset) {
1123+
policyManager.checkFileWrite(callerClass, new File(name));
1124+
}
1125+
1126+
@Override
1127+
public void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset, boolean append) {
1128+
policyManager.checkFileWrite(callerClass, new File(name));
1129+
}
1130+
1131+
@Override
1132+
public void check$java_io_RandomAccessFile$(Class<?> callerClass, String name, String mode) {
1133+
if (mode.equals("r")) {
1134+
policyManager.checkFileRead(callerClass, new File(name));
1135+
} else {
1136+
policyManager.checkFileWrite(callerClass, new File(name));
1137+
}
1138+
}
1139+
1140+
@Override
1141+
public void check$java_io_RandomAccessFile$(Class<?> callerClass, File file, String mode) {
1142+
if (mode.equals("r")) {
1143+
policyManager.checkFileRead(callerClass, file);
1144+
} else {
1145+
policyManager.checkFileWrite(callerClass, file);
1146+
}
1147+
}
1148+
10401149
@Override
10411150
public void check$java_util_Scanner$(Class<?> callerClass, File source) {
10421151
policyManager.checkFileRead(callerClass, source);

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,14 @@ public void checkFileWrite(Class<?> callerClass, Path path) {
294294
}
295295
}
296296

297+
public void checkFileDescriptorRead(Class<?> callerClass) {
298+
neverEntitled(callerClass, () -> "read file descriptor");
299+
}
300+
301+
public void checkFileDescriptorWrite(Class<?> callerClass) {
302+
neverEntitled(callerClass, () -> "write file descriptor");
303+
}
304+
297305
/**
298306
* Check for operations that can access sensitive network information, e.g. secrets, tokens or SSL sessions
299307
*/

0 commit comments

Comments
 (0)