Skip to content

Commit 83f2148

Browse files
n1v0lgn1v0lg
committed
Merge branch 'main' into read-failure-store-privilege-role-building
2 parents 0c848e4 + a1b16d9 commit 83f2148

File tree

67 files changed

+514
-396
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+514
-396
lines changed

‎.buildkite/pipelines/intake.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ steps:
7676
ES_VERSION:
7777
- "9.0.0"
7878
ES_COMMIT:
79-
- "b2cc9d9b8f00ee621f93ddca07ea9c671aab1578" # update to match last commit before lucene bump
79+
- "10352e57d85505984582616e1e38530d3ec6ca59" # update to match last commit before lucene bump / head of combat-lucene-10-0-0
8080
agents:
8181
provider: gcp
8282
image: family/elasticsearch-ubuntu-2004

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99

1010
package org.elasticsearch.entitlement.initialization;
1111

12+
import org.elasticsearch.core.PathUtils;
1213
import org.elasticsearch.core.internal.provider.ProviderLocator;
1314
import org.elasticsearch.entitlement.bootstrap.EntitlementBootstrap;
1415
import org.elasticsearch.entitlement.bridge.EntitlementChecker;
@@ -133,7 +134,7 @@ private static Class<?>[] findClassesToRetransform(Class<?>[] loadedClasses, Set
133134
private static PolicyManager createPolicyManager() {
134135
EntitlementBootstrap.BootstrapArgs bootstrapArgs = EntitlementBootstrap.bootstrapArgs();
135136
Map<String, Policy> pluginPolicies = bootstrapArgs.pluginPolicies();
136-
var pathLookup = new PathLookup(bootstrapArgs.configDir(), bootstrapArgs.dataDirs(), bootstrapArgs.tempDir());
137+
var pathLookup = new PathLookup(getUserHome(), bootstrapArgs.configDir(), bootstrapArgs.dataDirs(), bootstrapArgs.tempDir());
137138
Path logsDir = EntitlementBootstrap.bootstrapArgs().logsDir();
138139

139140
// TODO(ES-10031): Decide what goes in the elasticsearch default policy and extend it
@@ -221,6 +222,14 @@ private static PolicyManager createPolicyManager() {
221222
);
222223
}
223224

225+
private static Path getUserHome() {
226+
String userHome = System.getProperty("user.home");
227+
if (userHome == null) {
228+
throw new IllegalStateException("user.home system property is required");
229+
}
230+
return PathUtils.get(userHome);
231+
}
232+
224233
private static Stream<InstrumentationService.InstrumentationInfo> fileSystemProviderChecks() throws ClassNotFoundException,
225234
NoSuchMethodException {
226235
var fileSystemProviderClass = FileSystems.getDefault().provider().getClass();

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PathLookup.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,4 @@
1111

1212
import java.nio.file.Path;
1313

14-
public record PathLookup(Path configDir, Path[] dataDirs, Path tempDir) {}
14+
public record PathLookup(Path homeDir, Path configDir, Path[] dataDirs, Path tempDir) {}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@ public enum Mode {
3636

3737
public enum BaseDir {
3838
CONFIG,
39-
DATA
39+
DATA,
40+
HOME
4041
}
4142

4243
public sealed interface FileData {
@@ -46,12 +47,10 @@ public sealed interface FileData {
4647
Mode mode();
4748

4849
static FileData ofPath(Path path, Mode mode) {
49-
assert path.isAbsolute();
5050
return new AbsolutePathFileData(path, mode);
5151
}
5252

5353
static FileData ofRelativePath(Path relativePath, BaseDir baseDir, Mode mode) {
54-
assert relativePath.isAbsolute() == false;
5554
return new RelativePathFileData(relativePath, baseDir, mode);
5655
}
5756
}
@@ -73,6 +72,8 @@ public Stream<Path> resolvePaths(PathLookup pathLookup) {
7372
return Stream.of(pathLookup.configDir().resolve(relativePath));
7473
case DATA:
7574
return Arrays.stream(pathLookup.dataDirs()).map(d -> d.resolve(relativePath));
75+
case HOME:
76+
return Stream.of(pathLookup.homeDir().resolve(relativePath));
7677
default:
7778
throw new IllegalArgumentException();
7879
}
@@ -90,12 +91,14 @@ private static Mode parseMode(String mode) {
9091
}
9192

9293
private static BaseDir parseBaseDir(String baseDir) {
93-
if (baseDir.equals("config")) {
94-
return BaseDir.CONFIG;
95-
} else if (baseDir.equals("data")) {
96-
return BaseDir.DATA;
97-
}
98-
throw new PolicyValidationException("invalid relative directory: " + baseDir + ", valid values: [config, data]");
94+
return switch (baseDir) {
95+
case "config" -> BaseDir.CONFIG;
96+
case "data" -> BaseDir.DATA;
97+
case "home" -> BaseDir.HOME;
98+
default -> throw new PolicyValidationException(
99+
"invalid relative directory: " + baseDir + ", valid values: [config, data, home]"
100+
);
101+
};
99102
}
100103

101104
@ExternalEntitlement(parameterNames = { "paths" }, esModulesOnly = false)

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTreeTests.java‎

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ private static Path path(String s) {
3636
}
3737

3838
private static final PathLookup TEST_PATH_LOOKUP = new PathLookup(
39+
Path.of("/home"),
3940
Path.of("/config"),
4041
new Path[] { Path.of("/data1"), Path.of("/data2") },
4142
Path.of("/tmp")
@@ -91,32 +92,36 @@ public void testReadWriteUnderRead() {
9192
}
9293

9394
public void testReadWithRelativePath() {
94-
var tree = accessTree(entitlement(Map.of("relative_path", "foo", "mode", "read", "relative_to", "config")));
95-
assertThat(tree.canRead(path("foo")), is(false));
95+
for (var dir : List.of("config", "home")) {
96+
var tree = accessTree(entitlement(Map.of("relative_path", "foo", "mode", "read", "relative_to", dir)));
97+
assertThat(tree.canRead(path("foo")), is(false));
9698

97-
assertThat(tree.canRead(path("/config/foo")), is(true));
99+
assertThat(tree.canRead(path("/" + dir + "/foo")), is(true));
98100

99-
assertThat(tree.canRead(path("/config/foo/subdir")), is(true));
100-
assertThat(tree.canRead(path("/config/food")), is(false));
101-
assertThat(tree.canWrite(path("/config/foo")), is(false));
101+
assertThat(tree.canRead(path("/" + dir + "/foo/subdir")), is(true));
102+
assertThat(tree.canRead(path("/" + dir + "/food")), is(false));
103+
assertThat(tree.canWrite(path("/" + dir + "/foo")), is(false));
102104

103-
assertThat(tree.canRead(path("/config")), is(false));
104-
assertThat(tree.canRead(path("/config/before")), is(false));
105-
assertThat(tree.canRead(path("/config/later")), is(false));
105+
assertThat(tree.canRead(path("/" + dir)), is(false));
106+
assertThat(tree.canRead(path("/" + dir + "/before")), is(false));
107+
assertThat(tree.canRead(path("/" + dir + "/later")), is(false));
108+
}
106109
}
107110

108111
public void testWriteWithRelativePath() {
109-
var tree = accessTree(entitlement(Map.of("relative_path", "foo", "mode", "read_write", "relative_to", "config")));
110-
assertThat(tree.canWrite(path("/config/foo")), is(true));
111-
assertThat(tree.canWrite(path("/config/foo/subdir")), is(true));
112-
assertThat(tree.canWrite(path("foo")), is(false));
113-
assertThat(tree.canWrite(path("/config/food")), is(false));
114-
assertThat(tree.canRead(path("/config/foo")), is(true));
115-
assertThat(tree.canRead(path("foo")), is(false));
116-
117-
assertThat(tree.canWrite(path("/config")), is(false));
118-
assertThat(tree.canWrite(path("/config/before")), is(false));
119-
assertThat(tree.canWrite(path("/config/later")), is(false));
112+
for (var dir : List.of("config", "home")) {
113+
var tree = accessTree(entitlement(Map.of("relative_path", "foo", "mode", "read_write", "relative_to", dir)));
114+
assertThat(tree.canWrite(path("/" + dir + "/foo")), is(true));
115+
assertThat(tree.canWrite(path("/" + dir + "/foo/subdir")), is(true));
116+
assertThat(tree.canWrite(path("/" + dir)), is(false));
117+
assertThat(tree.canWrite(path("/" + dir + "/food")), is(false));
118+
assertThat(tree.canRead(path("/" + dir + "/foo")), is(true));
119+
assertThat(tree.canRead(path("/" + dir)), is(false));
120+
121+
assertThat(tree.canWrite(path("/" + dir)), is(false));
122+
assertThat(tree.canWrite(path("/" + dir + "/before")), is(false));
123+
assertThat(tree.canWrite(path("/" + dir + "/later")), is(false));
124+
}
120125
}
121126

122127
public void testMultipleDataDirs() {
@@ -161,7 +166,7 @@ public void testTempDirAccess() {
161166
Path tempDir = createTempDir();
162167
var tree = FileAccessTree.of(
163168
FilesEntitlement.EMPTY,
164-
new PathLookup(Path.of("/config"), new Path[] { Path.of("/data1"), Path.of("/data2") }, tempDir)
169+
new PathLookup(Path.of("/home"), Path.of("/config"), new Path[] { Path.of("/data1"), Path.of("/data2") }, tempDir)
165170
);
166171
assertThat(tree.canRead(tempDir), is(true));
167172
assertThat(tree.canWrite(tempDir), is(true));

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/PolicyManagerTests.java‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -53,17 +53,23 @@ public class PolicyManagerTests extends ESTestCase {
5353
*/
5454
private static Module NO_ENTITLEMENTS_MODULE;
5555

56-
private static final PathLookup TEST_PATH_LOOKUP = new PathLookup(
57-
Path.of("/config"),
58-
new Path[] { Path.of("/data1/"), Path.of("/data2") },
59-
Path.of("/temp")
60-
);
56+
private static Path TEST_BASE_DIR;
57+
58+
private static PathLookup TEST_PATH_LOOKUP;
6159

6260
@BeforeClass
6361
public static void beforeClass() {
6462
try {
6563
// Any old module will do for tests using NO_ENTITLEMENTS_MODULE
6664
NO_ENTITLEMENTS_MODULE = makeClassInItsOwnModule().getModule();
65+
66+
TEST_BASE_DIR = createTempDir().toAbsolutePath();
67+
TEST_PATH_LOOKUP = new PathLookup(
68+
TEST_BASE_DIR.resolve("/user/home"),
69+
TEST_BASE_DIR.resolve("/config"),
70+
new Path[] { TEST_BASE_DIR.resolve("/data1/"), TEST_BASE_DIR.resolve("/data2") },
71+
TEST_BASE_DIR.resolve("/temp")
72+
);
6773
} catch (Exception e) {
6874
throw new IllegalStateException(e);
6975
}
@@ -228,8 +234,7 @@ public void testGetEntitlementsReturnsEntitlementsForPluginModule() throws IOExc
228234

229235
var entitlements = policyManager.getEntitlements(mockPluginClass);
230236
assertThat(entitlements.hasEntitlement(CreateClassLoaderEntitlement.class), is(true));
231-
// TODO: this can't work on Windows, we need to have the root be unknown
232-
// assertThat(entitlements.fileAccess().canRead("/test/path"), is(true));
237+
assertThat(entitlements.fileAccess().canRead(TEST_BASE_DIR), is(true));
233238
}
234239

235240
public void testGetEntitlementsResultIsCached() {
@@ -439,9 +444,7 @@ private static Policy createPluginPolicy(String... pluginModules) {
439444
name -> new Scope(
440445
name,
441446
List.of(
442-
new FilesEntitlement(
443-
List.of(FilesEntitlement.FileData.ofPath(Path.of("/test/path"), FilesEntitlement.Mode.READ))
444-
),
447+
new FilesEntitlement(List.of(FilesEntitlement.FileData.ofPath(TEST_BASE_DIR, FilesEntitlement.Mode.READ))),
445448
new CreateClassLoaderEntitlement()
446449
)
447450
)

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/PolicyParserFailureTests.java‎

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -64,35 +64,6 @@ public void testEntitlementMissingDependentParameter() {
6464
);
6565
}
6666

67-
public void testEntitlementRelativePathWhenAbsolute() {
68-
PolicyParserException ppe = expectThrows(PolicyParserException.class, () -> new PolicyParser(new ByteArrayInputStream("""
69-
entitlement-module-name:
70-
- files:
71-
- path: test-path
72-
mode: read
73-
""".getBytes(StandardCharsets.UTF_8)), "test-failure-policy.yaml", false).parsePolicy());
74-
assertEquals(
75-
"[2:5] policy parsing error for [test-failure-policy.yaml] in scope [entitlement-module-name] "
76-
+ "for entitlement type [files]: 'path' [test-path] must be absolute",
77-
ppe.getMessage()
78-
);
79-
}
80-
81-
public void testEntitlementAbsolutePathWhenRelative() {
82-
PolicyParserException ppe = expectThrows(PolicyParserException.class, () -> new PolicyParser(new ByteArrayInputStream("""
83-
entitlement-module-name:
84-
- files:
85-
- relative_path: /test-path
86-
relative_to: data
87-
mode: read
88-
""".getBytes(StandardCharsets.UTF_8)), "test-failure-policy.yaml", false).parsePolicy());
89-
assertEquals(
90-
"[2:5] policy parsing error for [test-failure-policy.yaml] in scope [entitlement-module-name] "
91-
+ "for entitlement type [files]: 'relative_path' [/test-path] must be relative",
92-
ppe.getMessage()
93-
);
94-
}
95-
9667
public void testEntitlementMutuallyExclusiveParameters() {
9768
PolicyParserException ppe = expectThrows(PolicyParserException.class, () -> new PolicyParser(new ByteArrayInputStream("""
9869
entitlement-module-name:

0 commit comments

Comments
 (0)