Skip to content

Commit 920caea

Browse files
ldematteldematte
committed
Adjustments + IT tests
1 parent 59411c8 commit 920caea

File tree

8 files changed

+260
-10
lines changed

8 files changed

+260
-10
lines changed

‎distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/SystemJvmOptions.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ private static Stream<String> maybeAttachEntitlementAgent(boolean useEntitlement
180180
}
181181
// We instrument classes in these modules to call the bridge. Because the bridge gets patched
182182
// into java.base, we must export the bridge from java.base to these modules, as a comma-separated list
183-
String modulesContainingEntitlementInstrumentation = "java.logging,java.net.http,java.naming";
183+
String modulesContainingEntitlementInstrumentation = "java.logging,java.net.http,java.naming,jdk.net";
184184
return Stream.of(
185185
"-Des.entitlements.enabled=true",
186186
"-XX:+EnableDynamicAgentLoading",

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -608,6 +608,7 @@ public interface EntitlementChecker {
608608
Class<?> callerClass,
609609
Path path,
610610
Set<? extends OpenOption> options,
611+
ExecutorService executor,
611612
FileAttribute<?>... attrs
612613
);
613614

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/module-info.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,5 @@
1616
// Modules we'll attempt to use in order to exercise entitlements
1717
requires java.logging;
1818
requires java.net.http;
19+
requires jdk.net;
1920
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/DummyImplementations.java‎

Lines changed: 153 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,9 @@
2424
import java.net.SocketException;
2525
import java.net.SocketImpl;
2626
import java.net.URI;
27-
import java.nio.channels.AsynchronousChannelGroup;
28-
import java.nio.channels.AsynchronousServerSocketChannel;
29-
import java.nio.channels.AsynchronousSocketChannel;
30-
import java.nio.channels.DatagramChannel;
31-
import java.nio.channels.Pipe;
32-
import java.nio.channels.SeekableByteChannel;
33-
import java.nio.channels.ServerSocketChannel;
34-
import java.nio.channels.SocketChannel;
27+
import java.nio.ByteBuffer;
28+
import java.nio.MappedByteBuffer;
29+
import java.nio.channels.*;
3530
import java.nio.channels.spi.AbstractSelector;
3631
import java.nio.channels.spi.AsynchronousChannelProvider;
3732
import java.nio.channels.spi.SelectorProvider;
@@ -67,6 +62,7 @@
6762
import java.util.Map;
6863
import java.util.Set;
6964
import java.util.concurrent.ExecutorService;
65+
import java.util.concurrent.Future;
7066
import java.util.concurrent.ThreadFactory;
7167
import java.util.spi.CalendarDataProvider;
7268
import java.util.spi.CalendarNameProvider;
@@ -676,4 +672,153 @@ public void setAttribute(Path path, String attribute, Object value, LinkOption..
676672

677673
}
678674
}
675+
676+
static class DummyFileChannel extends FileChannel {
677+
@Override
678+
protected void implCloseChannel() throws IOException {
679+
680+
}
681+
682+
@Override
683+
public int read(ByteBuffer dst) throws IOException {
684+
return 0;
685+
}
686+
687+
@Override
688+
public long read(ByteBuffer[] dsts, int offset, int length) throws IOException {
689+
return 0;
690+
}
691+
692+
@Override
693+
public int write(ByteBuffer src) throws IOException {
694+
return 0;
695+
}
696+
697+
@Override
698+
public long write(ByteBuffer[] srcs, int offset, int length) throws IOException {
699+
return 0;
700+
}
701+
702+
@Override
703+
public long position() throws IOException {
704+
return 0;
705+
}
706+
707+
@Override
708+
public FileChannel position(long newPosition) throws IOException {
709+
return null;
710+
}
711+
712+
@Override
713+
public long size() throws IOException {
714+
return 0;
715+
}
716+
717+
@Override
718+
public FileChannel truncate(long size) throws IOException {
719+
return null;
720+
}
721+
722+
@Override
723+
public void force(boolean metaData) throws IOException {
724+
725+
}
726+
727+
@Override
728+
public long transferTo(long position, long count, WritableByteChannel target) throws IOException {
729+
return 0;
730+
}
731+
732+
@Override
733+
public long transferFrom(ReadableByteChannel src, long position, long count) throws IOException {
734+
return 0;
735+
}
736+
737+
@Override
738+
public int read(ByteBuffer dst, long position) throws IOException {
739+
return 0;
740+
}
741+
742+
@Override
743+
public int write(ByteBuffer src, long position) throws IOException {
744+
return 0;
745+
}
746+
747+
@Override
748+
public MappedByteBuffer map(MapMode mode, long position, long size) throws IOException {
749+
return null;
750+
}
751+
752+
@Override
753+
public FileLock lock(long position, long size, boolean shared) throws IOException {
754+
return null;
755+
}
756+
757+
@Override
758+
public FileLock tryLock(long position, long size, boolean shared) throws IOException {
759+
return null;
760+
}
761+
}
762+
763+
static class DummyAsynchronousFileChannel extends AsynchronousFileChannel {
764+
@Override
765+
public boolean isOpen() {
766+
return false;
767+
}
768+
769+
@Override
770+
public void close() throws IOException {
771+
772+
}
773+
774+
@Override
775+
public long size() throws IOException {
776+
return 0;
777+
}
778+
779+
@Override
780+
public AsynchronousFileChannel truncate(long size) throws IOException {
781+
return null;
782+
}
783+
784+
@Override
785+
public void force(boolean metaData) throws IOException {
786+
787+
}
788+
789+
@Override
790+
public <A> void lock(long position, long size, boolean shared, A attachment, CompletionHandler<FileLock, ? super A> handler) {
791+
792+
}
793+
794+
@Override
795+
public Future<FileLock> lock(long position, long size, boolean shared) {
796+
return null;
797+
}
798+
799+
@Override
800+
public FileLock tryLock(long position, long size, boolean shared) throws IOException {
801+
return null;
802+
}
803+
804+
@Override
805+
public <A> void read(ByteBuffer dst, long position, A attachment, CompletionHandler<Integer, ? super A> handler) {
806+
807+
}
808+
809+
@Override
810+
public Future<Integer> read(ByteBuffer dst, long position) {
811+
return null;
812+
}
813+
814+
@Override
815+
public <A> void write(ByteBuffer src, long position, A attachment, CompletionHandler<Integer, ? super A> handler) {
816+
817+
}
818+
819+
@Override
820+
public Future<Integer> write(ByteBuffer src, long position) {
821+
return null;
822+
}
823+
}
679824
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/NioChannelsActions.java‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.qa.test;
11+
12+
import jdk.nio.Channels;
13+
14+
import org.elasticsearch.common.util.concurrent.EsExecutors;
15+
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
16+
17+
import java.io.FileDescriptor;
18+
import java.io.IOException;
19+
import java.nio.channels.AsynchronousFileChannel;
20+
import java.nio.channels.FileChannel;
21+
import java.nio.channels.SelectableChannel;
22+
import java.nio.file.StandardOpenOption;
23+
import java.util.Set;
24+
25+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;
26+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
27+
28+
class NioChannelsActions {
29+
30+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
31+
static void createFileChannel() throws IOException {
32+
new DummyImplementations.DummyFileChannel().close();
33+
}
34+
35+
@EntitlementTest(expectedAccess = PLUGINS)
36+
static void fileChannelOpenForWrite() throws IOException {
37+
FileChannel.open(FileCheckActions.readWriteFile(), StandardOpenOption.WRITE).close();
38+
}
39+
40+
@EntitlementTest(expectedAccess = PLUGINS)
41+
static void fileChannelOpenForRead() throws IOException {
42+
FileChannel.open(FileCheckActions.readFile()).close();
43+
}
44+
45+
@EntitlementTest(expectedAccess = PLUGINS)
46+
static void fileChannelOpenForWriteWithOptions() throws IOException {
47+
FileChannel.open(FileCheckActions.readWriteFile(), Set.of(StandardOpenOption.WRITE)).close();
48+
}
49+
50+
@EntitlementTest(expectedAccess = PLUGINS)
51+
static void fileChannelOpenForReadWithOptions() throws IOException {
52+
FileChannel.open(FileCheckActions.readFile(), Set.of(StandardOpenOption.READ)).close();
53+
}
54+
55+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
56+
static void createAsynchronousFileChannel() throws IOException {
57+
new DummyImplementations.DummyAsynchronousFileChannel().close();
58+
}
59+
60+
@EntitlementTest(expectedAccess = PLUGINS)
61+
static void asynchronousFileChannelOpenForWrite() throws IOException {
62+
var file = EntitledActions.createTempFileForWrite();
63+
AsynchronousFileChannel.open(file, StandardOpenOption.WRITE).close();
64+
}
65+
66+
@EntitlementTest(expectedAccess = PLUGINS)
67+
static void asynchronousFileChannelOpenForRead() throws IOException {
68+
var file = EntitledActions.createTempFileForRead();
69+
AsynchronousFileChannel.open(file).close();
70+
}
71+
72+
@EntitlementTest(expectedAccess = PLUGINS)
73+
static void asynchronousFileChannelOpenForWriteWithOptions() throws IOException {
74+
var file = EntitledActions.createTempFileForWrite();
75+
AsynchronousFileChannel.open(file, Set.of(StandardOpenOption.WRITE), EsExecutors.DIRECT_EXECUTOR_SERVICE).close();
76+
}
77+
78+
@EntitlementTest(expectedAccess = PLUGINS)
79+
static void asynchronousFileChannelOpenForReadWithOptions() throws IOException {
80+
var file = EntitledActions.createTempFileForRead();
81+
AsynchronousFileChannel.open(file, Set.of(StandardOpenOption.READ), EsExecutors.DIRECT_EXECUTOR_SERVICE).close();
82+
}
83+
84+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
85+
static void channelsReadWriteSelectableChannel() throws IOException {
86+
87+
jdk.nio.Channels.readWriteSelectableChannel(new FileDescriptor(), new Channels.SelectableChannelCloser() {
88+
@Override
89+
public void implCloseChannel(SelectableChannel sc) throws IOException {}
90+
91+
@Override
92+
public void implReleaseChannel(SelectableChannel sc) throws IOException {}
93+
}).close();
94+
}
95+
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,7 @@ static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
189189
getTestEntries(FileStoreActions.class),
190190
getTestEntries(ManageThreadsActions.class),
191191
getTestEntries(NativeActions.class),
192+
getTestEntries(NioChannelsActions.class),
192193
getTestEntries(NioFileSystemActions.class),
193194
getTestEntries(PathActions.class),
194195
getTestEntries(SpiActions.class),

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,13 @@ private static PolicyManager createPolicyManager() {
141141
var serverPolicy = new Policy(
142142
"server",
143143
List.of(
144-
new Scope("org.elasticsearch.base", List.of(new CreateClassLoaderEntitlement())),
144+
new Scope(
145+
"org.elasticsearch.base",
146+
List.of(
147+
new CreateClassLoaderEntitlement(),
148+
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
149+
)
150+
),
145151
new Scope("org.elasticsearch.xcontent", List.of(new CreateClassLoaderEntitlement())),
146152
new Scope(
147153
"org.elasticsearch.server",

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1182,6 +1182,7 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
11821182
Class<?> callerClass,
11831183
Path path,
11841184
Set<? extends OpenOption> options,
1185+
ExecutorService executor,
11851186
FileAttribute<?>... attrs
11861187
) {
11871188
if (isOpenForWrite(options)) {

0 commit comments

Comments
 (0)