Skip to content

Commit 9497aa6

Browse files
salvatore-campagnasalvatore-campagna
authored
Merge branch 'main' into feature/date-field-mapper-skipper-benchmark
2 parents 07d621d + 12fcdd8 commit 9497aa6

File tree

68 files changed

+8415
-7805
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+8415
-7805
lines changed

‎build-conventions/src/main/java/org/elasticsearch/gradle/internal/conventions/EclipseConventionPlugin.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import org.gradle.api.Plugin;
1616
import org.gradle.api.Project;
1717
import org.gradle.api.Transformer;
18+
import org.gradle.api.invocation.Gradle;
1819
import org.gradle.api.plugins.JavaBasePlugin;
1920
import org.gradle.api.plugins.JavaPluginExtension;
2021
import org.gradle.api.tasks.Copy;
@@ -38,6 +39,15 @@ public class EclipseConventionPlugin implements Plugin<Project> {
3839
@Override
3940
public void apply(Project project) {
4041
project.getPlugins().apply(EclipsePlugin.class);
42+
Gradle gradle = project.getGradle();
43+
44+
boolean isEclipse = project.getProviders().systemProperty("eclipse.launcher").isPresent() || // Gradle launched from Eclipse
45+
project.getProviders().systemProperty("eclipse.application").isPresent() || // Gradle launched from the Eclipse compiler server
46+
gradle.getStartParameter().getTaskNames().contains("eclipse") || // Gradle launched from the command line to do eclipse stuff
47+
gradle.getStartParameter().getTaskNames().contains("cleanEclipse");
48+
// for eclipse ide specific hacks...
49+
project.getExtensions().add("isEclipse", isEclipse);
50+
4151
EclipseModel eclipseModel = project.getExtensions().getByType(EclipseModel.class);
4252
EclipseProject eclipseProject = eclipseModel.getProject();
4353

‎build.gradle‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -247,15 +247,6 @@ allprojects {
247247
}
248248
}
249249

250-
// injecting groovy property variables into all projects
251-
project.ext {
252-
// for ide hacks...
253-
isEclipse = providers.systemProperty("eclipse.launcher").isPresent() || // Detects gradle launched from Eclipse's IDE
254-
providers.systemProperty("eclipse.application").isPresent() || // Detects gradle launched from the Eclipse compiler server
255-
gradle.startParameter.taskNames.contains('eclipse') || // Detects gradle launched from the command line to do eclipse stuff
256-
gradle.startParameter.taskNames.contains('cleanEclipse')
257-
}
258-
259250
ext.bwc_tests_enabled = bwc_tests_enabled
260251

261252
// eclipse configuration

‎docs/changelog/122860.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 122860
2+
summary: Improved error message when index field type is invalid
3+
area: Mapping
4+
type: enhancement
5+
issues: []

‎docs/changelog/123079.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 123079
2+
summary: Register `IngestGeoIpMetadata` as a NamedXContent
3+
area: Ingest Node
4+
type: bug
5+
issues: []

‎docs/changelog/123272.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 123272
2+
summary: Set Connect Timeout to 5s
3+
area: Machine Learning
4+
type: bug
5+
issues: []

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/EntitlementBootstrap.java‎

Lines changed: 12 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,13 @@
1414
import com.sun.tools.attach.AttachNotSupportedException;
1515
import com.sun.tools.attach.VirtualMachine;
1616

17-
import org.elasticsearch.core.CheckedConsumer;
1817
import org.elasticsearch.core.SuppressForbidden;
1918
import org.elasticsearch.entitlement.initialization.EntitlementInitialization;
20-
import org.elasticsearch.entitlement.runtime.api.NotEntitledException;
2119
import org.elasticsearch.entitlement.runtime.policy.Policy;
2220
import org.elasticsearch.logging.LogManager;
2321
import org.elasticsearch.logging.Logger;
2422

2523
import java.io.IOException;
26-
import java.lang.reflect.InvocationTargetException;
2724
import java.nio.file.Files;
2825
import java.nio.file.Path;
2926
import java.util.Map;
@@ -39,23 +36,24 @@ public record BootstrapArgs(
3936
Function<Class<?>, String> pluginResolver,
4037
Function<String, String> settingResolver,
4138
Function<String, Stream<String>> settingGlobResolver,
42-
Function<String, Path> repoDirResolver,
4339
Path[] dataDirs,
40+
Path[] sharedRepoDirs,
4441
Path configDir,
4542
Path libDir,
4643
Path logsDir,
47-
Path tempDir
44+
Path tempDir,
45+
Path pidFile
4846
) {
4947
public BootstrapArgs {
5048
requireNonNull(pluginPolicies);
5149
requireNonNull(pluginResolver);
5250
requireNonNull(settingResolver);
5351
requireNonNull(settingGlobResolver);
54-
requireNonNull(repoDirResolver);
5552
requireNonNull(dataDirs);
5653
if (dataDirs.length == 0) {
5754
throw new IllegalArgumentException("must provide at least one data directory");
5855
}
56+
requireNonNull(sharedRepoDirs);
5957
requireNonNull(configDir);
6058
requireNonNull(libDir);
6159
requireNonNull(logsDir);
@@ -77,24 +75,26 @@ public static BootstrapArgs bootstrapArgs() {
7775
* @param pluginResolver a functor to map a Java Class to the plugin it belongs to (the plugin name).
7876
* @param settingResolver a functor to resolve the value of an Elasticsearch setting.
7977
* @param settingGlobResolver a functor to resolve a glob expression for one or more Elasticsearch settings.
80-
* @param repoDirResolver a functor to map a repository location to its Elasticsearch path.
8178
* @param dataDirs data directories for Elasticsearch
79+
* @param sharedRepoDirs shared repository directories for Elasticsearch
8280
* @param configDir the config directory for Elasticsearch
8381
* @param libDir the lib directory for Elasticsearch
8482
* @param tempDir the temp directory for Elasticsearch
8583
* @param logsDir the log directory for Elasticsearch
84+
* @param pidFile path to a pid file for Elasticsearch, or {@code null} if one was not specified
8685
*/
8786
public static void bootstrap(
8887
Map<String, Policy> pluginPolicies,
8988
Function<Class<?>, String> pluginResolver,
9089
Function<String, String> settingResolver,
9190
Function<String, Stream<String>> settingGlobResolver,
92-
Function<String, Path> repoDirResolver,
9391
Path[] dataDirs,
92+
Path[] sharedRepoDirs,
9493
Path configDir,
9594
Path libDir,
9695
Path logsDir,
97-
Path tempDir
96+
Path tempDir,
97+
Path pidFile
9898
) {
9999
logger.debug("Loading entitlement agent");
100100
if (EntitlementBootstrap.bootstrapArgs != null) {
@@ -105,16 +105,16 @@ public static void bootstrap(
105105
pluginResolver,
106106
settingResolver,
107107
settingGlobResolver,
108-
repoDirResolver,
109108
dataDirs,
109+
sharedRepoDirs,
110110
configDir,
111111
libDir,
112112
logsDir,
113-
tempDir
113+
tempDir,
114+
pidFile
114115
);
115116
exportInitializationToAgent();
116117
loadAgent(findAgentJar());
117-
selfTest();
118118
}
119119

120120
@SuppressForbidden(reason = "The VirtualMachine API is the only way to attach a java agent dynamically")
@@ -160,50 +160,5 @@ private static String findAgentJar() {
160160
}
161161
}
162162

163-
/**
164-
* Attempt a few sensitive operations to ensure that some are permitted and some are forbidden.
165-
* <p>
166-
*
167-
* This serves two purposes:
168-
*
169-
* <ol>
170-
* <li>
171-
* a smoke test to make sure the entitlements system is not completely broken, and
172-
* </li>
173-
* <li>
174-
* an early test of certain important operations so they don't fail later on at an awkward time.
175-
* </li>
176-
* </ol>
177-
*
178-
* @throws IllegalStateException if the entitlements system can't prevent an unauthorized action of our choosing
179-
*/
180-
private static void selfTest() {
181-
ensureCannotStartProcess(ProcessBuilder::start);
182-
// Try again with reflection
183-
ensureCannotStartProcess(EntitlementBootstrap::reflectiveStartProcess);
184-
}
185-
186-
private static void ensureCannotStartProcess(CheckedConsumer<ProcessBuilder, ?> startProcess) {
187-
try {
188-
// The command doesn't matter; it doesn't even need to exist
189-
startProcess.accept(new ProcessBuilder(""));
190-
} catch (NotEntitledException e) {
191-
logger.debug("Success: Entitlement protection correctly prevented process creation");
192-
return;
193-
} catch (Exception e) {
194-
throw new IllegalStateException("Failed entitlement protection self-test", e);
195-
}
196-
throw new IllegalStateException("Entitlement protection self-test was incorrectly permitted");
197-
}
198-
199-
private static void reflectiveStartProcess(ProcessBuilder pb) throws Exception {
200-
try {
201-
var start = ProcessBuilder.class.getMethod("start");
202-
start.invoke(pb);
203-
} catch (InvocationTargetException e) {
204-
throw (Exception) e.getCause();
205-
}
206-
}
207-
208163
private static final Logger logger = LogManager.getLogger(EntitlementBootstrap.class);
209164
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 43 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,11 @@
6363
import java.util.stream.Stream;
6464
import java.util.stream.StreamSupport;
6565

66+
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.BaseDir.DATA;
67+
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.BaseDir.SHARED_REPO;
6668
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ;
6769
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ_WRITE;
70+
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Platform.LINUX;
6871

6972
/**
7073
* Called by the agent during {@code agentmain} to configure the entitlement system,
@@ -138,12 +141,43 @@ private static PolicyManager createPolicyManager() {
138141
getUserHome(),
139142
bootstrapArgs.configDir(),
140143
bootstrapArgs.dataDirs(),
144+
bootstrapArgs.sharedRepoDirs(),
141145
bootstrapArgs.tempDir(),
142146
bootstrapArgs.settingResolver(),
143147
bootstrapArgs.settingGlobResolver()
144148
);
145149

146150
List<Scope> serverScopes = new ArrayList<>();
151+
List<FileData> serverModuleFileDatas = new ArrayList<>();
152+
Collections.addAll(
153+
serverModuleFileDatas,
154+
// Base ES directories
155+
FileData.ofPath(bootstrapArgs.configDir(), READ),
156+
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
157+
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE),
158+
FileData.ofRelativePath(Path.of(""), SHARED_REPO, READ_WRITE),
159+
160+
// OS release on Linux
161+
FileData.ofPath(Path.of("/etc/os-release"), READ).withPlatform(LINUX),
162+
FileData.ofPath(Path.of("/etc/system-release"), READ).withPlatform(LINUX),
163+
FileData.ofPath(Path.of("/usr/lib/os-release"), READ).withPlatform(LINUX),
164+
// read max virtual memory areas
165+
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ).withPlatform(LINUX),
166+
FileData.ofPath(Path.of("/proc/meminfo"), READ).withPlatform(LINUX),
167+
// load averages on Linux
168+
FileData.ofPath(Path.of("/proc/loadavg"), READ).withPlatform(LINUX),
169+
// control group stats on Linux. cgroup v2 stats are in an unpredicable
170+
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
171+
// read access to the entire directory hierarchy.
172+
FileData.ofPath(Path.of("/proc/self/cgroup"), READ).withPlatform(LINUX),
173+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ).withPlatform(LINUX),
174+
// // io stats on Linux
175+
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ).withPlatform(LINUX),
176+
FileData.ofPath(Path.of("/proc/diskstats"), READ).withPlatform(LINUX)
177+
);
178+
if (bootstrapArgs.pidFile() != null) {
179+
serverModuleFileDatas.add(FileData.ofPath(bootstrapArgs.pidFile(), READ_WRITE));
180+
}
147181
Collections.addAll(
148182
serverScopes,
149183
new Scope(
@@ -152,8 +186,8 @@ private static PolicyManager createPolicyManager() {
152186
new CreateClassLoaderEntitlement(),
153187
new FilesEntitlement(
154188
List.of(
155-
FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE),
156-
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)
189+
FileData.ofRelativePath(Path.of(""), SHARED_REPO, READ_WRITE),
190+
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE)
157191
)
158192
)
159193
)
@@ -169,34 +203,7 @@ private static PolicyManager createPolicyManager() {
169203
new OutboundNetworkEntitlement(),
170204
new LoadNativeLibrariesEntitlement(),
171205
new ManageThreadsEntitlement(),
172-
new FilesEntitlement(
173-
List.of(
174-
// Base ES directories
175-
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
176-
FileData.ofPath(bootstrapArgs.configDir(), READ),
177-
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
178-
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE),
179-
FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE),
180-
181-
// OS release on Linux
182-
FileData.ofPath(Path.of("/etc/os-release"), READ),
183-
FileData.ofPath(Path.of("/etc/system-release"), READ),
184-
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
185-
// read max virtual memory areas
186-
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
187-
FileData.ofPath(Path.of("/proc/meminfo"), READ),
188-
// load averages on Linux
189-
FileData.ofPath(Path.of("/proc/loadavg"), READ),
190-
// control group stats on Linux. cgroup v2 stats are in an unpredicable
191-
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
192-
// read access to the entire directory hierarchy.
193-
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
194-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
195-
// // io stats on Linux
196-
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
197-
FileData.ofPath(Path.of("/proc/diskstats"), READ)
198-
)
199-
)
206+
new FilesEntitlement(serverModuleFileDatas)
200207
)
201208
),
202209
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
@@ -207,24 +214,20 @@ private static PolicyManager createPolicyManager() {
207214
new LoadNativeLibrariesEntitlement(),
208215
new ManageThreadsEntitlement(),
209216
new FilesEntitlement(
210-
List.of(
211-
FileData.ofPath(bootstrapArgs.configDir(), READ),
212-
FileData.ofPath(bootstrapArgs.tempDir(), READ),
213-
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)
214-
)
217+
List.of(FileData.ofPath(bootstrapArgs.configDir(), READ), FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE))
215218
)
216219
)
217220
),
218221
new Scope(
219222
"org.apache.lucene.misc",
220-
List.of(new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE))))
223+
List.of(new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE))))
221224
),
222225
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
223226
new Scope(
224227
"org.elasticsearch.nativeaccess",
225228
List.of(
226229
new LoadNativeLibrariesEntitlement(),
227-
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
230+
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE)))
228231
)
229232
)
230233
);
@@ -252,7 +255,9 @@ private static PolicyManager createPolicyManager() {
252255
new FilesEntitlement(
253256
List.of(
254257
FileData.ofPath(Path.of("/co/elastic/apm/agent/"), READ),
255-
FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ)
258+
FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ),
259+
FileData.ofPath(Path.of("/proc/meminfo"), READ),
260+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ)
256261
)
257262
)
258263
);

0 commit comments

Comments
 (0)