More missing policies

Author: ldematte

libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java

@@ -150,7 +150,12 @@ private static PolicyManager createPolicyManager() {
                 "org.elasticsearch.base",
                 List.of(
                     new CreateClassLoaderEntitlement(),
-                    new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
+                    new FilesEntitlement(
+                        List.of(
+                            FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE),
+                            FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)
+                        )
+                    )
                 )
             ),
             new Scope("org.elasticsearch.xcontent", List.of(new CreateClassLoaderEntitlement())),
@@ -165,34 +170,32 @@ private static PolicyManager createPolicyManager() {
                     new LoadNativeLibrariesEntitlement(),
                     new ManageThreadsEntitlement(),
                     new FilesEntitlement(
-                        Stream.concat(
-                            Stream.of(
-                                // Base ES directories
-                                FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
-                                FileData.ofPath(bootstrapArgs.configDir(), READ),
-                                FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
-                                FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE),
-
-                                // OS release on Linux
-                                FileData.ofPath(Path.of("/etc/os-release"), READ),
-                                FileData.ofPath(Path.of("/etc/system-release"), READ),
-                                FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
-                                // read max virtual memory areas
-                                FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
-                                FileData.ofPath(Path.of("/proc/meminfo"), READ),
-                                // load averages on Linux
-                                FileData.ofPath(Path.of("/proc/loadavg"), READ),
-                                // control group stats on Linux. cgroup v2 stats are in an unpredicable
-                                // location under `/sys/fs/cgroup`, so unfortunately we have to allow
-                                // read access to the entire directory hierarchy.
-                                FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
-                                FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
-                                // // io stats on Linux
-                                FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
-                                FileData.ofPath(Path.of("/proc/diskstats"), READ)
-                            ),
-                            getRepositoryFileData(bootstrapArgs)
-                        ).toList()
+                        List.of(
+                            // Base ES directories
+                            FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
+                            FileData.ofPath(bootstrapArgs.configDir(), READ),
+                            FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
+                            FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE),
+                            FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE),
+
+                            // OS release on Linux
+                            FileData.ofPath(Path.of("/etc/os-release"), READ),
+                            FileData.ofPath(Path.of("/etc/system-release"), READ),
+                            FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
+                            // read max virtual memory areas
+                            FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
+                            FileData.ofPath(Path.of("/proc/meminfo"), READ),
+                            // load averages on Linux
+                            FileData.ofPath(Path.of("/proc/loadavg"), READ),
+                            // control group stats on Linux. cgroup v2 stats are in an unpredicable
+                            // location under `/sys/fs/cgroup`, so unfortunately we have to allow
+                            // read access to the entire directory hierarchy.
+                            FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
+                            FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
+                            // // io stats on Linux
+                            FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
+                            FileData.ofPath(Path.of("/proc/diskstats"), READ)
+                        )
                     )
                 )
             ),
@@ -250,10 +253,6 @@ private static PolicyManager createPolicyManager() {
         );
     }
 
-    private static Stream<FileData> getRepositoryFileData(EntitlementBootstrap.BootstrapArgs bootstrapArgs) {
-        return Stream.of(FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE));
-    }
-
     private static Path getUserHome() {
         String userHome = System.getProperty("user.home");
         if (userHome == null) {

modules/analysis-common/src/main/plugin-metadata/entitlement-policy.yaml

@@ -0,0 +1,5 @@
+org.elasticsearch.analysis.common:
+  - files:
+      - relative_path: analysis
+        relative_to: config
+        mode: read

modules/reindex/src/main/plugin-metadata/entitlement-policy.yaml

@@ -1,3 +1,7 @@
 ALL-UNNAMED:
   - manage_threads
   - outbound_network
+  - files:
+      - relative_path: ""
+        relative_to: config
+        mode: read

plugins/analysis-icu/src/main/plugin-metadata/entitlement-policy.yaml

@@ -0,0 +1,5 @@
+org.elasticsearch.analysis.icu:
+  - files:
+      - relative_path: ""
+        relative_to: config
+        mode: read

x-pack/plugin/searchable-snapshots/src/main/plugin-metadata/entitlement-policy.yaml

@@ -3,3 +3,6 @@ org.elasticsearch.searchablesnapshots:
       - relative_path: snapshot_cache
         relative_to: data
         mode: read_write
+      - relative_path: indices
+        relative_to: data
+        mode: read_write