Skip to content

Commit b86d434

Browse files
jdconradjdconrad
committed
add withExclusive to FileData
1 parent a39b3a9 commit b86d434

File tree

4 files changed

+74
-56
lines changed

4 files changed

+74
-56
lines changed

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 26 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,8 @@ private static PolicyManager createPolicyManager() {
152152
new CreateClassLoaderEntitlement(),
153153
new FilesEntitlement(
154154
List.of(
155-
FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE, false),
156-
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false)
155+
FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE),
156+
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)
157157
)
158158
)
159159
)
@@ -172,29 +172,29 @@ private static PolicyManager createPolicyManager() {
172172
new FilesEntitlement(
173173
List.of(
174174
// Base ES directories
175-
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE, false),
176-
FileData.ofPath(bootstrapArgs.configDir(), READ, false),
177-
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE, false),
178-
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false),
179-
FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE, false),
175+
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
176+
FileData.ofPath(bootstrapArgs.configDir(), READ),
177+
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
178+
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE),
179+
FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE),
180180

181181
// OS release on Linux
182-
FileData.ofPath(Path.of("/etc/os-release"), READ, false),
183-
FileData.ofPath(Path.of("/etc/system-release"), READ, false),
184-
FileData.ofPath(Path.of("/usr/lib/os-release"), READ, false),
182+
FileData.ofPath(Path.of("/etc/os-release"), READ),
183+
FileData.ofPath(Path.of("/etc/system-release"), READ),
184+
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
185185
// read max virtual memory areas
186-
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ, false),
187-
FileData.ofPath(Path.of("/proc/meminfo"), READ, false),
186+
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
187+
FileData.ofPath(Path.of("/proc/meminfo"), READ),
188188
// load averages on Linux
189-
FileData.ofPath(Path.of("/proc/loadavg"), READ, false),
189+
FileData.ofPath(Path.of("/proc/loadavg"), READ),
190190
// control group stats on Linux. cgroup v2 stats are in an unpredicable
191191
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
192192
// read access to the entire directory hierarchy.
193-
FileData.ofPath(Path.of("/proc/self/cgroup"), READ, false),
194-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ, false),
193+
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
194+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
195195
// // io stats on Linux
196-
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ, false),
197-
FileData.ofPath(Path.of("/proc/diskstats"), READ, false)
196+
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
197+
FileData.ofPath(Path.of("/proc/diskstats"), READ)
198198
)
199199
)
200200
)
@@ -208,25 +208,23 @@ private static PolicyManager createPolicyManager() {
208208
new ManageThreadsEntitlement(),
209209
new FilesEntitlement(
210210
List.of(
211-
FileData.ofPath(bootstrapArgs.configDir(), READ, false),
212-
FileData.ofPath(bootstrapArgs.tempDir(), READ, false),
213-
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false)
211+
FileData.ofPath(bootstrapArgs.configDir(), READ),
212+
FileData.ofPath(bootstrapArgs.tempDir(), READ),
213+
FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)
214214
)
215215
)
216216
)
217217
),
218218
new Scope(
219219
"org.apache.lucene.misc",
220-
List.of(
221-
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false)))
222-
)
220+
List.of(new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE))))
223221
),
224222
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
225223
new Scope(
226224
"org.elasticsearch.nativeaccess",
227225
List.of(
228226
new LoadNativeLibrariesEntitlement(),
229-
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false)))
227+
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
230228
)
231229
)
232230
);
@@ -235,17 +233,11 @@ private static PolicyManager createPolicyManager() {
235233
if (trustStorePath != null) {
236234
Collections.addAll(
237235
serverScopes,
238-
new Scope(
239-
"org.bouncycastle.fips.tls",
240-
List.of(new FilesEntitlement(List.of(FileData.ofPath(trustStorePath, READ, false))))
241-
),
236+
new Scope("org.bouncycastle.fips.tls", List.of(new FilesEntitlement(List.of(FileData.ofPath(trustStorePath, READ))))),
242237
new Scope(
243238
"org.bouncycastle.fips.core",
244239
// read to lib dir is required for checksum validation
245-
List.of(
246-
new FilesEntitlement(List.of(FileData.ofPath(bootstrapArgs.libDir(), READ, false))),
247-
new ManageThreadsEntitlement()
248-
)
240+
List.of(new FilesEntitlement(List.of(FileData.ofPath(bootstrapArgs.libDir(), READ))), new ManageThreadsEntitlement())
249241
)
250242
);
251243
}
@@ -259,8 +251,8 @@ private static PolicyManager createPolicyManager() {
259251
new ManageThreadsEntitlement(),
260252
new FilesEntitlement(
261253
List.of(
262-
FileData.ofPath(Path.of("/co/elastic/apm/agent/"), READ, false),
263-
FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ, false)
254+
FileData.ofPath(Path.of("/co/elastic/apm/agent/"), READ),
255+
FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ)
264256
)
265257
)
266258
);

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java‎

Lines changed: 40 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -47,20 +47,22 @@ public sealed interface FileData {
4747

4848
boolean exclusive();
4949

50-
static FileData ofPath(Path path, Mode mode, boolean exclusive) {
51-
return new AbsolutePathFileData(path, mode, exclusive);
50+
FileData withExclusive();
51+
52+
static FileData ofPath(Path path, Mode mode) {
53+
return new AbsolutePathFileData(path, mode, false);
5254
}
5355

54-
static FileData ofRelativePath(Path relativePath, BaseDir baseDir, Mode mode, boolean exclusive) {
55-
return new RelativePathFileData(relativePath, baseDir, mode, exclusive);
56+
static FileData ofRelativePath(Path relativePath, BaseDir baseDir, Mode mode) {
57+
return new RelativePathFileData(relativePath, baseDir, mode, false);
5658
}
5759

58-
static FileData ofPathSetting(String setting, Mode mode, boolean exclusive) {
59-
return new PathSettingFileData(setting, mode, exclusive);
60+
static FileData ofPathSetting(String setting, Mode mode) {
61+
return new PathSettingFileData(setting, mode, false);
6062
}
6163

62-
static FileData ofRelativePathSetting(String setting, BaseDir baseDir, Mode mode, boolean exclusive) {
63-
return new RelativePathSettingFileData(setting, baseDir, mode, exclusive);
64+
static FileData ofRelativePathSetting(String setting, BaseDir baseDir, Mode mode) {
65+
return new RelativePathSettingFileData(setting, baseDir, mode, false);
6466
}
6567
}
6668

@@ -94,6 +96,12 @@ default Stream<Path> resolvePaths(PathLookup pathLookup) {
9496
}
9597

9698
private record AbsolutePathFileData(Path path, Mode mode, boolean exclusive) implements FileData {
99+
100+
@Override
101+
public AbsolutePathFileData withExclusive() {
102+
return new AbsolutePathFileData(path, mode, true);
103+
}
104+
97105
@Override
98106
public Stream<Path> resolvePaths(PathLookup pathLookup) {
99107
return Stream.of(path);
@@ -104,13 +112,25 @@ private record RelativePathFileData(Path relativePath, BaseDir baseDir, Mode mod
104112
implements
105113
FileData,
106114
RelativeFileData {
115+
116+
@Override
117+
public RelativePathFileData withExclusive() {
118+
return new RelativePathFileData(relativePath, baseDir, mode, true);
119+
}
120+
107121
@Override
108122
public Stream<Path> resolveRelativePaths(PathLookup pathLookup) {
109123
return Stream.of(relativePath);
110124
}
111125
}
112126

113127
private record PathSettingFileData(String setting, Mode mode, boolean exclusive) implements FileData {
128+
129+
@Override
130+
public PathSettingFileData withExclusive() {
131+
return new PathSettingFileData(setting, mode, true);
132+
}
133+
114134
@Override
115135
public Stream<Path> resolvePaths(PathLookup pathLookup) {
116136
return resolvePathSettings(pathLookup, setting);
@@ -121,6 +141,12 @@ private record RelativePathSettingFileData(String setting, BaseDir baseDir, Mode
121141
implements
122142
FileData,
123143
RelativeFileData {
144+
145+
@Override
146+
public RelativePathSettingFileData withExclusive() {
147+
return new RelativePathSettingFileData(setting, baseDir, mode, true);
148+
}
149+
124150
@Override
125151
public Stream<Path> resolveRelativePaths(PathLookup pathLookup) {
126152
return resolvePathSettings(pathLookup, setting);
@@ -195,6 +221,7 @@ public static FilesEntitlement build(List<Object> paths) {
195221
baseDir = parseBaseDir(relativeTo);
196222
}
197223

224+
FileData fileData;
198225
if (relativePathAsString != null) {
199226
if (baseDir == null) {
200227
throw new PolicyValidationException("files entitlement with a 'relative_path' must specify 'relative_to'");
@@ -204,23 +231,24 @@ public static FilesEntitlement build(List<Object> paths) {
204231
if (relativePath.isAbsolute()) {
205232
throw new PolicyValidationException("'relative_path' [" + relativePathAsString + "] must be relative");
206233
}
207-
filesData.add(FileData.ofRelativePath(relativePath, baseDir, mode, exclusive));
234+
fileData = FileData.ofRelativePath(relativePath, baseDir, mode);
208235
} else if (pathAsString != null) {
209236
Path path = Path.of(pathAsString);
210237
if (path.isAbsolute() == false) {
211238
throw new PolicyValidationException("'path' [" + pathAsString + "] must be absolute");
212239
}
213-
filesData.add(FileData.ofPath(path, mode, exclusive));
240+
fileData = FileData.ofPath(path, mode);
214241
} else if (pathSetting != null) {
215-
filesData.add(FileData.ofPathSetting(pathSetting, mode, exclusive));
242+
fileData = FileData.ofPathSetting(pathSetting, mode);
216243
} else if (relativePathSetting != null) {
217244
if (baseDir == null) {
218245
throw new PolicyValidationException("files entitlement with a 'relative_path_setting' must specify 'relative_to'");
219246
}
220-
filesData.add(FileData.ofRelativePathSetting(relativePathSetting, baseDir, mode, exclusive));
247+
fileData = FileData.ofRelativePathSetting(relativePathSetting, baseDir, mode);
221248
} else {
222249
throw new AssertionError("File entry validation error");
223250
}
251+
filesData.add(exclusive ? fileData.withExclusive() : fileData);
224252
}
225253
return new FilesEntitlement(filesData);
226254
}

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/PolicyManagerTests.java‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -379,7 +379,7 @@ public void testDuplicateEntitlements() {
379379
FilesEntitlement.EMPTY,
380380
new CreateClassLoaderEntitlement(),
381381
new FilesEntitlement(
382-
List.of(FilesEntitlement.FileData.ofPath(Path.of("/tmp/test"), FilesEntitlement.Mode.READ, false))
382+
List.of(FilesEntitlement.FileData.ofPath(Path.of("/tmp/test"), FilesEntitlement.Mode.READ))
383383
)
384384
)
385385
)
@@ -450,9 +450,7 @@ private static Policy createPluginPolicy(String... pluginModules) {
450450
name -> new Scope(
451451
name,
452452
List.of(
453-
new FilesEntitlement(
454-
List.of(FilesEntitlement.FileData.ofPath(TEST_BASE_DIR, FilesEntitlement.Mode.READ, false))
455-
),
453+
new FilesEntitlement(List.of(FilesEntitlement.FileData.ofPath(TEST_BASE_DIR, FilesEntitlement.Mode.READ))),
456454
new CreateClassLoaderEntitlement()
457455
)
458456
)

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlementTests.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -61,29 +61,29 @@ public void testInvalidRelativeDirectory() {
6161
}
6262

6363
public void testFileDataRelativeWithEmptyDirectory() {
64-
var fileData = FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false);
64+
var fileData = FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE);
6565
var dataDirs = fileData.resolvePaths(TEST_PATH_LOOKUP);
6666
assertThat(dataDirs.toList(), contains(Path.of("/data1/"), Path.of("/data2")));
6767
}
6868

6969
public void testPathSettingResolve() {
7070
var entitlement = FilesEntitlement.build(List.of(Map.of("path_setting", "foo.bar", "mode", "read")));
7171
var filesData = entitlement.filesData();
72-
assertThat(filesData, contains(FileData.ofPathSetting("foo.bar", READ, false)));
72+
assertThat(filesData, contains(FileData.ofPathSetting("foo.bar", READ)));
7373

74-
var fileData = FileData.ofPathSetting("foo.bar", READ, false);
74+
var fileData = FileData.ofPathSetting("foo.bar", READ);
7575
// empty settings
7676
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), empty());
7777

78-
fileData = FileData.ofPathSetting("foo.bar", READ, false);
78+
fileData = FileData.ofPathSetting("foo.bar", READ);
7979
settings = Settings.builder().put("foo.bar", "/setting/path").build();
8080
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));
8181

82-
fileData = FileData.ofPathSetting("foo.*.bar", READ, false);
82+
fileData = FileData.ofPathSetting("foo.*.bar", READ);
8383
settings = Settings.builder().put("foo.baz.bar", "/setting/path").build();
8484
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));
8585

86-
fileData = FileData.ofPathSetting("foo.*.bar", READ, false);
86+
fileData = FileData.ofPathSetting("foo.*.bar", READ);
8787
settings = Settings.builder().put("foo.baz.bar", "/setting/path").put("foo.baz2.bar", "/other/path").build();
8888
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), containsInAnyOrder(Path.of("/setting/path"), Path.of("/other/path")));
8989
}

0 commit comments

Comments
 (0)