Skip to content

Commit bb690a5

Browse files
moschemosche
committed
[Entitlements] Add missing entitlements for trust store (#122797)
Add missing entitlements for trust store if running in fips mode. Fixes #122546, fixes #122569, fixes #122568, fixes #122680, fixes #122566 (cherry picked from commit 87c58ff) # Conflicts: # muted-tests.yml
1 parent 1370f6e commit bb690a5

File tree

3 files changed

+221
-65
lines changed

3 files changed

+221
-65
lines changed

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 79 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
import java.nio.file.spi.FileSystemProvider;
5454
import java.util.ArrayList;
5555
import java.util.Arrays;
56+
import java.util.Collections;
5657
import java.util.HashMap;
5758
import java.util.List;
5859
import java.util.Map;
@@ -137,76 +138,84 @@ private static PolicyManager createPolicyManager() {
137138
var pathLookup = new PathLookup(getUserHome(), bootstrapArgs.configDir(), bootstrapArgs.dataDirs(), bootstrapArgs.tempDir());
138139
Path logsDir = EntitlementBootstrap.bootstrapArgs().logsDir();
139140

140-
// TODO(ES-10031): Decide what goes in the elasticsearch default policy and extend it
141-
var serverPolicy = new Policy(
142-
"server",
143-
List.of(
144-
new Scope("org.elasticsearch.base", List.of(new CreateClassLoaderEntitlement())),
145-
new Scope("org.elasticsearch.xcontent", List.of(new CreateClassLoaderEntitlement())),
146-
new Scope(
147-
"org.elasticsearch.server",
148-
List.of(
149-
new ExitVMEntitlement(),
150-
new ReadStoreAttributesEntitlement(),
151-
new CreateClassLoaderEntitlement(),
152-
new InboundNetworkEntitlement(),
153-
new OutboundNetworkEntitlement(),
154-
new LoadNativeLibrariesEntitlement(),
155-
new ManageThreadsEntitlement(),
156-
new FilesEntitlement(
157-
Stream.concat(
158-
Stream.of(
159-
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
160-
FileData.ofPath(bootstrapArgs.configDir(), READ),
161-
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
162-
// OS release on Linux
163-
FileData.ofPath(Path.of("/etc/os-release"), READ),
164-
FileData.ofPath(Path.of("/etc/system-release"), READ),
165-
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
166-
// read max virtual memory areas
167-
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
168-
FileData.ofPath(Path.of("/proc/meminfo"), READ),
169-
// load averages on Linux
170-
FileData.ofPath(Path.of("/proc/loadavg"), READ),
171-
// control group stats on Linux. cgroup v2 stats are in an unpredicable
172-
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
173-
// read access to the entire directory hierarchy.
174-
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
175-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
176-
// // io stats on Linux
177-
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
178-
FileData.ofPath(Path.of("/proc/diskstats"), READ)
179-
),
180-
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ))
181-
).toList()
182-
)
183-
)
184-
),
185-
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
186-
new Scope("io.netty.transport", List.of(new InboundNetworkEntitlement(), new OutboundNetworkEntitlement())),
187-
new Scope(
188-
"org.apache.lucene.core",
189-
List.of(
190-
new LoadNativeLibrariesEntitlement(),
191-
new ManageThreadsEntitlement(),
192-
new FilesEntitlement(
193-
Stream.concat(
194-
Stream.of(FileData.ofPath(bootstrapArgs.configDir(), READ)),
195-
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ_WRITE))
196-
).toList()
197-
)
141+
List<Scope> serverScopes = new ArrayList<>();
142+
Collections.addAll(
143+
serverScopes,
144+
new Scope("org.elasticsearch.base", List.of(new CreateClassLoaderEntitlement())),
145+
new Scope("org.elasticsearch.xcontent", List.of(new CreateClassLoaderEntitlement())),
146+
new Scope(
147+
"org.elasticsearch.server",
148+
List.of(
149+
new ExitVMEntitlement(),
150+
new ReadStoreAttributesEntitlement(),
151+
new CreateClassLoaderEntitlement(),
152+
new InboundNetworkEntitlement(),
153+
new OutboundNetworkEntitlement(),
154+
new LoadNativeLibrariesEntitlement(),
155+
new ManageThreadsEntitlement(),
156+
new FilesEntitlement(
157+
Stream.concat(
158+
Stream.of(
159+
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
160+
FileData.ofPath(bootstrapArgs.configDir(), READ),
161+
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
162+
// OS release on Linux
163+
FileData.ofPath(Path.of("/etc/os-release"), READ),
164+
FileData.ofPath(Path.of("/etc/system-release"), READ),
165+
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
166+
// read max virtual memory areas
167+
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
168+
FileData.ofPath(Path.of("/proc/meminfo"), READ),
169+
// load averages on Linux
170+
FileData.ofPath(Path.of("/proc/loadavg"), READ),
171+
// control group stats on Linux. cgroup v2 stats are in an unpredicable
172+
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
173+
// read access to the entire directory hierarchy.
174+
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
175+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
176+
// // io stats on Linux
177+
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
178+
FileData.ofPath(Path.of("/proc/diskstats"), READ)
179+
),
180+
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ))
181+
).toList()
198182
)
199-
),
200-
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
201-
new Scope(
202-
"org.elasticsearch.nativeaccess",
203-
List.of(
204-
new LoadNativeLibrariesEntitlement(),
205-
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
183+
)
184+
),
185+
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
186+
new Scope("io.netty.transport", List.of(new InboundNetworkEntitlement(), new OutboundNetworkEntitlement())),
187+
new Scope(
188+
"org.apache.lucene.core",
189+
List.of(
190+
new LoadNativeLibrariesEntitlement(),
191+
new ManageThreadsEntitlement(),
192+
new FilesEntitlement(
193+
Stream.concat(
194+
Stream.of(FileData.ofPath(bootstrapArgs.configDir(), READ)),
195+
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ_WRITE))
196+
).toList()
206197
)
207198
)
199+
),
200+
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
201+
new Scope(
202+
"org.elasticsearch.nativeaccess",
203+
List.of(
204+
new LoadNativeLibrariesEntitlement(),
205+
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
206+
)
208207
)
209208
);
209+
210+
Path trustStorePath = trustStorePath();
211+
if (trustStorePath != null) {
212+
serverScopes.add(
213+
new Scope("org.bouncycastle.fips.tls", List.of(new FilesEntitlement(List.of(FileData.ofPath(trustStorePath, READ)))))
214+
);
215+
}
216+
217+
// TODO(ES-10031): Decide what goes in the elasticsearch default policy and extend it
218+
var serverPolicy = new Policy("server", serverScopes);
210219
// agents run without a module, so this is a special hack for the apm agent
211220
// this should be removed once https://github.com/elastic/elasticsearch/issues/109335 is completed
212221
List<Entitlement> agentEntitlements = List.of(new CreateClassLoaderEntitlement(), new ManageThreadsEntitlement());
@@ -230,6 +239,11 @@ private static Path getUserHome() {
230239
return PathUtils.get(userHome);
231240
}
232241

242+
private static Path trustStorePath() {
243+
String trustStore = System.getProperty("javax.net.ssl.trustStore");
244+
return trustStore != null ? Path.of(trustStore) : null;
245+
}
246+
233247
private static Stream<InstrumentationService.InstrumentationInfo> fileSystemProviderChecks() throws ClassNotFoundException,
234248
NoSuchMethodException {
235249
var fileSystemProviderClass = FileSystems.getDefault().provider().getClass();

‎muted-tests.yml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,7 @@ tests:
266266
- class: org.elasticsearch.env.NodeEnvironmentTests
267267
method: testGetBestDowngradeVersion
268268
issue: https://github.com/elastic/elasticsearch/issues/121316
269+
<<<<<<< HEAD
269270
- class: org.elasticsearch.index.engine.ShuffleForcedMergePolicyTests
270271
method: testDiagnostics
271272
issue: https://github.com/elastic/elasticsearch/issues/121336
@@ -280,6 +281,144 @@ tests:
280281
issue: https://github.com/elastic/elasticsearch/issues/122670
281282
- class: org.elasticsearch.telemetry.apm.ApmAgentSettingsIT
282283
issue: https://github.com/elastic/elasticsearch/issues/122546
284+
=======
285+
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
286+
method: test {yaml=reference/rest-api/security/invalidate-tokens/line_194}
287+
issue: https://github.com/elastic/elasticsearch/issues/121337
288+
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
289+
method: test {yaml=reference/rest-api/common-options/line_125}
290+
issue: https://github.com/elastic/elasticsearch/issues/121338
291+
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
292+
method: test {yaml=reference/snapshot-restore/apis/get-snapshot-api/line_751}
293+
issue: https://github.com/elastic/elasticsearch/issues/121345
294+
- class: org.elasticsearch.test.rest.yaml.CcsCommonYamlTestSuiteIT
295+
issue: https://github.com/elastic/elasticsearch/issues/121407
296+
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
297+
method: test {yaml=reference/cat/health/cat-health-no-timestamp-example}
298+
issue: https://github.com/elastic/elasticsearch/issues/121867
299+
- class: org.elasticsearch.analysis.common.CommonAnalysisClientYamlTestSuiteIT
300+
method: test {yaml=analysis-common/40_token_filters/stemmer_override file access}
301+
issue: https://github.com/elastic/elasticsearch/issues/121625
302+
- class: org.elasticsearch.xpack.searchablesnapshots.hdfs.SecureHdfsSearchableSnapshotsIT
303+
issue: https://github.com/elastic/elasticsearch/issues/121967
304+
- class: org.elasticsearch.xpack.application.CohereServiceUpgradeIT
305+
issue: https://github.com/elastic/elasticsearch/issues/121537
306+
- class: org.elasticsearch.xpack.restart.FullClusterRestartIT
307+
method: testWatcherWithApiKey {cluster=UPGRADED}
308+
issue: https://github.com/elastic/elasticsearch/issues/122061
309+
- class: org.elasticsearch.test.rest.ClientYamlTestSuiteIT
310+
method: test {yaml=snapshot.delete/10_basic/Delete a snapshot asynchronously}
311+
issue: https://github.com/elastic/elasticsearch/issues/122102
312+
- class: org.elasticsearch.search.SearchCancellationIT
313+
method: testCancelFailedSearchWhenPartialResultDisallowed
314+
issue: https://github.com/elastic/elasticsearch/issues/121719
315+
- class: org.elasticsearch.datastreams.TSDBPassthroughIndexingIT
316+
issue: https://github.com/elastic/elasticsearch/issues/121716
317+
- class: org.elasticsearch.smoketest.SmokeTestMonitoringWithSecurityIT
318+
method: testHTTPExporterWithSSL
319+
issue: https://github.com/elastic/elasticsearch/issues/122220
320+
- class: org.elasticsearch.xpack.esql.action.CrossClusterAsyncQueryStopIT
321+
method: testStopQueryLocal
322+
issue: https://github.com/elastic/elasticsearch/issues/121672
323+
- class: org.elasticsearch.xpack.security.authz.IndexAliasesTests
324+
method: testRemoveIndex
325+
issue: https://github.com/elastic/elasticsearch/issues/122221
326+
- class: org.elasticsearch.blocks.SimpleBlocksIT
327+
method: testConcurrentAddBlock
328+
issue: https://github.com/elastic/elasticsearch/issues/122324
329+
- class: org.elasticsearch.xpack.searchablesnapshots.hdfs.HdfsSearchableSnapshotsIT
330+
issue: https://github.com/elastic/elasticsearch/issues/122024
331+
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
332+
method: test {yaml=reference/cat/health/cat-health-example}
333+
issue: https://github.com/elastic/elasticsearch/issues/122335
334+
- class: org.elasticsearch.xpack.esql.action.CrossClusterCancellationIT
335+
method: testCloseSkipUnavailable
336+
issue: https://github.com/elastic/elasticsearch/issues/122336
337+
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
338+
method: test {yaml=reference/alias/line_260}
339+
issue: https://github.com/elastic/elasticsearch/issues/122343
340+
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
341+
method: test {yaml=reference/snapshot-restore/apis/get-snapshot-api/line_488}
342+
issue: https://github.com/elastic/elasticsearch/issues/121611
343+
- class: org.elasticsearch.repositories.blobstore.testkit.analyze.SecureHdfsRepositoryAnalysisRestIT
344+
issue: https://github.com/elastic/elasticsearch/issues/122377
345+
- class: org.elasticsearch.repositories.blobstore.testkit.analyze.HdfsRepositoryAnalysisRestIT
346+
issue: https://github.com/elastic/elasticsearch/issues/122378
347+
- class: org.elasticsearch.xpack.inference.mapper.SemanticInferenceMetadataFieldsRecoveryTests
348+
method: testSnapshotRecovery {p0=false p1=false}
349+
issue: https://github.com/elastic/elasticsearch/issues/122549
350+
- class: org.elasticsearch.xpack.inference.mapper.SemanticInferenceMetadataFieldsRecoveryTests
351+
method: testSnapshotRecovery {p0=true p1=false}
352+
issue: https://github.com/elastic/elasticsearch/issues/122550
353+
- class: org.elasticsearch.xpack.inference.mapper.SemanticInferenceMetadataFieldsRecoveryTests
354+
method: testSnapshotRecovery {p0=false p1=true}
355+
issue: https://github.com/elastic/elasticsearch/issues/122551
356+
- class: org.elasticsearch.index.mapper.ShapeGeometryFieldMapperTests
357+
method: testCartesianBoundsBlockLoader
358+
issue: https://github.com/elastic/elasticsearch/issues/122661
359+
- class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT
360+
method: test {yaml=reference/snapshot-restore/apis/get-snapshot-api/line_408}
361+
issue: https://github.com/elastic/elasticsearch/issues/122681
362+
- class: org.elasticsearch.xpack.autoscaling.storage.ReactiveStorageIT
363+
method: testScaleWhileShrinking
364+
issue: https://github.com/elastic/elasticsearch/issues/122119
365+
- class: org.elasticsearch.lucene.RollingUpgradeLuceneIndexCompatibilityTestCase
366+
method: testIndexUpgrade {p0=[9.1.0, 8.19.0, 8.19.0]}
367+
issue: https://github.com/elastic/elasticsearch/issues/122688
368+
- class: org.elasticsearch.lucene.RollingUpgradeLuceneIndexCompatibilityTestCase
369+
method: testRestoreIndex {p0=[9.1.0, 9.1.0, 8.19.0]}
370+
issue: https://github.com/elastic/elasticsearch/issues/122689
371+
- class: org.elasticsearch.lucene.RollingUpgradeLuceneIndexCompatibilityTestCase
372+
method: testClosedIndexUpgrade {p0=[9.1.0, 8.19.0, 8.19.0]}
373+
issue: https://github.com/elastic/elasticsearch/issues/122690
374+
- class: org.elasticsearch.lucene.RollingUpgradeLuceneIndexCompatibilityTestCase
375+
method: testRestoreIndex {p0=[9.1.0, 8.19.0, 8.19.0]}
376+
issue: https://github.com/elastic/elasticsearch/issues/122691
377+
- class: org.elasticsearch.xpack.searchablesnapshots.FrozenSearchableSnapshotsIntegTests
378+
method: testCreateAndRestorePartialSearchableSnapshot
379+
issue: https://github.com/elastic/elasticsearch/issues/122693
380+
- class: org.elasticsearch.lucene.RollingUpgradeLuceneIndexCompatibilityTestCase
381+
method: testClosedIndexUpgrade {p0=[9.1.0, 9.1.0, 8.19.0]}
382+
issue: https://github.com/elastic/elasticsearch/issues/122694
383+
- class: org.elasticsearch.lucene.RollingUpgradeLuceneIndexCompatibilityTestCase
384+
method: testClosedIndexUpgrade {p0=[9.1.0, 9.1.0, 9.1.0]}
385+
issue: https://github.com/elastic/elasticsearch/issues/122695
386+
- class: org.elasticsearch.lucene.RollingUpgradeLuceneIndexCompatibilityTestCase
387+
method: testIndexUpgrade {p0=[9.1.0, 9.1.0, 8.19.0]}
388+
issue: https://github.com/elastic/elasticsearch/issues/122696
389+
- class: org.elasticsearch.lucene.RollingUpgradeLuceneIndexCompatibilityTestCase
390+
method: testIndexUpgrade {p0=[9.1.0, 9.1.0, 9.1.0]}
391+
issue: https://github.com/elastic/elasticsearch/issues/122697
392+
- class: org.elasticsearch.lucene.RollingUpgradeLuceneIndexCompatibilityTestCase
393+
method: testRestoreIndex {p0=[9.1.0, 9.1.0, 9.1.0]}
394+
issue: https://github.com/elastic/elasticsearch/issues/122698
395+
- class: org.elasticsearch.lucene.RollingUpgradeSearchableSnapshotIndexCompatibilityIT
396+
method: testSearchableSnapshotUpgrade {p0=[9.1.0, 8.19.0, 8.19.0]}
397+
issue: https://github.com/elastic/elasticsearch/issues/122700
398+
- class: org.elasticsearch.lucene.RollingUpgradeSearchableSnapshotIndexCompatibilityIT
399+
method: testSearchableSnapshotUpgrade {p0=[9.1.0, 9.1.0, 8.19.0]}
400+
issue: https://github.com/elastic/elasticsearch/issues/122701
401+
- class: org.elasticsearch.lucene.RollingUpgradeSearchableSnapshotIndexCompatibilityIT
402+
method: testMountSearchableSnapshot {p0=[9.1.0, 8.19.0, 8.19.0]}
403+
issue: https://github.com/elastic/elasticsearch/issues/122702
404+
- class: org.elasticsearch.lucene.RollingUpgradeSearchableSnapshotIndexCompatibilityIT
405+
method: testMountSearchableSnapshot {p0=[9.1.0, 9.1.0, 8.19.0]}
406+
issue: https://github.com/elastic/elasticsearch/issues/122703
407+
- class: org.elasticsearch.lucene.RollingUpgradeSearchableSnapshotIndexCompatibilityIT
408+
method: testSearchableSnapshotUpgrade {p0=[9.1.0, 9.1.0, 9.1.0]}
409+
issue: https://github.com/elastic/elasticsearch/issues/122704
410+
- class: org.elasticsearch.lucene.RollingUpgradeSearchableSnapshotIndexCompatibilityIT
411+
method: testMountSearchableSnapshot {p0=[9.1.0, 9.1.0, 9.1.0]}
412+
issue: https://github.com/elastic/elasticsearch/issues/122705
413+
- class: org.elasticsearch.search.basic.SearchWithRandomDisconnectsIT
414+
method: testSearchWithRandomDisconnects
415+
issue: https://github.com/elastic/elasticsearch/issues/122707
416+
- class: org.elasticsearch.indices.recovery.IndexRecoveryIT
417+
method: testSourceThrottling
418+
issue: https://github.com/elastic/elasticsearch/issues/122712
419+
- class: org.elasticsearch.xpack.esql.action.EsqlActionBreakerIT
420+
issue: https://github.com/elastic/elasticsearch/issues/122810
421+
>>>>>>> 87c58ff93f8 ([Entitlements] Add missing entitlements for trust store (#122797))
283422

284423
# Examples:
285424
#

‎x-pack/plugin/security/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,6 @@ org.opensaml.saml.impl:
2828
- relative_path: saml-metadata.xml
2929
relative_to: config
3030
mode: read
31+
- relative_path: metadata.xml
32+
relative_to: config
33+
mode: read

0 commit comments

Comments
 (0)