Skip to content

Commit c5d6966

Browse files
ldematteldematte
committed
Merge remote-tracking branch 'upstream/main' into entitlements/nio-files-1
2 parents c2a626c + 5462601 commit c5d6966

File tree

13 files changed

+225
-37
lines changed

13 files changed

+225
-37
lines changed

‎build-tools-internal/version.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jna = 5.12.1
1717
netty = 4.1.115.Final
1818
commons_lang3 = 3.9
1919
google_oauth_client = 1.34.1
20-
awsv1sdk = 1.12.270
20+
awsv1sdk = 1.12.746
2121
awsv2sdk = 2.28.13
2222
reactive_streams = 1.0.4
2323

‎docs/changelog/122247.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 122247
2+
summary: Improve jwt logging on failed auth
3+
area: Authentication
4+
type: bug
5+
issues: []

‎docs/changelog/122431.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 122431
2+
summary: Upgrade AWS SDK to v1.12.746
3+
area: Snapshot/Restore
4+
type: upgrade
5+
issues: []

‎gradle/verification-metadata.xml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -89,29 +89,29 @@
8989
<sha256 value="ccc7efe5cd3ce22d6046cafd4d2f8bff5adcb43e0d27da482178fac5daadef81" origin="Generated by Gradle"/>
9090
</artifact>
9191
</component>
92-
<component group="com.amazonaws" name="aws-java-sdk-core" version="1.12.270">
93-
<artifact name="aws-java-sdk-core-1.12.270.jar">
94-
<sha256 value="4e41d9f54606151674fc550e5e6291b0ddf917d55a2a3465a45a4e6ac98c9f8f" origin="Generated by Gradle"/>
92+
<component group="com.amazonaws" name="aws-java-sdk-core" version="1.12.746">
93+
<artifact name="aws-java-sdk-core-1.12.746.jar">
94+
<sha256 value="798fd30dafcf6816e760ad8aef8b3f09c43351ed2e166993bddc4527dbafb0be" origin="Generated by Gradle"/>
9595
</artifact>
9696
</component>
97-
<component group="com.amazonaws" name="aws-java-sdk-ec2" version="1.12.270">
98-
<artifact name="aws-java-sdk-ec2-1.12.270.jar">
99-
<sha256 value="faadf443751822e205338e80d2cea5eabd6373c1c3cef6348c24809ca82a9dd0" origin="Generated by Gradle"/>
97+
<component group="com.amazonaws" name="aws-java-sdk-ec2" version="1.12.746">
98+
<artifact name="aws-java-sdk-ec2-1.12.746.jar">
99+
<sha256 value="cec22d57e05ed75417b1342e9dd468c6fe7f2fab97c626c065d6495e44d732ad" origin="Generated by Gradle"/>
100100
</artifact>
101101
</component>
102-
<component group="com.amazonaws" name="aws-java-sdk-s3" version="1.12.270">
103-
<artifact name="aws-java-sdk-s3-1.12.270.jar">
104-
<sha256 value="41bbea44bac7cfce3898e2e598a17526984337e265f6b16814839c17168a570e" origin="Generated by Gradle"/>
102+
<component group="com.amazonaws" name="aws-java-sdk-s3" version="1.12.746">
103+
<artifact name="aws-java-sdk-s3-1.12.746.jar">
104+
<sha256 value="dcd839802c71ffc4d3e6bebc8769a2149bc423baf95f3e6c8214f9c91536bc38" origin="Generated by Gradle"/>
105105
</artifact>
106106
</component>
107-
<component group="com.amazonaws" name="aws-java-sdk-sts" version="1.12.270">
108-
<artifact name="aws-java-sdk-sts-1.12.270.jar">
109-
<sha256 value="8cf2d3705381b81808c2e75a5e25a7097385b121ef15c001b18fde3d79657571" origin="Generated by Gradle"/>
107+
<component group="com.amazonaws" name="aws-java-sdk-sts" version="1.12.746">
108+
<artifact name="aws-java-sdk-sts-1.12.746.jar">
109+
<sha256 value="2916c28f9a6b6ade40c7e2ffdea3788b198a98b2b16830e02a24ec49fc0fb06f" origin="Generated by Gradle"/>
110110
</artifact>
111111
</component>
112-
<component group="com.amazonaws" name="jmespath-java" version="1.12.270">
113-
<artifact name="jmespath-java-1.12.270.jar">
114-
<sha256 value="515d1afb0cd0176630c0707acabd4a3e48424ea938b89359774f61a24b6450f1" origin="Generated by Gradle"/>
112+
<component group="com.amazonaws" name="jmespath-java" version="1.12.746">
113+
<artifact name="jmespath-java-1.12.746.jar">
114+
<sha256 value="d4239a7a1bfacbb9cd1f0e48a46ac95960ab7942c6fbb41ea825161efea72351" origin="Generated by Gradle"/>
115115
</artifact>
116116
</component>
117117
<component group="com.avast.gradle" name="gradle-docker-compose-plugin" version="0.17.5">

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@
1010
package org.elasticsearch.entitlement.bridge;
1111

1212
import java.io.File;
13+
import java.io.FileFilter;
14+
import java.io.FilenameFilter;
1315
import java.io.InputStream;
1416
import java.io.OutputStream;
1517
import java.io.PrintStream;
@@ -520,6 +522,12 @@ public interface EntitlementChecker {
520522
//
521523

522524
// old io (ie File)
525+
void check$java_io_File$canExecute(Class<?> callerClass, File file);
526+
527+
void check$java_io_File$canRead(Class<?> callerClass, File file);
528+
529+
void check$java_io_File$canWrite(Class<?> callerClass, File file);
530+
523531
void check$java_io_File$createNewFile(Class<?> callerClass, File file);
524532

525533
void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix, File directory);
@@ -528,6 +536,28 @@ public interface EntitlementChecker {
528536

529537
void check$java_io_File$deleteOnExit(Class<?> callerClass, File file);
530538

539+
void check$java_io_File$exists(Class<?> callerClass, File file);
540+
541+
void check$java_io_File$isDirectory(Class<?> callerClass, File file);
542+
543+
void check$java_io_File$isFile(Class<?> callerClass, File file);
544+
545+
void check$java_io_File$isHidden(Class<?> callerClass, File file);
546+
547+
void check$java_io_File$lastModified(Class<?> callerClass, File file);
548+
549+
void check$java_io_File$length(Class<?> callerClass, File file);
550+
551+
void check$java_io_File$list(Class<?> callerClass, File file);
552+
553+
void check$java_io_File$list(Class<?> callerClass, File file, FilenameFilter filter);
554+
555+
void check$java_io_File$listFiles(Class<?> callerClass, File file);
556+
557+
void check$java_io_File$listFiles(Class<?> callerClass, File file, FileFilter filter);
558+
559+
void check$java_io_File$listFiles(Class<?> callerClass, File file, FilenameFilter filter);
560+
531561
void check$java_io_File$mkdir(Class<?> callerClass, File file);
532562

533563
void check$java_io_File$mkdirs(Class<?> callerClass, File file);

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,21 @@ static Path readWriteFile() {
4444
return testRootDir.resolve("read_write_file");
4545
}
4646

47+
@EntitlementTest(expectedAccess = PLUGINS)
48+
static void fileCanExecute() throws IOException {
49+
readFile().toFile().canExecute();
50+
}
51+
52+
@EntitlementTest(expectedAccess = PLUGINS)
53+
static void fileCanRead() throws IOException {
54+
readFile().toFile().canRead();
55+
}
56+
57+
@EntitlementTest(expectedAccess = PLUGINS)
58+
static void fileCanWrite() throws IOException {
59+
readFile().toFile().canWrite();
60+
}
61+
4762
@EntitlementTest(expectedAccess = PLUGINS)
4863
static void fileCreateNewFile() throws IOException {
4964
readWriteDir().resolve("new_file").toFile().createNewFile();
@@ -68,6 +83,61 @@ static void fileDeleteOnExit() throws IOException {
6883
toDelete.toFile().deleteOnExit();
6984
}
7085

86+
@EntitlementTest(expectedAccess = PLUGINS)
87+
static void fileExists() throws IOException {
88+
readFile().toFile().exists();
89+
}
90+
91+
@EntitlementTest(expectedAccess = PLUGINS)
92+
static void fileIsDirectory() throws IOException {
93+
readFile().toFile().isDirectory();
94+
}
95+
96+
@EntitlementTest(expectedAccess = PLUGINS)
97+
static void fileIsFile() throws IOException {
98+
readFile().toFile().isFile();
99+
}
100+
101+
@EntitlementTest(expectedAccess = PLUGINS)
102+
static void fileIsHidden() throws IOException {
103+
readFile().toFile().isHidden();
104+
}
105+
106+
@EntitlementTest(expectedAccess = PLUGINS)
107+
static void fileLastModified() throws IOException {
108+
readFile().toFile().lastModified();
109+
}
110+
111+
@EntitlementTest(expectedAccess = PLUGINS)
112+
static void fileLength() throws IOException {
113+
readFile().toFile().length();
114+
}
115+
116+
@EntitlementTest(expectedAccess = PLUGINS)
117+
static void fileList() throws IOException {
118+
readDir().toFile().list();
119+
}
120+
121+
@EntitlementTest(expectedAccess = PLUGINS)
122+
static void fileListWithFilter() throws IOException {
123+
readDir().toFile().list((dir, name) -> true);
124+
}
125+
126+
@EntitlementTest(expectedAccess = PLUGINS)
127+
static void fileListFiles() throws IOException {
128+
readDir().toFile().listFiles();
129+
}
130+
131+
@EntitlementTest(expectedAccess = PLUGINS)
132+
static void fileListFilesWithFileFilter() throws IOException {
133+
readDir().toFile().listFiles(pathname -> true);
134+
}
135+
136+
@EntitlementTest(expectedAccess = PLUGINS)
137+
static void fileListFilesWithFilenameFilter() throws IOException {
138+
readDir().toFile().listFiles((dir, name) -> true);
139+
}
140+
71141
@EntitlementTest(expectedAccess = PLUGINS)
72142
static void fileMkdir() throws IOException {
73143
Path mkdir = readWriteDir().resolve("mkdir");

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
import org.elasticsearch.entitlement.runtime.policy.PolicyManager;
1515

1616
import java.io.File;
17+
import java.io.FileFilter;
18+
import java.io.FilenameFilter;
1719
import java.io.IOException;
1820
import java.io.InputStream;
1921
import java.io.OutputStream;
@@ -964,6 +966,21 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
964966

965967
// old io (ie File)
966968

969+
@Override
970+
public void check$java_io_File$canExecute(Class<?> callerClass, File file) {
971+
policyManager.checkFileRead(callerClass, file);
972+
}
973+
974+
@Override
975+
public void check$java_io_File$canRead(Class<?> callerClass, File file) {
976+
policyManager.checkFileRead(callerClass, file);
977+
}
978+
979+
@Override
980+
public void check$java_io_File$canWrite(Class<?> callerClass, File file) {
981+
policyManager.checkFileRead(callerClass, file);
982+
}
983+
967984
@Override
968985
public void check$java_io_File$createNewFile(Class<?> callerClass, File file) {
969986
policyManager.checkFileWrite(callerClass, file);
@@ -984,6 +1001,61 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
9841001
policyManager.checkFileWrite(callerClass, file);
9851002
}
9861003

1004+
@Override
1005+
public void check$java_io_File$exists(Class<?> callerClass, File file) {
1006+
policyManager.checkFileRead(callerClass, file);
1007+
}
1008+
1009+
@Override
1010+
public void check$java_io_File$isDirectory(Class<?> callerClass, File file) {
1011+
policyManager.checkFileRead(callerClass, file);
1012+
}
1013+
1014+
@Override
1015+
public void check$java_io_File$isFile(Class<?> callerClass, File file) {
1016+
policyManager.checkFileRead(callerClass, file);
1017+
}
1018+
1019+
@Override
1020+
public void check$java_io_File$isHidden(Class<?> callerClass, File file) {
1021+
policyManager.checkFileRead(callerClass, file);
1022+
}
1023+
1024+
@Override
1025+
public void check$java_io_File$lastModified(Class<?> callerClass, File file) {
1026+
policyManager.checkFileRead(callerClass, file);
1027+
}
1028+
1029+
@Override
1030+
public void check$java_io_File$length(Class<?> callerClass, File file) {
1031+
policyManager.checkFileRead(callerClass, file);
1032+
}
1033+
1034+
@Override
1035+
public void check$java_io_File$list(Class<?> callerClass, File file) {
1036+
policyManager.checkFileRead(callerClass, file);
1037+
}
1038+
1039+
@Override
1040+
public void check$java_io_File$list(Class<?> callerClass, File file, FilenameFilter filter) {
1041+
policyManager.checkFileRead(callerClass, file);
1042+
}
1043+
1044+
@Override
1045+
public void check$java_io_File$listFiles(Class<?> callerClass, File file) {
1046+
policyManager.checkFileRead(callerClass, file);
1047+
}
1048+
1049+
@Override
1050+
public void check$java_io_File$listFiles(Class<?> callerClass, File file, FileFilter filter) {
1051+
policyManager.checkFileRead(callerClass, file);
1052+
}
1053+
1054+
@Override
1055+
public void check$java_io_File$listFiles(Class<?> callerClass, File file, FilenameFilter filter) {
1056+
policyManager.checkFileRead(callerClass, file);
1057+
}
1058+
9871059
@Override
9881060
public void check$java_io_File$mkdir(Class<?> callerClass, File file) {
9891061
policyManager.checkFileWrite(callerClass, file);

‎modules/repository-azure/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
11
io.netty.common:
22
- outbound_network
33
- manage_threads
4+
- files:
5+
- path: "/etc/os-release"
6+
mode: "read"
7+
- path: "/usr/lib/os-release"
8+
mode: "read"

‎modules/repository-s3/build.gradle‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -139,15 +139,6 @@ tasks.named("thirdPartyAudit").configure {
139139
'org.apache.log.Hierarchy',
140140
'org.apache.log.Logger',
141141
'javax.jms.Message',
142-
'software.amazon.ion.IonReader',
143-
'software.amazon.ion.IonSystem',
144-
'software.amazon.ion.IonType',
145-
'software.amazon.ion.IonWriter',
146-
'software.amazon.ion.Timestamp',
147-
'software.amazon.ion.system.IonBinaryWriterBuilder',
148-
'software.amazon.ion.system.IonSystemBuilder',
149-
'software.amazon.ion.system.IonTextWriterBuilder',
150-
'software.amazon.ion.system.IonWriterBuilder',
151142
// We don't use the kms dependency
152143
'com.amazonaws.services.kms.AWSKMS',
153144
'com.amazonaws.services.kms.AWSKMSClient',

‎modules/transport-netty4/src/main/plugin-metadata/entitlement-policy.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,8 @@ io.netty.common:
66
- inbound_network
77
- outbound_network
88
- manage_threads
9+
- files:
10+
- path: "/etc/os-release"
11+
mode: "read"
12+
- path: "/usr/lib/os-release"
13+
mode: "read"

0 commit comments

Comments
 (0)