Grant file entitlements for shared data dir to ES base due to lack of entitlement delegation

mosche · mosche · commit ca4fd4b919d9 · 2025-07-23T11:59:01.000+02:00
diff --git a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/HardcodedEntitlements.java b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/HardcodedEntitlements.java
@@ -92,8 +92,9 @@ private static List<Scope> createServerEntitlements(Path pidFile) {
                     new CreateClassLoaderEntitlement(),
                     new FilesEntitlement(
                         List.of(
-                            // TODO: what in es.base is accessing shared repo?
+                            // necessary due to lack of delegation ES-12382
                             FilesEntitlement.FileData.ofBaseDirPath(SHARED_REPO, READ_WRITE),
+                            FilesEntitlement.FileData.ofBaseDirPath(SHARED_DATA, READ_WRITE),
                             FilesEntitlement.FileData.ofBaseDirPath(DATA, READ_WRITE)
                         )
                     )

Original file line number	Diff line number	Diff line change
`@@ -92,8 +92,9 @@ private static List<Scope> createServerEntitlements(Path pidFile) {`
`92`	`92`	`new CreateClassLoaderEntitlement(),`
`93`	`93`	`new FilesEntitlement(`
`94`	`94`	`List.of(`
`95`		`- // TODO: what in es.base is accessing shared repo?`
	`95`	`+ // necessary due to lack of delegation ES-12382`
`96`	`96`	`FilesEntitlement.FileData.ofBaseDirPath(SHARED_REPO, READ_WRITE),`
	`97`	`+ FilesEntitlement.FileData.ofBaseDirPath(SHARED_DATA, READ_WRITE),`
`97`	`98`	`FilesEntitlement.FileData.ofBaseDirPath(DATA, READ_WRITE)`
`98`	`99`	`)`
`99`	`100`	`)`