Skip to content

Commit d00f4cf

Browse files
slobodanadamovicslobodanadamovic
authored
Merge branch '9.0' into backport/9.0/pr-122803
2 parents 37a105f + a923dca commit d00f4cf

File tree

106 files changed

+1472
-409
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

106 files changed

+1472
-409
lines changed

‎docs/changelog/122538.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 122538
2+
summary: Fix `ArrayIndexOutOfBoundsException` in `ShardBulkInferenceActionFilter`
3+
area: Ingest
4+
type: bug
5+
issues: []

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
package org.elasticsearch.entitlement.bridge;
1111

1212
import java.io.File;
13+
import java.io.FileDescriptor;
1314
import java.io.FileFilter;
1415
import java.io.FilenameFilter;
1516
import java.io.InputStream;
@@ -572,14 +573,54 @@ public interface EntitlementChecker {
572573

573574
void check$java_io_File$setWritable(Class<?> callerClass, File file, boolean writable, boolean ownerOnly);
574575

576+
void check$java_io_FileInputStream$(Class<?> callerClass, File file);
577+
578+
void check$java_io_FileInputStream$(Class<?> callerClass, FileDescriptor fd);
579+
580+
void check$java_io_FileInputStream$(Class<?> callerClass, String name);
581+
575582
void check$java_io_FileOutputStream$(Class<?> callerClass, File file);
576583

577584
void check$java_io_FileOutputStream$(Class<?> callerClass, File file, boolean append);
578585

586+
void check$java_io_FileOutputStream$(Class<?> callerClass, FileDescriptor fd);
587+
579588
void check$java_io_FileOutputStream$(Class<?> callerClass, String name);
580589

581590
void check$java_io_FileOutputStream$(Class<?> callerClass, String name, boolean append);
582591

592+
void check$java_io_FileReader$(Class<?> callerClass, File file);
593+
594+
void check$java_io_FileReader$(Class<?> callerClass, File file, Charset charset);
595+
596+
void check$java_io_FileReader$(Class<?> callerClass, FileDescriptor fd);
597+
598+
void check$java_io_FileReader$(Class<?> callerClass, String name);
599+
600+
void check$java_io_FileReader$(Class<?> callerClass, String name, Charset charset);
601+
602+
void check$java_io_FileWriter$(Class<?> callerClass, File file);
603+
604+
void check$java_io_FileWriter$(Class<?> callerClass, File file, boolean append);
605+
606+
void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset);
607+
608+
void check$java_io_FileWriter$(Class<?> callerClass, File file, Charset charset, boolean append);
609+
610+
void check$java_io_FileWriter$(Class<?> callerClass, FileDescriptor fd);
611+
612+
void check$java_io_FileWriter$(Class<?> callerClass, String name);
613+
614+
void check$java_io_FileWriter$(Class<?> callerClass, String name, boolean append);
615+
616+
void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset);
617+
618+
void check$java_io_FileWriter$(Class<?> callerClass, String name, Charset charset, boolean append);
619+
620+
void check$java_io_RandomAccessFile$(Class<?> callerClass, String name, String mode);
621+
622+
void check$java_io_RandomAccessFile$(Class<?> callerClass, File file, String mode);
623+
583624
void check$java_util_Scanner$(Class<?> callerClass, File source);
584625

585626
void check$java_util_Scanner$(Class<?> callerClass, File source, String charsetName);

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,22 @@
1313
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
1414

1515
import java.io.File;
16+
import java.io.FileDescriptor;
17+
import java.io.FileInputStream;
1618
import java.io.FileNotFoundException;
1719
import java.io.FileOutputStream;
20+
import java.io.FileReader;
21+
import java.io.FileWriter;
1822
import java.io.IOException;
23+
import java.io.RandomAccessFile;
1924
import java.nio.charset.StandardCharsets;
2025
import java.nio.file.Files;
2126
import java.nio.file.Path;
2227
import java.nio.file.Paths;
2328
import java.nio.file.attribute.UserPrincipal;
2429
import java.util.Scanner;
2530

31+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;
2632
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
2733

2834
@SuppressForbidden(reason = "Explicitly checking APIs that are forbidden")
@@ -216,6 +222,21 @@ static void createScannerFileWithCharsetName() throws FileNotFoundException {
216222
new Scanner(readFile().toFile(), "UTF-8");
217223
}
218224

225+
@EntitlementTest(expectedAccess = PLUGINS)
226+
static void createFileInputStreamFile() throws IOException {
227+
new FileInputStream(readFile().toFile()).close();
228+
}
229+
230+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
231+
static void createFileInputStreamFileDescriptor() throws IOException {
232+
new FileInputStream(FileDescriptor.in).close();
233+
}
234+
235+
@EntitlementTest(expectedAccess = PLUGINS)
236+
static void createFileInputStreamString() throws IOException {
237+
new FileInputStream(readFile().toString()).close();
238+
}
239+
219240
@EntitlementTest(expectedAccess = PLUGINS)
220241
static void createFileOutputStreamString() throws IOException {
221242
new FileOutputStream(readWriteFile().toString()).close();
@@ -236,6 +257,96 @@ static void createFileOutputStreamFileWithAppend() throws IOException {
236257
new FileOutputStream(readWriteFile().toFile(), false).close();
237258
}
238259

260+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
261+
static void createFileOutputStreamFileDescriptor() throws IOException {
262+
new FileOutputStream(FileDescriptor.out).close();
263+
}
264+
265+
@EntitlementTest(expectedAccess = PLUGINS)
266+
static void createFileReaderFile() throws IOException {
267+
new FileReader(readFile().toFile()).close();
268+
}
269+
270+
@EntitlementTest(expectedAccess = PLUGINS)
271+
static void createFileReaderFileCharset() throws IOException {
272+
new FileReader(readFile().toFile(), StandardCharsets.UTF_8).close();
273+
}
274+
275+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
276+
static void createFileReaderFileDescriptor() throws IOException {
277+
new FileReader(FileDescriptor.in).close();
278+
}
279+
280+
@EntitlementTest(expectedAccess = PLUGINS)
281+
static void createFileReaderString() throws IOException {
282+
new FileReader(readFile().toString()).close();
283+
}
284+
285+
@EntitlementTest(expectedAccess = PLUGINS)
286+
static void createFileReaderStringCharset() throws IOException {
287+
new FileReader(readFile().toString(), StandardCharsets.UTF_8).close();
288+
}
289+
290+
@EntitlementTest(expectedAccess = PLUGINS)
291+
static void createFileWriterFile() throws IOException {
292+
new FileWriter(readWriteFile().toFile()).close();
293+
}
294+
295+
@EntitlementTest(expectedAccess = PLUGINS)
296+
static void createFileWriterFileWithAppend() throws IOException {
297+
new FileWriter(readWriteFile().toFile(), false).close();
298+
}
299+
300+
@EntitlementTest(expectedAccess = PLUGINS)
301+
static void createFileWriterFileCharsetWithAppend() throws IOException {
302+
new FileWriter(readWriteFile().toFile(), StandardCharsets.UTF_8, false).close();
303+
}
304+
305+
@EntitlementTest(expectedAccess = ALWAYS_DENIED)
306+
static void createFileWriterFileDescriptor() throws IOException {
307+
new FileWriter(FileDescriptor.out).close();
308+
}
309+
310+
@EntitlementTest(expectedAccess = PLUGINS)
311+
static void createFileWriterString() throws IOException {
312+
new FileWriter(readWriteFile().toString()).close();
313+
}
314+
315+
@EntitlementTest(expectedAccess = PLUGINS)
316+
static void createFileWriterStringWithAppend() throws IOException {
317+
new FileWriter(readWriteFile().toString(), false).close();
318+
}
319+
320+
@EntitlementTest(expectedAccess = PLUGINS)
321+
static void createFileWriterStringCharset() throws IOException {
322+
new FileWriter(readWriteFile().toString(), StandardCharsets.UTF_8).close();
323+
}
324+
325+
@EntitlementTest(expectedAccess = PLUGINS)
326+
static void createFileWriterStringCharsetWithAppend() throws IOException {
327+
new FileWriter(readWriteFile().toString(), StandardCharsets.UTF_8, false).close();
328+
}
329+
330+
@EntitlementTest(expectedAccess = PLUGINS)
331+
static void createRandomAccessFileStringRead() throws IOException {
332+
new RandomAccessFile(readFile().toString(), "r").close();
333+
}
334+
335+
@EntitlementTest(expectedAccess = PLUGINS)
336+
static void createRandomAccessFileStringReadWrite() throws IOException {
337+
new RandomAccessFile(readWriteFile().toString(), "rw").close();
338+
}
339+
340+
@EntitlementTest(expectedAccess = PLUGINS)
341+
static void createRandomAccessFileRead() throws IOException {
342+
new RandomAccessFile(readFile().toFile(), "r").close();
343+
}
344+
345+
@EntitlementTest(expectedAccess = PLUGINS)
346+
static void createRandomAccessFileReadWrite() throws IOException {
347+
new RandomAccessFile(readWriteFile().toFile(), "rw").close();
348+
}
349+
239350
@EntitlementTest(expectedAccess = PLUGINS)
240351
static void filesGetOwner() throws IOException {
241352
Files.getOwner(readFile());

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 79 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
import java.nio.file.spi.FileSystemProvider;
5454
import java.util.ArrayList;
5555
import java.util.Arrays;
56+
import java.util.Collections;
5657
import java.util.HashMap;
5758
import java.util.List;
5859
import java.util.Map;
@@ -137,76 +138,84 @@ private static PolicyManager createPolicyManager() {
137138
var pathLookup = new PathLookup(getUserHome(), bootstrapArgs.configDir(), bootstrapArgs.dataDirs(), bootstrapArgs.tempDir());
138139
Path logsDir = EntitlementBootstrap.bootstrapArgs().logsDir();
139140

140-
// TODO(ES-10031): Decide what goes in the elasticsearch default policy and extend it
141-
var serverPolicy = new Policy(
142-
"server",
143-
List.of(
144-
new Scope("org.elasticsearch.base", List.of(new CreateClassLoaderEntitlement())),
145-
new Scope("org.elasticsearch.xcontent", List.of(new CreateClassLoaderEntitlement())),
146-
new Scope(
147-
"org.elasticsearch.server",
148-
List.of(
149-
new ExitVMEntitlement(),
150-
new ReadStoreAttributesEntitlement(),
151-
new CreateClassLoaderEntitlement(),
152-
new InboundNetworkEntitlement(),
153-
new OutboundNetworkEntitlement(),
154-
new LoadNativeLibrariesEntitlement(),
155-
new ManageThreadsEntitlement(),
156-
new FilesEntitlement(
157-
Stream.concat(
158-
Stream.of(
159-
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
160-
FileData.ofPath(bootstrapArgs.configDir(), READ),
161-
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
162-
// OS release on Linux
163-
FileData.ofPath(Path.of("/etc/os-release"), READ),
164-
FileData.ofPath(Path.of("/etc/system-release"), READ),
165-
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
166-
// read max virtual memory areas
167-
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
168-
FileData.ofPath(Path.of("/proc/meminfo"), READ),
169-
// load averages on Linux
170-
FileData.ofPath(Path.of("/proc/loadavg"), READ),
171-
// control group stats on Linux. cgroup v2 stats are in an unpredicable
172-
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
173-
// read access to the entire directory hierarchy.
174-
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
175-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
176-
// // io stats on Linux
177-
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
178-
FileData.ofPath(Path.of("/proc/diskstats"), READ)
179-
),
180-
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ))
181-
).toList()
182-
)
183-
)
184-
),
185-
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
186-
new Scope("io.netty.transport", List.of(new InboundNetworkEntitlement(), new OutboundNetworkEntitlement())),
187-
new Scope(
188-
"org.apache.lucene.core",
189-
List.of(
190-
new LoadNativeLibrariesEntitlement(),
191-
new ManageThreadsEntitlement(),
192-
new FilesEntitlement(
193-
Stream.concat(
194-
Stream.of(FileData.ofPath(bootstrapArgs.configDir(), READ)),
195-
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ_WRITE))
196-
).toList()
197-
)
141+
List<Scope> serverScopes = new ArrayList<>();
142+
Collections.addAll(
143+
serverScopes,
144+
new Scope("org.elasticsearch.base", List.of(new CreateClassLoaderEntitlement())),
145+
new Scope("org.elasticsearch.xcontent", List.of(new CreateClassLoaderEntitlement())),
146+
new Scope(
147+
"org.elasticsearch.server",
148+
List.of(
149+
new ExitVMEntitlement(),
150+
new ReadStoreAttributesEntitlement(),
151+
new CreateClassLoaderEntitlement(),
152+
new InboundNetworkEntitlement(),
153+
new OutboundNetworkEntitlement(),
154+
new LoadNativeLibrariesEntitlement(),
155+
new ManageThreadsEntitlement(),
156+
new FilesEntitlement(
157+
Stream.concat(
158+
Stream.of(
159+
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
160+
FileData.ofPath(bootstrapArgs.configDir(), READ),
161+
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
162+
// OS release on Linux
163+
FileData.ofPath(Path.of("/etc/os-release"), READ),
164+
FileData.ofPath(Path.of("/etc/system-release"), READ),
165+
FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
166+
// read max virtual memory areas
167+
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
168+
FileData.ofPath(Path.of("/proc/meminfo"), READ),
169+
// load averages on Linux
170+
FileData.ofPath(Path.of("/proc/loadavg"), READ),
171+
// control group stats on Linux. cgroup v2 stats are in an unpredicable
172+
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
173+
// read access to the entire directory hierarchy.
174+
FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
175+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
176+
// // io stats on Linux
177+
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
178+
FileData.ofPath(Path.of("/proc/diskstats"), READ)
179+
),
180+
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ))
181+
).toList()
198182
)
199-
),
200-
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
201-
new Scope(
202-
"org.elasticsearch.nativeaccess",
203-
List.of(
204-
new LoadNativeLibrariesEntitlement(),
205-
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
183+
)
184+
),
185+
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
186+
new Scope("io.netty.transport", List.of(new InboundNetworkEntitlement(), new OutboundNetworkEntitlement())),
187+
new Scope(
188+
"org.apache.lucene.core",
189+
List.of(
190+
new LoadNativeLibrariesEntitlement(),
191+
new ManageThreadsEntitlement(),
192+
new FilesEntitlement(
193+
Stream.concat(
194+
Stream.of(FileData.ofPath(bootstrapArgs.configDir(), READ)),
195+
Arrays.stream(bootstrapArgs.dataDirs()).map(d -> FileData.ofPath(d, READ_WRITE))
196+
).toList()
206197
)
207198
)
199+
),
200+
new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
201+
new Scope(
202+
"org.elasticsearch.nativeaccess",
203+
List.of(
204+
new LoadNativeLibrariesEntitlement(),
205+
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
206+
)
208207
)
209208
);
209+
210+
Path trustStorePath = trustStorePath();
211+
if (trustStorePath != null) {
212+
serverScopes.add(
213+
new Scope("org.bouncycastle.fips.tls", List.of(new FilesEntitlement(List.of(FileData.ofPath(trustStorePath, READ)))))
214+
);
215+
}
216+
217+
// TODO(ES-10031): Decide what goes in the elasticsearch default policy and extend it
218+
var serverPolicy = new Policy("server", serverScopes);
210219
// agents run without a module, so this is a special hack for the apm agent
211220
// this should be removed once https://github.com/elastic/elasticsearch/issues/109335 is completed
212221
List<Entitlement> agentEntitlements = List.of(new CreateClassLoaderEntitlement(), new ManageThreadsEntitlement());
@@ -230,6 +239,11 @@ private static Path getUserHome() {
230239
return PathUtils.get(userHome);
231240
}
232241

242+
private static Path trustStorePath() {
243+
String trustStore = System.getProperty("javax.net.ssl.trustStore");
244+
return trustStore != null ? Path.of(trustStore) : null;
245+
}
246+
233247
private static Stream<InstrumentationService.InstrumentationInfo> fileSystemProviderChecks() throws ClassNotFoundException,
234248
NoSuchMethodException {
235249
var fileSystemProviderClass = FileSystems.getDefault().provider().getClass();

0 commit comments

Comments
 (0)