Skip to content

Commit d998f3a

Browse files
rjernstrjernst
committed
Remove doPrivileged uses from server
Now that SecurityManager is no longer used, doPrivileged is no longer necessary. This commit removes uses of it from core and server
1 parent 1a1763c commit d998f3a

File tree

14 files changed

+100
-241
lines changed

14 files changed

+100
-241
lines changed

‎libs/core/src/main/java/org/elasticsearch/core/internal/provider/EmbeddedImplClassLoader.java‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,8 @@
2323
import java.nio.file.FileSystems;
2424
import java.nio.file.Files;
2525
import java.nio.file.Path;
26-
import java.security.AccessController;
2726
import java.security.CodeSigner;
2827
import java.security.CodeSource;
29-
import java.security.PrivilegedAction;
3028
import java.security.SecureClassLoader;
3129
import java.util.ArrayList;
3230
import java.util.Collections;
@@ -96,8 +94,7 @@ record JarMeta(String prefix, boolean isMultiRelease, Set<String> packages, Map<
9694
private final ClassLoader parent;
9795

9896
static EmbeddedImplClassLoader getInstance(ClassLoader parent, String providerName) {
99-
PrivilegedAction<EmbeddedImplClassLoader> pa = () -> new EmbeddedImplClassLoader(parent, getProviderPrefixes(parent, providerName));
100-
return AccessController.doPrivileged(pa);
97+
return new EmbeddedImplClassLoader(parent, getProviderPrefixes(parent, providerName));
10198
}
10299

103100
private EmbeddedImplClassLoader(ClassLoader parent, Map<JarMeta, CodeSource> prefixToCodeBase) {
@@ -120,14 +117,12 @@ private EmbeddedImplClassLoader(ClassLoader parent, Map<JarMeta, CodeSource> pre
120117
record Resource(InputStream inputStream, CodeSource codeSource) {}
121118

122119
/** Searches for the named resource. Iterates over all prefixes. */
123-
private Resource privilegedGetResourceOrNull(JarMeta jarMeta, String pkg, String filepath) {
124-
return AccessController.doPrivileged((PrivilegedAction<Resource>) () -> {
125-
InputStream is = findResourceInLoaderPkgOrNull(jarMeta, pkg, filepath, parent::getResourceAsStream);
126-
if (is != null) {
127-
return new Resource(is, prefixToCodeBase.get(jarMeta.prefix()));
128-
}
129-
return null;
130-
});
120+
private Resource getResourceOrNull(JarMeta jarMeta, String pkg, String filepath) {
121+
InputStream is = findResourceInLoaderPkgOrNull(jarMeta, pkg, filepath, parent::getResourceAsStream);
122+
if (is != null) {
123+
return new Resource(is, prefixToCodeBase.get(jarMeta.prefix()));
124+
}
125+
return null;
131126
}
132127

133128
@Override
@@ -148,7 +143,7 @@ public Class<?> findClass(String name) throws ClassNotFoundException {
148143
String pkg = toPackageName(filepath);
149144
JarMeta jarMeta = packageToJarMeta.get(pkg);
150145
if (jarMeta != null) {
151-
Resource res = privilegedGetResourceOrNull(jarMeta, pkg, filepath);
146+
Resource res = getResourceOrNull(jarMeta, pkg, filepath);
152147
if (res != null) {
153148
try (InputStream in = res.inputStream()) {
154149
byte[] bytes = in.readAllBytes();

‎libs/core/src/main/java/org/elasticsearch/core/internal/provider/ProviderLocator.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,10 +97,9 @@ public ProviderLocator(String providerName, Class<T> providerType, String provid
9797
@Override
9898
public T get() {
9999
try {
100-
PrivilegedExceptionAction<T> pa = this::load;
101-
return AccessController.doPrivileged(pa);
102-
} catch (PrivilegedActionException e) {
103-
throw new UncheckedIOException((IOException) e.getCause());
100+
return load();
101+
} catch (IOException e) {
102+
throw new UncheckedIOException(e);
104103
}
105104
}
106105

‎server/src/main/java/org/elasticsearch/bootstrap/ElasticsearchUncaughtExceptionHandler.java‎

Lines changed: 4 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,8 @@
1111

1212
import org.apache.logging.log4j.LogManager;
1313
import org.apache.logging.log4j.Logger;
14-
import org.elasticsearch.core.SuppressForbidden;
1514

1615
import java.io.IOError;
17-
import java.security.AccessController;
18-
import java.security.PrivilegedAction;
1916

2017
class ElasticsearchUncaughtExceptionHandler implements Thread.UncaughtExceptionHandler {
2118
private static final Logger logger = LogManager.getLogger(ElasticsearchUncaughtExceptionHandler.class);
@@ -53,41 +50,16 @@ static boolean isFatalUncaught(Throwable e) {
5350

5451
void onFatalUncaught(final String threadName, final Throwable t) {
5552
final String message = "fatal error in thread [" + threadName + "], exiting";
56-
logErrorMessage(t, message);
53+
logger.error(message, t);
5754
}
5855

5956
void onNonFatalUncaught(final String threadName, final Throwable t) {
6057
final String message = "uncaught exception in thread [" + threadName + "]";
61-
logErrorMessage(t, message);
62-
}
63-
64-
private static void logErrorMessage(Throwable t, String message) {
65-
AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
66-
logger.error(message, t);
67-
return null;
68-
});
58+
logger.error(message, t);
6959
}
7060

7161
void halt(int status) {
72-
AccessController.doPrivileged(new PrivilegedHaltAction(status));
62+
// we halt to prevent shutdown hooks from running
63+
Runtime.getRuntime().halt(status);
7364
}
74-
75-
static class PrivilegedHaltAction implements PrivilegedAction<Void> {
76-
77-
private final int status;
78-
79-
private PrivilegedHaltAction(final int status) {
80-
this.status = status;
81-
}
82-
83-
@SuppressForbidden(reason = "halt")
84-
@Override
85-
public Void run() {
86-
// we halt to prevent shutdown hooks from running
87-
Runtime.getRuntime().halt(status);
88-
return null;
89-
}
90-
91-
}
92-
9365
}

‎server/src/main/java/org/elasticsearch/common/blobstore/fs/FsBlobStore.java‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@
1818
import java.io.IOException;
1919
import java.nio.file.Files;
2020
import java.nio.file.Path;
21-
import java.security.AccessController;
22-
import java.security.PrivilegedAction;
2321
import java.util.Iterator;
2422
import java.util.List;
2523

@@ -57,14 +55,11 @@ public int bufferSizeInBytes() {
5755
public BlobContainer blobContainer(BlobPath path) {
5856
Path f = buildPath(path);
5957
if (readOnly == false) {
60-
AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
61-
try {
62-
Files.createDirectories(f);
63-
} catch (IOException ex) {
64-
throw new ElasticsearchException("failed to create blob container", ex);
65-
}
66-
return null;
67-
});
58+
try {
59+
Files.createDirectories(f);
60+
} catch (IOException ex) {
61+
throw new ElasticsearchException("failed to create blob container", ex);
62+
}
6863
}
6964
return new FsBlobContainer(this, path, f);
7065
}

‎server/src/main/java/org/elasticsearch/common/logging/DeprecationLogger.java‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@
1515
import org.elasticsearch.common.regex.Regex;
1616
import org.elasticsearch.common.settings.Settings;
1717

18-
import java.security.AccessController;
19-
import java.security.PrivilegedAction;
2018
import java.util.Collections;
2119
import java.util.List;
2220

@@ -119,18 +117,11 @@ private DeprecationLogger logDeprecation(Level level, DeprecationCategory catego
119117
String opaqueId = HeaderWarning.getXOpaqueId();
120118
String productOrigin = HeaderWarning.getProductOrigin();
121119
ESLogMessage deprecationMessage = DeprecatedMessage.of(category, key, opaqueId, productOrigin, msg, params);
122-
doPrivilegedLog(level, deprecationMessage);
120+
logger.log(level, deprecationMessage);
123121
}
124122
return this;
125123
}
126124

127-
private void doPrivilegedLog(Level level, ESLogMessage deprecationMessage) {
128-
AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
129-
logger.log(level, deprecationMessage);
130-
return null;
131-
});
132-
}
133-
134125
/**
135126
* Used for handling previous version RestApiCompatible logic.
136127
* Logs a message at the {@link DeprecationLogger#CRITICAL} level

‎server/src/main/java/org/elasticsearch/common/util/concurrent/EsExecutors.java‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,6 @@
1717
import org.elasticsearch.core.SuppressForbidden;
1818
import org.elasticsearch.node.Node;
1919

20-
import java.security.AccessController;
21-
import java.security.PrivilegedAction;
2220
import java.util.List;
2321
import java.util.Optional;
2422
import java.util.concurrent.AbstractExecutorService;
@@ -393,11 +391,9 @@ static class EsThreadFactory implements ThreadFactory {
393391

394392
@Override
395393
public Thread newThread(Runnable r) {
396-
return AccessController.doPrivileged((PrivilegedAction<Thread>) () -> {
397-
Thread t = new EsThread(group, r, namePrefix + "[T#" + threadNumber.getAndIncrement() + "]", 0, isSystem);
398-
t.setDaemon(true);
399-
return t;
400-
});
394+
Thread t = new EsThread(group, r, namePrefix + "[T#" + threadNumber.getAndIncrement() + "]", 0, isSystem);
395+
t.setDaemon(true);
396+
return t;
401397
}
402398
}
403399

‎server/src/main/java/org/elasticsearch/index/codec/vectors/reflect/AssertingKnnVectorsReaderReflect.java‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,6 @@
1414

1515
import java.lang.invoke.MethodHandle;
1616
import java.lang.invoke.MethodHandles;
17-
import java.security.AccessController;
18-
import java.security.PrivilegedAction;
1917

2018
/**
2119
* Reflective access to unwrap non-accessible delegate in AssertingKnnVectorsReader.
@@ -52,25 +50,13 @@ private static MethodHandle getDelegateFieldHandle() {
5250
if (cls == null) {
5351
return MethodHandles.throwException(KnnVectorsReader.class, AssertionError.class);
5452
}
55-
var lookup = privilegedPrivateLookupIn(cls, MethodHandles.lookup());
53+
var lookup = MethodHandles.privateLookupIn((cls, MethodHandles.lookup());
5654
return lookup.findGetter(cls, "delegate", KnnVectorsReader.class);
5755
} catch (ReflectiveOperationException e) {
5856
throw new AssertionError(e);
5957
}
6058
}
6159

62-
@SuppressWarnings("removal")
63-
static MethodHandles.Lookup privilegedPrivateLookupIn(Class<?> cls, MethodHandles.Lookup lookup) throws IllegalAccessException {
64-
PrivilegedAction<MethodHandles.Lookup> pa = () -> {
65-
try {
66-
return MethodHandles.privateLookupIn(cls, lookup);
67-
} catch (IllegalAccessException e) {
68-
throw new AssertionError("should not happen, check opens", e);
69-
}
70-
};
71-
return AccessController.doPrivileged(pa);
72-
}
73-
7460
static void handleThrowable(Throwable t) {
7561
if (t instanceof Error error) {
7662
throw error;

‎server/src/main/java/org/elasticsearch/index/codec/vectors/reflect/OffHeapReflectionUtils.java‎

Lines changed: 10 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,6 @@
2626
import java.lang.invoke.MethodHandle;
2727
import java.lang.invoke.MethodHandles;
2828
import java.lang.invoke.VarHandle;
29-
import java.security.AccessController;
30-
import java.security.PrivilegedAction;
3129
import java.util.Map;
3230

3331
import static java.lang.invoke.MethodType.methodType;
@@ -91,62 +89,62 @@ private OffHeapReflectionUtils() {}
9189
try {
9290
// Lucene99ScalarQuantizedVectorsReader
9391
var cls = Class.forName("org.apache.lucene.codecs.lucene99.Lucene99ScalarQuantizedVectorsReader$FieldEntry");
94-
var lookup = privilegedPrivateLookupIn(L99_SQ_VR_CLS, MethodHandles.lookup());
92+
var lookup = MethodHandles.privateLookupIn(L99_SQ_VR_CLS, MethodHandles.lookup());
9593
var mt = methodType(cls, String.class);
9694
GET_FIELD_ENTRY_HNDL_SQ = lookup.findVirtual(L99_SQ_VR_CLS, "getFieldEntry", mt);
9795
GET_VECTOR_DATA_LENGTH_HANDLE_SQ = lookup.findVirtual(cls, "vectorDataLength", methodType(long.class));
9896
RAW_VECTORS_READER_HNDL_SQ = lookup.findVarHandle(L99_SQ_VR_CLS, "rawVectorsReader", FlatVectorsReader.class);
9997
// Lucene99FlatVectorsReader
10098
cls = Class.forName("org.apache.lucene.codecs.lucene99.Lucene99FlatVectorsReader$FieldEntry");
101-
lookup = privilegedPrivateLookupIn(L99_FLT_VR_CLS, MethodHandles.lookup());
99+
lookup = MethodHandles.privateLookupIn(L99_FLT_VR_CLS, MethodHandles.lookup());
102100
mt = methodType(cls, String.class, VectorEncoding.class);
103101
GET_FIELD_ENTRY_HANDLE_L99FLT = lookup.findVirtual(L99_FLT_VR_CLS, "getFieldEntry", mt);
104102
VECTOR_DATA_LENGTH_HANDLE_L99FLT = lookup.findVirtual(cls, "vectorDataLength", methodType(long.class));
105103
// DirectIOLucene99FlatVectorsReader
106104
cls = Class.forName("org.elasticsearch.index.codec.vectors.es818.DirectIOLucene99FlatVectorsReader$FieldEntry");
107-
lookup = privilegedPrivateLookupIn(DIOL99_FLT_VR_CLS, MethodHandles.lookup());
105+
lookup = MethodHandles.privateLookupIn(DIOL99_FLT_VR_CLS, MethodHandles.lookup());
108106
mt = methodType(cls, String.class, VectorEncoding.class);
109107
GET_FIELD_ENTRY_HANDLE_DIOL99FLT = lookup.findVirtual(DIOL99_FLT_VR_CLS, "getFieldEntry", mt);
110108
VECTOR_DATA_LENGTH_HANDLE_DIOL99FLT = lookup.findVirtual(cls, "vectorDataLength", methodType(long.class));
111109
// Lucene99HnswVectorsReader
112110
cls = Class.forName("org.apache.lucene.codecs.lucene99.Lucene99HnswVectorsReader$FieldEntry");
113-
lookup = privilegedPrivateLookupIn(L99_HNSW_VR_CLS, MethodHandles.lookup());
111+
lookup = MethodHandles.privateLookupIn(L99_HNSW_VR_CLS, MethodHandles.lookup());
114112
mt = methodType(cls, String.class, VectorEncoding.class);
115113
GET_FIELD_ENTRY_HANDLE_L99HNSW = lookup.findVirtual(L99_HNSW_VR_CLS, "getFieldEntry", mt);
116114
GET_VECTOR_INDEX_LENGTH_HANDLE_L99HNSW = lookup.findVirtual(cls, "vectorIndexLength", methodType(long.class));
117-
lookup = privilegedPrivateLookupIn(L99_HNSW_VR_CLS, MethodHandles.lookup());
115+
lookup = MethodHandles.privateLookupIn(L99_HNSW_VR_CLS, MethodHandles.lookup());
118116
FLAT_VECTORS_READER_HNDL_L99HNSW = lookup.findVarHandle(L99_HNSW_VR_CLS, "flatVectorsReader", FlatVectorsReader.class);
119117
// Lucene90HnswVectorsReader
120118
cls = Class.forName("org.apache.lucene.backward_codecs.lucene90.Lucene90HnswVectorsReader$FieldEntry");
121-
lookup = privilegedPrivateLookupIn(L90_HNSW_VR_CLS, MethodHandles.lookup());
119+
lookup = MethodHandles.privateLookupIn(L90_HNSW_VR_CLS, MethodHandles.lookup());
122120
mt = methodType(cls, String.class);
123121
GET_FIELD_ENTRY_HANDLE_L90HNSW = lookup.findVirtual(L90_HNSW_VR_CLS, "getFieldEntry", mt);
124122
GET_VECTOR_INDEX_LENGTH_HANDLE_L90HNSW = lookup.findVirtual(cls, "indexDataLength", methodType(long.class));
125123
GET_VECTOR_DATA_LENGTH_HANDLE_L90HNSW = lookup.findVirtual(cls, "vectorDataLength", methodType(long.class));
126124
// Lucene91HnswVectorsReader
127125
cls = Class.forName("org.apache.lucene.backward_codecs.lucene91.Lucene91HnswVectorsReader$FieldEntry");
128-
lookup = privilegedPrivateLookupIn(L91_HNSW_VR_CLS, MethodHandles.lookup());
126+
lookup = MethodHandles.privateLookupIn(L91_HNSW_VR_CLS, MethodHandles.lookup());
129127
mt = methodType(cls, String.class);
130128
GET_FIELD_ENTRY_HANDLE_L91HNSW = lookup.findVirtual(L91_HNSW_VR_CLS, "getFieldEntry", mt);
131129
GET_VECTOR_INDEX_LENGTH_HANDLE_L91HNSW = lookup.findVirtual(cls, "vectorIndexLength", methodType(long.class));
132130
GET_VECTOR_DATA_LENGTH_HANDLE_L91HNSW = lookup.findVirtual(cls, "vectorDataLength", methodType(long.class));
133131
// Lucene92HnswVectorsReader
134132
cls = Class.forName("org.apache.lucene.backward_codecs.lucene92.Lucene92HnswVectorsReader$FieldEntry");
135-
lookup = privilegedPrivateLookupIn(L92_HNSW_VR_CLS, MethodHandles.lookup());
133+
lookup = MethodHandles.privateLookupIn(L92_HNSW_VR_CLS, MethodHandles.lookup());
136134
mt = methodType(cls, String.class);
137135
GET_FIELD_ENTRY_HANDLE_L92HNSW = lookup.findVirtual(L92_HNSW_VR_CLS, "getFieldEntry", mt);
138136
GET_VECTOR_INDEX_LENGTH_HANDLE_L92HNSW = lookup.findVirtual(cls, "vectorIndexLength", methodType(long.class));
139137
GET_VECTOR_DATA_LENGTH_HANDLE_L92HNSW = lookup.findVirtual(cls, "vectorDataLength", methodType(long.class));
140138
// Lucene94HnswVectorsReader
141139
cls = Class.forName("org.apache.lucene.backward_codecs.lucene94.Lucene94HnswVectorsReader$FieldEntry");
142-
lookup = privilegedPrivateLookupIn(L94_HNSW_VR_CLS, MethodHandles.lookup());
140+
lookup = MethodHandles.privateLookupIn(L94_HNSW_VR_CLS, MethodHandles.lookup());
143141
mt = methodType(cls, String.class, VectorEncoding.class);
144142
GET_FIELD_ENTRY_HANDLE_L94HNSW = lookup.findVirtual(L94_HNSW_VR_CLS, "getFieldEntry", mt);
145143
GET_VECTOR_INDEX_LENGTH_HANDLE_L94HNSW = lookup.findVirtual(cls, "vectorIndexLength", methodType(long.class));
146144
GET_VECTOR_DATA_LENGTH_HANDLE_L94HNSW = lookup.findVirtual(cls, "vectorDataLength", methodType(long.class));
147145
// Lucene95HnswVectorsReader
148146
cls = Class.forName("org.apache.lucene.backward_codecs.lucene95.Lucene95HnswVectorsReader$FieldEntry");
149-
lookup = privilegedPrivateLookupIn(L95_HNSW_VR_CLS, MethodHandles.lookup());
147+
lookup = MethodHandles.privateLookupIn(L95_HNSW_VR_CLS, MethodHandles.lookup());
150148
mt = methodType(cls, String.class, VectorEncoding.class);
151149
GET_FIELD_ENTRY_HANDLE_L95HNSW = lookup.findVirtual(L95_HNSW_VR_CLS, "getFieldEntry", mt);
152150
GET_VECTOR_INDEX_LENGTH_HANDLE_L95HNSW = lookup.findVirtual(cls, "vectorIndexLength", methodType(long.class));
@@ -278,18 +276,6 @@ static Map<String, Long> getOffHeapByteSizeL95HNSW(Lucene95HnswVectorsReader rea
278276
throw new AssertionError("should not reach here");
279277
}
280278

281-
@SuppressWarnings("removal")
282-
private static MethodHandles.Lookup privilegedPrivateLookupIn(Class<?> cls, MethodHandles.Lookup lookup) {
283-
PrivilegedAction<MethodHandles.Lookup> pa = () -> {
284-
try {
285-
return MethodHandles.privateLookupIn(cls, lookup);
286-
} catch (IllegalAccessException e) {
287-
throw new AssertionError("should not happen, check opens", e);
288-
}
289-
};
290-
return AccessController.doPrivileged(pa);
291-
}
292-
293279
private static void handleThrowable(Throwable t) {
294280
if (t instanceof Error error) {
295281
throw error;

‎server/src/main/java/org/elasticsearch/plugins/ExtendedPluginsClassLoader.java‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@
99

1010
package org.elasticsearch.plugins;
1111

12-
import java.security.AccessController;
13-
import java.security.PrivilegedAction;
1412
import java.util.Collections;
1513
import java.util.List;
1614

@@ -43,8 +41,6 @@ protected Class<?> findClass(String name) throws ClassNotFoundException {
4341
* Return a new classloader across the parent and extended loaders.
4442
*/
4543
public static ExtendedPluginsClassLoader create(ClassLoader parent, List<ClassLoader> extendedLoaders) {
46-
return AccessController.doPrivileged(
47-
(PrivilegedAction<ExtendedPluginsClassLoader>) () -> new ExtendedPluginsClassLoader(parent, extendedLoaders)
48-
);
44+
return new ExtendedPluginsClassLoader(parent, extendedLoaders);
4945
}
5046
}

0 commit comments

Comments
 (0)