Skip to content

Commit daa77ba

Browse files
salvatore-campagnasalvatore-campagna
authored
Merge branch 'main' into tsdb-timestamp-sparse-index
2 parents 0b3d514 + 12fcdd8 commit daa77ba

File tree

17 files changed

+441
-327
lines changed

17 files changed

+441
-327
lines changed

‎build-conventions/src/main/java/org/elasticsearch/gradle/internal/conventions/EclipseConventionPlugin.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import org.gradle.api.Plugin;
1616
import org.gradle.api.Project;
1717
import org.gradle.api.Transformer;
18+
import org.gradle.api.invocation.Gradle;
1819
import org.gradle.api.plugins.JavaBasePlugin;
1920
import org.gradle.api.plugins.JavaPluginExtension;
2021
import org.gradle.api.tasks.Copy;
@@ -38,6 +39,15 @@ public class EclipseConventionPlugin implements Plugin<Project> {
3839
@Override
3940
public void apply(Project project) {
4041
project.getPlugins().apply(EclipsePlugin.class);
42+
Gradle gradle = project.getGradle();
43+
44+
boolean isEclipse = project.getProviders().systemProperty("eclipse.launcher").isPresent() || // Gradle launched from Eclipse
45+
project.getProviders().systemProperty("eclipse.application").isPresent() || // Gradle launched from the Eclipse compiler server
46+
gradle.getStartParameter().getTaskNames().contains("eclipse") || // Gradle launched from the command line to do eclipse stuff
47+
gradle.getStartParameter().getTaskNames().contains("cleanEclipse");
48+
// for eclipse ide specific hacks...
49+
project.getExtensions().add("isEclipse", isEclipse);
50+
4151
EclipseModel eclipseModel = project.getExtensions().getByType(EclipseModel.class);
4252
EclipseProject eclipseProject = eclipseModel.getProject();
4353

‎build.gradle‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -247,15 +247,6 @@ allprojects {
247247
}
248248
}
249249

250-
// injecting groovy property variables into all projects
251-
project.ext {
252-
// for ide hacks...
253-
isEclipse = providers.systemProperty("eclipse.launcher").isPresent() || // Detects gradle launched from Eclipse's IDE
254-
providers.systemProperty("eclipse.application").isPresent() || // Detects gradle launched from the Eclipse compiler server
255-
gradle.startParameter.taskNames.contains('eclipse') || // Detects gradle launched from the command line to do eclipse stuff
256-
gradle.startParameter.taskNames.contains('cleanEclipse')
257-
}
258-
259250
ext.bwc_tests_enabled = bwc_tests_enabled
260251

261252
// eclipse configuration

‎docs/changelog/123079.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
pr: 123079
2+
summary: Register `IngestGeoIpMetadata` as a NamedXContent
3+
area: Ingest Node
4+
type: bug
5+
issues: []

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/EntitlementBootstrap.java‎

Lines changed: 7 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,13 @@
1414
import com.sun.tools.attach.AttachNotSupportedException;
1515
import com.sun.tools.attach.VirtualMachine;
1616

17-
import org.elasticsearch.core.CheckedConsumer;
1817
import org.elasticsearch.core.SuppressForbidden;
1918
import org.elasticsearch.entitlement.initialization.EntitlementInitialization;
20-
import org.elasticsearch.entitlement.runtime.api.NotEntitledException;
2119
import org.elasticsearch.entitlement.runtime.policy.Policy;
2220
import org.elasticsearch.logging.LogManager;
2321
import org.elasticsearch.logging.Logger;
2422

2523
import java.io.IOException;
26-
import java.lang.reflect.InvocationTargetException;
2724
import java.nio.file.Files;
2825
import java.nio.file.Path;
2926
import java.util.Map;
@@ -44,7 +41,8 @@ public record BootstrapArgs(
4441
Path configDir,
4542
Path libDir,
4643
Path logsDir,
47-
Path tempDir
44+
Path tempDir,
45+
Path pidFile
4846
) {
4947
public BootstrapArgs {
5048
requireNonNull(pluginPolicies);
@@ -83,6 +81,7 @@ public static BootstrapArgs bootstrapArgs() {
8381
* @param libDir the lib directory for Elasticsearch
8482
* @param tempDir the temp directory for Elasticsearch
8583
* @param logsDir the log directory for Elasticsearch
84+
* @param pidFile path to a pid file for Elasticsearch, or {@code null} if one was not specified
8685
*/
8786
public static void bootstrap(
8887
Map<String, Policy> pluginPolicies,
@@ -94,7 +93,8 @@ public static void bootstrap(
9493
Path configDir,
9594
Path libDir,
9695
Path logsDir,
97-
Path tempDir
96+
Path tempDir,
97+
Path pidFile
9898
) {
9999
logger.debug("Loading entitlement agent");
100100
if (EntitlementBootstrap.bootstrapArgs != null) {
@@ -110,11 +110,11 @@ public static void bootstrap(
110110
configDir,
111111
libDir,
112112
logsDir,
113-
tempDir
113+
tempDir,
114+
pidFile
114115
);
115116
exportInitializationToAgent();
116117
loadAgent(findAgentJar());
117-
selfTest();
118118
}
119119

120120
@SuppressForbidden(reason = "The VirtualMachine API is the only way to attach a java agent dynamically")
@@ -160,50 +160,5 @@ private static String findAgentJar() {
160160
}
161161
}
162162

163-
/**
164-
* Attempt a few sensitive operations to ensure that some are permitted and some are forbidden.
165-
* <p>
166-
*
167-
* This serves two purposes:
168-
*
169-
* <ol>
170-
* <li>
171-
* a smoke test to make sure the entitlements system is not completely broken, and
172-
* </li>
173-
* <li>
174-
* an early test of certain important operations so they don't fail later on at an awkward time.
175-
* </li>
176-
* </ol>
177-
*
178-
* @throws IllegalStateException if the entitlements system can't prevent an unauthorized action of our choosing
179-
*/
180-
private static void selfTest() {
181-
ensureCannotStartProcess(ProcessBuilder::start);
182-
// Try again with reflection
183-
ensureCannotStartProcess(EntitlementBootstrap::reflectiveStartProcess);
184-
}
185-
186-
private static void ensureCannotStartProcess(CheckedConsumer<ProcessBuilder, ?> startProcess) {
187-
try {
188-
// The command doesn't matter; it doesn't even need to exist
189-
startProcess.accept(new ProcessBuilder(""));
190-
} catch (NotEntitledException e) {
191-
logger.debug("Success: Entitlement protection correctly prevented process creation");
192-
return;
193-
} catch (Exception e) {
194-
throw new IllegalStateException("Failed entitlement protection self-test", e);
195-
}
196-
throw new IllegalStateException("Entitlement protection self-test was incorrectly permitted");
197-
}
198-
199-
private static void reflectiveStartProcess(ProcessBuilder pb) throws Exception {
200-
try {
201-
var start = ProcessBuilder.class.getMethod("start");
202-
start.invoke(pb);
203-
} catch (InvocationTargetException e) {
204-
throw (Exception) e.getCause();
205-
}
206-
}
207-
208163
private static final Logger logger = LogManager.getLogger(EntitlementBootstrap.class);
209164
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 35 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,36 @@ private static PolicyManager createPolicyManager() {
148148
);
149149

150150
List<Scope> serverScopes = new ArrayList<>();
151+
List<FileData> serverModuleFileDatas = new ArrayList<>();
152+
Collections.addAll(
153+
serverModuleFileDatas,
154+
// Base ES directories
155+
FileData.ofPath(bootstrapArgs.configDir(), READ),
156+
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
157+
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE),
158+
FileData.ofRelativePath(Path.of(""), SHARED_REPO, READ_WRITE),
159+
160+
// OS release on Linux
161+
FileData.ofPath(Path.of("/etc/os-release"), READ).withPlatform(LINUX),
162+
FileData.ofPath(Path.of("/etc/system-release"), READ).withPlatform(LINUX),
163+
FileData.ofPath(Path.of("/usr/lib/os-release"), READ).withPlatform(LINUX),
164+
// read max virtual memory areas
165+
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ).withPlatform(LINUX),
166+
FileData.ofPath(Path.of("/proc/meminfo"), READ).withPlatform(LINUX),
167+
// load averages on Linux
168+
FileData.ofPath(Path.of("/proc/loadavg"), READ).withPlatform(LINUX),
169+
// control group stats on Linux. cgroup v2 stats are in an unpredicable
170+
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
171+
// read access to the entire directory hierarchy.
172+
FileData.ofPath(Path.of("/proc/self/cgroup"), READ).withPlatform(LINUX),
173+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ).withPlatform(LINUX),
174+
// // io stats on Linux
175+
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ).withPlatform(LINUX),
176+
FileData.ofPath(Path.of("/proc/diskstats"), READ).withPlatform(LINUX)
177+
);
178+
if (bootstrapArgs.pidFile() != null) {
179+
serverModuleFileDatas.add(FileData.ofPath(bootstrapArgs.pidFile(), READ_WRITE));
180+
}
151181
Collections.addAll(
152182
serverScopes,
153183
new Scope(
@@ -173,34 +203,7 @@ private static PolicyManager createPolicyManager() {
173203
new OutboundNetworkEntitlement(),
174204
new LoadNativeLibrariesEntitlement(),
175205
new ManageThreadsEntitlement(),
176-
new FilesEntitlement(
177-
List.of(
178-
// Base ES directories
179-
FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
180-
FileData.ofPath(bootstrapArgs.configDir(), READ),
181-
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
182-
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE),
183-
FileData.ofRelativePath(Path.of(""), SHARED_REPO, READ_WRITE),
184-
185-
// OS release on Linux
186-
FileData.ofPath(Path.of("/etc/os-release"), READ).withPlatform(LINUX),
187-
FileData.ofPath(Path.of("/etc/system-release"), READ).withPlatform(LINUX),
188-
FileData.ofPath(Path.of("/usr/lib/os-release"), READ).withPlatform(LINUX),
189-
// read max virtual memory areas
190-
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ).withPlatform(LINUX),
191-
FileData.ofPath(Path.of("/proc/meminfo"), READ).withPlatform(LINUX),
192-
// load averages on Linux
193-
FileData.ofPath(Path.of("/proc/loadavg"), READ).withPlatform(LINUX),
194-
// control group stats on Linux. cgroup v2 stats are in an unpredicable
195-
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
196-
// read access to the entire directory hierarchy.
197-
FileData.ofPath(Path.of("/proc/self/cgroup"), READ).withPlatform(LINUX),
198-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ).withPlatform(LINUX),
199-
// // io stats on Linux
200-
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ).withPlatform(LINUX),
201-
FileData.ofPath(Path.of("/proc/diskstats"), READ).withPlatform(LINUX)
202-
)
203-
)
206+
new FilesEntitlement(serverModuleFileDatas)
204207
)
205208
),
206209
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
@@ -211,11 +214,7 @@ private static PolicyManager createPolicyManager() {
211214
new LoadNativeLibrariesEntitlement(),
212215
new ManageThreadsEntitlement(),
213216
new FilesEntitlement(
214-
List.of(
215-
FileData.ofPath(bootstrapArgs.configDir(), READ),
216-
FileData.ofPath(bootstrapArgs.tempDir(), READ),
217-
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE)
218-
)
217+
List.of(FileData.ofPath(bootstrapArgs.configDir(), READ), FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE))
219218
)
220219
)
221220
),
@@ -256,7 +255,9 @@ private static PolicyManager createPolicyManager() {
256255
new FilesEntitlement(
257256
List.of(
258257
FileData.ofPath(Path.of("/co/elastic/apm/agent/"), READ),
259-
FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ)
258+
FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ),
259+
FileData.ofPath(Path.of("/proc/meminfo"), READ),
260+
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ)
260261
)
261262
)
262263
);

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
import org.elasticsearch.core.Strings;
1313
import org.elasticsearch.core.SuppressForbidden;
1414
import org.elasticsearch.entitlement.bootstrap.EntitlementBootstrap;
15-
import org.elasticsearch.entitlement.bridge.EntitlementChecker;
1615
import org.elasticsearch.entitlement.instrumentation.InstrumentationService;
1716
import org.elasticsearch.entitlement.runtime.api.NotEntitledException;
1817
import org.elasticsearch.entitlement.runtime.policy.entitlements.CreateClassLoaderEntitlement;
@@ -126,11 +125,12 @@ private static Set<Module> findSystemModules() {
126125
.stream()
127126
.map(ModuleReference::descriptor)
128127
.collect(Collectors.toUnmodifiableSet());
129-
return ModuleLayer.boot()
130-
.modules()
131-
.stream()
132-
.filter(m -> systemModulesDescriptors.contains(m.getDescriptor()))
133-
.collect(Collectors.toUnmodifiableSet());
128+
return Stream.concat(
129+
// entitlements is a "system" module, we can do anything from it
130+
Stream.of(PolicyManager.class.getModule()),
131+
// anything in the boot layer is also part of the system
132+
ModuleLayer.boot().modules().stream().filter(m -> systemModulesDescriptors.contains(m.getDescriptor()))
133+
).collect(Collectors.toUnmodifiableSet());
134134
}
135135

136136
/**
@@ -564,10 +564,6 @@ private static boolean isTriviallyAllowed(Class<?> requestingClass) {
564564
logger.debug("Entitlement trivially allowed from system module [{}]", requestingClass.getModule().getName());
565565
return true;
566566
}
567-
if (EntitlementChecker.class.isAssignableFrom(requestingClass)) {
568-
logger.debug("Entitlement trivially allowed for EntitlementChecker class");
569-
return true;
570-
}
571567
logger.trace("Entitlement not trivially allowed");
572568
return false;
573569
}

‎modules/ingest-geoip/qa/full-cluster-restart/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ dependencies {
1818
javaRestTestImplementation(testArtifact(project(":qa:full-cluster-restart"), "javaRestTest"))
1919
}
2020

21-
buildParams.bwcVersions.withWireCompatible(v -> v.before("9.0.0")) { bwcVersion, baseName ->
21+
buildParams.bwcVersions.withWireCompatible(v -> v.onOrAfter("8.15.0")) { bwcVersion, baseName ->
2222
tasks.register(bwcTaskName(bwcVersion), StandaloneRestIntegTestTask) {
2323
usesBwcDistribution(bwcVersion)
2424
systemProperty("tests.old_cluster_version", bwcVersion)

0 commit comments

Comments
 (0)