Skip to content

Commit e400940

Browse files
prdoyleprdoyle
committed
java.base entitlements
1 parent 2ae80c7 commit e400940

File tree

9 files changed

+319
-19
lines changed

9 files changed

+319
-19
lines changed

‎libs/entitlement/asm-provider/build.gradle‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ apply plugin: 'elasticsearch.build'
1212
dependencies {
1313
compileOnly project(':libs:entitlement')
1414
compileOnly project(':libs:core')
15+
compileOnly project(':libs:logging')
1516
implementation 'org.ow2.asm:asm:9.7.1'
1617
testImplementation project(":test:framework")
1718
testImplementation project(":libs:entitlement:bridge")

‎libs/entitlement/asm-provider/src/main/java/module-info.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
requires org.elasticsearch.entitlement;
1616

1717
requires static org.elasticsearch.base; // for SuppressForbidden
18+
requires static org.elasticsearch.logging;
1819

1920
provides InstrumentationService with InstrumentationServiceImpl;
2021
}

‎libs/entitlement/asm-provider/src/main/java/org/elasticsearch/entitlement/instrumentation/impl/InstrumenterImpl.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
import org.elasticsearch.entitlement.instrumentation.CheckMethod;
1313
import org.elasticsearch.entitlement.instrumentation.Instrumenter;
1414
import org.elasticsearch.entitlement.instrumentation.MethodKey;
15+
import org.elasticsearch.logging.LogManager;
16+
import org.elasticsearch.logging.Logger;
1517
import org.objectweb.asm.AnnotationVisitor;
1618
import org.objectweb.asm.ClassReader;
1719
import org.objectweb.asm.ClassVisitor;
@@ -36,6 +38,7 @@
3638
import static org.objectweb.asm.Opcodes.INVOKEVIRTUAL;
3739

3840
public class InstrumenterImpl implements Instrumenter {
41+
private static final Logger logger = LogManager.getLogger(InstrumenterImpl.class);
3942

4043
private final String getCheckerClassMethodDescriptor;
4144
private final String handleClass;
@@ -155,10 +158,10 @@ public MethodVisitor visitMethod(int access, String name, String descriptor, Str
155158
var key = new MethodKey(className, name, Stream.of(Type.getArgumentTypes(descriptor)).map(Type::getInternalName).toList());
156159
var instrumentationMethod = checkMethods.get(key);
157160
if (instrumentationMethod != null) {
158-
// System.out.println("Will instrument method " + key);
161+
logger.debug("Will instrument {}", key);
159162
return new EntitlementMethodVisitor(Opcodes.ASM9, mv, isStatic, isCtor, descriptor, instrumentationMethod);
160163
} else {
161-
// System.out.println("Will not instrument method " + key);
164+
logger.trace("Will not instrument {}", key);
162165
}
163166
}
164167
return mv;

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@
6666
import java.nio.file.attribute.FileAttribute;
6767
import java.nio.file.attribute.UserPrincipal;
6868
import java.nio.file.spi.FileSystemProvider;
69+
import java.security.KeyStore;
70+
import java.security.Provider;
6971
import java.security.cert.CertStoreParameters;
7072
import java.util.List;
7173
import java.util.Locale;
@@ -621,12 +623,50 @@ public interface EntitlementChecker {
621623

622624
void check$java_io_RandomAccessFile$(Class<?> callerClass, File file, String mode);
623625

626+
void check$java_security_KeyStore$$getInstance(Class<?> callerClass, File file, char[] password);
627+
628+
void check$java_security_KeyStore$$getInstance(Class<?> callerClass, File file, KeyStore.LoadStoreParameter param);
629+
630+
void check$java_security_KeyStore$Builder$$newInstance(Class<?> callerClass, File file, KeyStore.ProtectionParameter protection);
631+
632+
void check$java_security_KeyStore$Builder$$newInstance(
633+
Class<?> callerClass,
634+
String type,
635+
Provider provider,
636+
File file,
637+
KeyStore.ProtectionParameter protection
638+
);
639+
624640
void check$java_util_Scanner$(Class<?> callerClass, File source);
625641

626642
void check$java_util_Scanner$(Class<?> callerClass, File source, String charsetName);
627643

628644
void check$java_util_Scanner$(Class<?> callerClass, File source, Charset charset);
629645

646+
void check$java_util_jar_JarFile$(Class<?> callerClass, String name);
647+
648+
void check$java_util_jar_JarFile$(Class<?> callerClass, String name, boolean verify);
649+
650+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file);
651+
652+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify);
653+
654+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify, int mode);
655+
656+
void check$java_util_jar_JarFile$(Class<?> callerClass, File file, boolean verify, int mode, Runtime.Version version);
657+
658+
void check$java_util_zip_ZipFile$(Class<?> callerClass, String name);
659+
660+
void check$java_util_zip_ZipFile$(Class<?> callerClass, String name, Charset charset);
661+
662+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file);
663+
664+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, int mode);
665+
666+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, Charset charset);
667+
668+
void check$java_util_zip_ZipFile$(Class<?> callerClass, File file, int mode, Charset charset);
669+
630670
// nio
631671
void check$java_nio_file_Files$$getOwner(Class<?> callerClass, Path path, LinkOption... options);
632672

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java‎

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
import java.io.File;
1616
import java.io.FileDescriptor;
1717
import java.io.FileInputStream;
18-
import java.io.FileNotFoundException;
1918
import java.io.FileOutputStream;
2019
import java.io.FileReader;
2120
import java.io.FileWriter;
@@ -26,12 +25,12 @@
2625
import java.nio.file.Path;
2726
import java.nio.file.Paths;
2827
import java.nio.file.attribute.UserPrincipal;
29-
import java.util.Scanner;
3028

3129
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.ALWAYS_DENIED;
3230
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
3331

3432
@SuppressForbidden(reason = "Explicitly checking APIs that are forbidden")
33+
@SuppressWarnings("unused") // Called via reflection
3534
class FileCheckActions {
3635

3736
static Path testRootDir = Paths.get(System.getProperty("es.entitlements.testdir"));
@@ -207,21 +206,6 @@ static void fileSetWritableOwner() throws IOException {
207206
readWriteFile().toFile().setWritable(true, false);
208207
}
209208

210-
@EntitlementTest(expectedAccess = PLUGINS)
211-
static void createScannerFile() throws FileNotFoundException {
212-
new Scanner(readFile().toFile());
213-
}
214-
215-
@EntitlementTest(expectedAccess = PLUGINS)
216-
static void createScannerFileWithCharset() throws IOException {
217-
new Scanner(readFile().toFile(), StandardCharsets.UTF_8);
218-
}
219-
220-
@EntitlementTest(expectedAccess = PLUGINS)
221-
static void createScannerFileWithCharsetName() throws FileNotFoundException {
222-
new Scanner(readFile().toFile(), "UTF-8");
223-
}
224-
225209
@EntitlementTest(expectedAccess = PLUGINS)
226210
static void createFileInputStreamFile() throws IOException {
227211
new FileInputStream(readFile().toFile()).close();

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/JavaBaseFileActions.java‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.qa.test;
11+
12+
import org.elasticsearch.core.CheckedRunnable;
13+
import org.elasticsearch.core.SuppressForbidden;
14+
15+
import java.io.FileNotFoundException;
16+
import java.io.IOException;
17+
import java.nio.charset.StandardCharsets;
18+
import java.security.GeneralSecurityException;
19+
import java.security.KeyStore;
20+
import java.util.Scanner;
21+
import java.util.jar.JarFile;
22+
import java.util.zip.ZipException;
23+
import java.util.zip.ZipFile;
24+
25+
import static java.nio.charset.Charset.defaultCharset;
26+
import static java.util.zip.ZipFile.OPEN_DELETE;
27+
import static java.util.zip.ZipFile.OPEN_READ;
28+
import static org.elasticsearch.entitlement.qa.entitled.EntitledActions.createTempFileForWrite;
29+
import static org.elasticsearch.entitlement.qa.test.EntitlementTest.ExpectedAccess.PLUGINS;
30+
import static org.elasticsearch.entitlement.qa.test.FileCheckActions.readFile;
31+
32+
@SuppressForbidden(reason = "Explicitly checking APIs that are forbidden")
33+
@SuppressWarnings("unused") // Called via reflection
34+
public class JavaBaseFileActions {
35+
@EntitlementTest(expectedAccess = PLUGINS)
36+
static void keystore_getInstance_1() throws IOException {
37+
try {
38+
KeyStore.getInstance(readFile().toFile(), new char[0]);
39+
} catch (GeneralSecurityException expected) {
40+
return;
41+
}
42+
throw new AssertionError("Expected an exception");
43+
}
44+
45+
@EntitlementTest(expectedAccess = PLUGINS)
46+
static void keystore_getInstance_2() throws IOException {
47+
try {
48+
KeyStore.LoadStoreParameter loadStoreParameter = () -> null;
49+
KeyStore.getInstance(readFile().toFile(), loadStoreParameter);
50+
} catch (GeneralSecurityException expected) {
51+
return;
52+
}
53+
throw new AssertionError("Expected an exception");
54+
}
55+
56+
@EntitlementTest(expectedAccess = PLUGINS)
57+
static void keystoreBuilder_newInstance() {
58+
try {
59+
KeyStore.Builder.newInstance("", null, readFile().toFile(), null);
60+
} catch (NullPointerException expected) {
61+
return;
62+
}
63+
throw new AssertionError("Expected an exception");
64+
}
65+
66+
@EntitlementTest(expectedAccess = PLUGINS)
67+
static void zipFile_1() throws IOException {
68+
expectZipException(() -> new ZipFile(readFile().toString()).close());
69+
}
70+
71+
@EntitlementTest(expectedAccess = PLUGINS)
72+
static void zipFile_2() throws IOException {
73+
expectZipException(() -> new ZipFile(readFile().toString(), defaultCharset()).close());
74+
}
75+
76+
@EntitlementTest(expectedAccess = PLUGINS)
77+
static void zipFile_3() throws IOException {
78+
expectZipException(() -> new ZipFile(readFile().toFile()).close());
79+
}
80+
81+
@EntitlementTest(expectedAccess = PLUGINS)
82+
static void zipFile_4() throws IOException {
83+
expectZipException(() -> new ZipFile(readFile().toFile(), defaultCharset()).close());
84+
}
85+
86+
@EntitlementTest(expectedAccess = PLUGINS)
87+
static void zipFile_5_readOnly() throws IOException {
88+
expectZipException(() -> new ZipFile(readFile().toFile(), OPEN_READ).close());
89+
}
90+
91+
@EntitlementTest(expectedAccess = PLUGINS)
92+
static void zipFile_5_readAndDelete() throws IOException {
93+
expectZipException(() -> new ZipFile(createTempFileForWrite().toFile(), OPEN_READ | OPEN_DELETE).close());
94+
}
95+
96+
@EntitlementTest(expectedAccess = PLUGINS)
97+
static void zipFile_6_readOnly() throws IOException {
98+
expectZipException(() -> new ZipFile(readFile().toFile(), OPEN_READ, defaultCharset()).close());
99+
}
100+
101+
@EntitlementTest(expectedAccess = PLUGINS)
102+
static void jarFile_1() throws IOException {
103+
expectZipException(() -> new JarFile(readFile().toString()).close());
104+
}
105+
106+
@EntitlementTest(expectedAccess = PLUGINS)
107+
static void jarFile_2() throws IOException {
108+
expectZipException(() -> new JarFile(readFile().toString(), false).close());
109+
}
110+
111+
@EntitlementTest(expectedAccess = PLUGINS)
112+
static void jarFile_3_readOnly() throws IOException {
113+
expectZipException(() -> new JarFile(readFile().toFile(), false, OPEN_READ).close());
114+
}
115+
116+
@EntitlementTest(expectedAccess = PLUGINS)
117+
static void jarFile_3_readAndDelete() throws IOException {
118+
expectZipException(() -> new JarFile(createTempFileForWrite().toFile(), false, OPEN_READ | OPEN_DELETE).close());
119+
}
120+
121+
@EntitlementTest(expectedAccess = PLUGINS)
122+
static void jarFile_4_readOnly() throws IOException {
123+
expectZipException(() -> new JarFile(readFile().toFile(), false, OPEN_READ, Runtime.version()).close());
124+
}
125+
126+
@EntitlementTest(expectedAccess = PLUGINS)
127+
static void jarFile_4_readAndDelete() throws IOException {
128+
expectZipException(() -> new JarFile(createTempFileForWrite().toFile(), false, OPEN_READ | OPEN_DELETE, Runtime.version()).close());
129+
}
130+
131+
@EntitlementTest(expectedAccess = PLUGINS)
132+
static void jarFile_5() throws IOException {
133+
expectZipException(() -> new JarFile(readFile().toFile()).close());
134+
}
135+
136+
@EntitlementTest(expectedAccess = PLUGINS)
137+
static void jarFile_6() throws IOException {
138+
expectZipException(() -> new JarFile(readFile().toFile(), false).close());
139+
}
140+
141+
private static void expectZipException(CheckedRunnable<IOException> action) throws IOException {
142+
try {
143+
action.run();
144+
} catch (ZipException expected) {
145+
return;
146+
}
147+
throw new AssertionError("Expected an exception");
148+
}
149+
150+
@EntitlementTest(expectedAccess = PLUGINS)
151+
static void createScannerFile() throws FileNotFoundException {
152+
new Scanner(readFile().toFile());
153+
}
154+
155+
@EntitlementTest(expectedAccess = PLUGINS)
156+
static void createScannerFileWithCharset() throws IOException {
157+
new Scanner(readFile().toFile(), StandardCharsets.UTF_8);
158+
}
159+
160+
@EntitlementTest(expectedAccess = PLUGINS)
161+
static void createScannerFileWithCharsetName() throws FileNotFoundException {
162+
new Scanner(readFile().toFile(), "UTF-8");
163+
}
164+
165+
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
187187
),
188188
getTestEntries(FileCheckActions.class),
189189
getTestEntries(FileStoreActions.class),
190+
getTestEntries(JavaBaseFileActions.class),
190191
getTestEntries(ManageThreadsActions.class),
191192
getTestEntries(NativeActions.class),
192193
getTestEntries(NioFileSystemActions.class),

0 commit comments

Comments
 (0)