Skip to content

Commit fa92815

Browse files
moschemosche
committed
Fix entitlement checks for relative links
1 parent b1c75d1 commit fa92815

File tree

6 files changed

+74
-16
lines changed

6 files changed

+74
-16
lines changed

‎libs/entitlement/qa/entitled-plugin/src/main/java/org/elasticsearch/entitlement/qa/entitled/EntitledActions.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,19 @@ public static Path createTempSymbolicLink() throws IOException {
6060
return Files.createSymbolicLink(readDir().resolve("entitlements-link-" + random.nextLong()), readWriteDir());
6161
}
6262

63+
public static Path createK8sLikeMount() throws IOException {
64+
Path baseDir = readDir().resolve("k8s");
65+
var versionedDir = Files.createDirectories(baseDir.resolve("..version"));
66+
var actualFileMount = Files.createFile(versionedDir.resolve("mount-" + random.nextLong() + ".tmp"));
67+
68+
var dataDir = Files.createSymbolicLink(baseDir.resolve("..data"), versionedDir.getFileName());
69+
// mount-0.tmp -> ..data/mount-0.tmp -> ..version/mount-0.tmp
70+
return Files.createSymbolicLink(
71+
baseDir.resolve(actualFileMount.getFileName()),
72+
dataDir.getFileName().resolve(actualFileMount.getFileName())
73+
);
74+
}
75+
6376
public static URLConnection createHttpURLConnection() throws IOException {
6477
return URI.create("http://127.0.0.1:12345/").toURL().openConnection();
6578
}
@@ -76,4 +89,5 @@ public static URLConnection createFileURLConnection() throws IOException {
7689
var fileUrl = createTempFileForWrite().toUri().toURL();
7790
return fileUrl.openConnection();
7891
}
92+
7993
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/NioFilesActions.java‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,16 @@ static void checkFilesCreateSymbolicLink() throws IOException {
140140
}
141141
}
142142

143+
@EntitlementTest(expectedAccess = PLUGINS)
144+
static void checkFilesCreateRelativeSymbolicLink() throws IOException {
145+
var directory = EntitledActions.createTempDirectoryForWrite();
146+
try {
147+
Files.createSymbolicLink(directory.resolve("link"), Path.of("target"));
148+
} catch (UnsupportedOperationException | FileSystemException e) {
149+
// OK not to implement symbolic link in the filesystem
150+
}
151+
}
152+
143153
@EntitlementTest(expectedAccess = PLUGINS)
144154
static void checkFilesCreateLink() throws IOException {
145155
var directory = EntitledActions.createTempDirectoryForWrite();
@@ -150,6 +160,17 @@ static void checkFilesCreateLink() throws IOException {
150160
}
151161
}
152162

163+
@EntitlementTest(expectedAccess = PLUGINS)
164+
static void checkFilesCreateRelativeLink() throws IOException {
165+
var directory = EntitledActions.createTempDirectoryForWrite();
166+
var target = directory.resolve("target");
167+
try {
168+
Files.createLink(directory.resolve("link"), Path.of("target"));
169+
} catch (UnsupportedOperationException | FileSystemException e) {
170+
// OK not to implement symbolic link in the filesystem
171+
}
172+
}
173+
153174
@EntitlementTest(expectedAccess = PLUGINS)
154175
static void checkFilesDelete() throws IOException {
155176
var file = EntitledActions.createTempFileForWrite();

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/PathActions.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99

1010
package org.elasticsearch.entitlement.qa.test;
1111

12+
import org.elasticsearch.entitlement.qa.entitled.EntitledActions;
13+
1214
import java.io.IOException;
1315
import java.nio.file.FileSystems;
1416
import java.nio.file.LinkOption;
@@ -24,6 +26,11 @@ static void checkToRealPath() throws IOException {
2426
FileCheckActions.readFile().toRealPath();
2527
}
2628

29+
@EntitlementTest(expectedAccess = PLUGINS)
30+
static void checkToRealPathWithK8sLikeMount() throws IOException, Exception {
31+
EntitledActions.createK8sLikeMount().toRealPath();
32+
}
33+
2734
@EntitlementTest(expectedAccess = PLUGINS)
2835
static void checkToRealPathNoFollow() throws IOException {
2936
FileCheckActions.readFile().toRealPath(LinkOption.NOFOLLOW_LINKS);

‎libs/entitlement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsTestRule.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ class EntitlementsTestRule implements TestRule {
4040
"files",
4141
List.of(
4242
Map.of("path", tempDir.resolve("read_dir"), "mode", "read_write"),
43+
Map.of("path", tempDir.resolve("read_dir").resolve("k8s").resolve("..data"), "mode", "read", "exclusive", true),
4344
Map.of("path", tempDir.resolve("read_write_dir"), "mode", "read_write"),
4445
Map.of("path", tempDir.resolve("read_file"), "mode", "read"),
4546
Map.of("path", tempDir.resolve("read_write_file"), "mode", "read_write")

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
import java.io.FileDescriptor;
2020
import java.io.FileFilter;
2121
import java.io.FilenameFilter;
22-
import java.io.IOException;
2322
import java.io.InputStream;
2423
import java.io.OutputStream;
2524
import java.io.PrintStream;
@@ -71,7 +70,6 @@
7170
import java.nio.file.FileStore;
7271
import java.nio.file.FileVisitOption;
7372
import java.nio.file.FileVisitor;
74-
import java.nio.file.Files;
7573
import java.nio.file.LinkOption;
7674
import java.nio.file.OpenOption;
7775
import java.nio.file.Path;
@@ -2062,16 +2060,21 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector
20622060
policyManager.checkCreateTempFile(callerClass);
20632061
}
20642062

2063+
private static Path resolveLinkTarget(Path path, Path target) {
2064+
var parent = path.getParent();
2065+
return parent == null ? target : parent.resolve(target);
2066+
}
2067+
20652068
@Override
20662069
public void check$java_nio_file_Files$$createSymbolicLink(Class<?> callerClass, Path link, Path target, FileAttribute<?>... attrs) {
2067-
policyManager.checkFileRead(callerClass, target);
20682070
policyManager.checkFileWrite(callerClass, link);
2071+
policyManager.checkFileRead(callerClass, resolveLinkTarget(link, target));
20692072
}
20702073

20712074
@Override
20722075
public void check$java_nio_file_Files$$createLink(Class<?> callerClass, Path link, Path existing) {
2073-
policyManager.checkFileRead(callerClass, existing);
20742076
policyManager.checkFileWrite(callerClass, link);
2077+
policyManager.checkFileRead(callerClass, resolveLinkTarget(link, existing));
20752078
}
20762079

20772080
@Override
@@ -2560,13 +2563,13 @@ public void checkCreateDirectory(Class<?> callerClass, FileSystemProvider that,
25602563
@Override
25612564
public void checkCreateSymbolicLink(Class<?> callerClass, FileSystemProvider that, Path link, Path target, FileAttribute<?>... attrs) {
25622565
policyManager.checkFileWrite(callerClass, link);
2563-
policyManager.checkFileRead(callerClass, target);
2566+
policyManager.checkFileRead(callerClass, resolveLinkTarget(link, target));
25642567
}
25652568

25662569
@Override
25672570
public void checkCreateLink(Class<?> callerClass, FileSystemProvider that, Path link, Path existing) {
25682571
policyManager.checkFileWrite(callerClass, link);
2569-
policyManager.checkFileRead(callerClass, existing);
2572+
policyManager.checkFileRead(callerClass, resolveLinkTarget(link, existing));
25702573
}
25712574

25722575
@Override
@@ -2760,14 +2763,7 @@ public void checkPathToRealPath(Class<?> callerClass, Path that, LinkOption... o
27602763
followLinks = false;
27612764
}
27622765
}
2763-
if (followLinks) {
2764-
try {
2765-
policyManager.checkFileRead(callerClass, Files.readSymbolicLink(that));
2766-
} catch (IOException | UnsupportedOperationException e) {
2767-
// that is not a link, or unrelated IOException or unsupported
2768-
}
2769-
}
2770-
policyManager.checkFileRead(callerClass, that);
2766+
policyManager.checkFileRead(callerClass, that, followLinks);
27712767
}
27722768

27732769
@Override

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
import org.elasticsearch.logging.Logger;
3232

3333
import java.io.File;
34+
import java.io.IOException;
3435
import java.lang.StackWalker.StackFrame;
3536
import java.lang.module.ModuleFinder;
3637
import java.lang.module.ModuleReference;
@@ -325,6 +326,10 @@ private static boolean isPathOnDefaultFilesystem(Path path) {
325326
}
326327

327328
public void checkFileRead(Class<?> callerClass, Path path) {
329+
checkFileRead(callerClass, path, false);
330+
}
331+
332+
public void checkFileRead(Class<?> callerClass, Path path, boolean followLinks) {
328333
if (isPathOnDefaultFilesystem(path) == false) {
329334
return;
330335
}
@@ -334,14 +339,28 @@ public void checkFileRead(Class<?> callerClass, Path path) {
334339
}
335340

336341
ModuleEntitlements entitlements = getEntitlements(requestingClass);
337-
if (entitlements.fileAccess().canRead(path) == false) {
342+
343+
Path realPath = null;
344+
boolean canRead = entitlements.fileAccess().canRead(path);
345+
if (canRead && followLinks) {
346+
try {
347+
realPath = path.toRealPath();
348+
} catch (IOException e) {
349+
// target not found or other IO error
350+
}
351+
if (realPath != null && realPath.equals(path) == false) {
352+
canRead = entitlements.fileAccess().canRead(realPath);
353+
}
354+
}
355+
356+
if (canRead == false) {
338357
notEntitled(
339358
Strings.format(
340359
"Not entitled: component [%s], module [%s], class [%s], entitlement [file], operation [read], path [%s]",
341360
entitlements.componentName(),
342361
requestingClass.getModule().getName(),
343362
requestingClass,
344-
path
363+
realPath == null ? path : String.format("%s -> %s", path, realPath)
345364
),
346365
callerClass
347366
);

0 commit comments

Comments
 (0)