Entitlements for thread properties

libs/entitlement/asm-provider/src/main/java/org/elasticsearch/entitlement/instrumentation/impl/InstrumenterImpl.java

@@ -152,14 +152,13 @@ public MethodVisitor visitMethod(int access, String name, String descriptor, Str
             if (isAnnotationPresent == false) {
                 boolean isStatic = (access & ACC_STATIC) != 0;
                 boolean isCtor = "<init>".equals(name);
-                boolean hasReceiver = (isStatic || isCtor) == false;
                 var key = new MethodKey(className, name, Stream.of(Type.getArgumentTypes(descriptor)).map(Type::getInternalName).toList());
                 var instrumentationMethod = checkMethods.get(key);
                 if (instrumentationMethod != null) {
-                    // LOGGER.debug("Will instrument method {}", key);
+                    // System.out.println("Will instrument method " + key);
                     return new EntitlementMethodVisitor(Opcodes.ASM9, mv, isStatic, isCtor, descriptor, instrumentationMethod);
                 } else {
-                    // LOGGER.trace("Will not instrument method {}", key);
+                    // System.out.println("Will not instrument method " + key);
                 }
             }
             return mv;

libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java

@@ -58,7 +58,13 @@
 import java.util.Locale;
 import java.util.Properties;
 import java.util.TimeZone;
+import java.util.concurrent.Executor;
+import java.util.concurrent.ForkJoinPool;
+import java.util.concurrent.ThreadFactory;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
 import java.util.function.Consumer;
+import java.util.function.Predicate;
 
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.HttpsURLConnection;
@@ -507,4 +513,121 @@ public interface EntitlementChecker {
 
     // file system providers
     void checkNewInputStream(Class<?> callerClass, FileSystemProvider that, Path path, OpenOption... options);
+
+    ////////////////////
+    //
+    // Setting thread properties
+    //
+
+    void check$java_lang_Thread$setContextClassLoader(Class<?> callerClass, Thread thread, ClassLoader cl);
+
+    void check$java_lang_Thread$(Class<?> callerClass);
+
+    void check$java_lang_Thread$(Class<?> callerClass, Runnable task);
+
+    void check$java_lang_Thread$(Class<?> callerClass, ThreadGroup group, Runnable task);
+
+    void check$java_lang_Thread$(Class<?> callerClass, String name);
+
+    // TODO: Causes mysterious test failure even if the check does nothing
+    // void check$java_lang_Thread$(Class<?> callerClass, ThreadGroup group, String name);
+
+    void check$java_lang_Thread$(Class<?> callerClass, Runnable task, String name);
+
+    void check$java_lang_Thread$(Class<?> callerClass, ThreadGroup group, Runnable task, String name);
+
+    void check$java_lang_Thread$(Class<?> callerClass, ThreadGroup group, Runnable task, String name, long stackSize);
+
+    void check$java_lang_Thread$(
+        Class<?> callerClass,
+        ThreadGroup group,
+        Runnable task,
+        String name,
+        long stackSize,
+        boolean inheritInheritableThreadLocals
+    );
+
+    void check$java_lang_ThreadBuilders$PlatformThreadBuilder$unstarted(Class<?> callerClass, Thread.Builder builder, Runnable task);
+
+    void check$java_lang_ThreadBuilders$PlatformThreadFactory$newThread(Class<?> callerClass, ThreadFactory threadFactory, Runnable task);
+
+    void check$java_lang_ThreadGroup$(Class<?> callerClass, String name);
+
+    void check$java_lang_ThreadGroup$(Class<?> callerClass, ThreadGroup parent, String name);
+
+    void check$java_util_concurrent_ForkJoinPool$(Class<?> callerClass);
+
+    void check$java_util_concurrent_ForkJoinPool$(Class<?> callerClass, int parallelism);
+
+    void check$java_util_concurrent_ForkJoinPool$(
+        Class<?> callerClass,
+        int parallelism,
+        ForkJoinPool.ForkJoinWorkerThreadFactory factory,
+        Thread.UncaughtExceptionHandler handler,
+        boolean asyncMode
+    );
+
+    void check$java_util_concurrent_ForkJoinPool$(
+        Class<?> callerClass,
+        int parallelism,
+        ForkJoinPool.ForkJoinWorkerThreadFactory factory,
+        Thread.UncaughtExceptionHandler handler,
+        boolean asyncMode,
+        int corePoolSize,
+        int maximumPoolSize,
+        int minimumRunnable,
+        Predicate<? super ForkJoinPool> saturate,
+        long keepAliveTime,
+        TimeUnit unit
+    );
+
+    void check$java_util_concurrent_ForkJoinPool$DefaultForkJoinWorkerThreadFactory$newThread(
+        Class<?> callerClass,
+        ForkJoinPool.ForkJoinWorkerThreadFactory factory,
+        ForkJoinPool pool
+    );
+
+    void check$java_util_concurrent_ForkJoinWorkerThread$(
+        Class<?> callerClass,
+        ThreadGroup group,
+        ForkJoinPool pool,
+        boolean preserveThreadLocals
+    );
+
+    void check$java_util_concurrent_ForkJoinWorkerThread$(Class<?> callerClass, ForkJoinPool pool);
+
+    void check$java_lang_Thread$setDaemon(Class<?> callerClass, Thread thread, boolean on);
+
+    void check$java_lang_ThreadGroup$setDaemon(Class<?> callerClass, ThreadGroup threadGroup, boolean daemon);
+
+    void check$java_util_concurrent_ForkJoinPool$setParallelism(Class<?> callerClass, ForkJoinPool forkJoinPool, int size);
+
+    void check$java_lang_Thread$interrupt(Class<?> callerClass, Thread thread);
+
+    void check$java_lang_ThreadGroup$interrupt(Class<?> callerClass, ThreadGroup threadGroup);
+
+    void check$java_util_concurrent_ForkJoinPool$close(Class<?> callerClass, ForkJoinPool forkJoinPool);
+
+    void check$java_util_concurrent_ForkJoinPool$shutdown(Class<?> callerClass, ForkJoinPool forkJoinPool);
+
+    void check$java_util_concurrent_ForkJoinPool$shutdownNow(Class<?> callerClass, ForkJoinPool forkJoinPool);
+
+    void check$java_util_concurrent_ThreadPerTaskExecutor$close(Class<?> callerClass, Executor executor);
+
+    void check$java_util_concurrent_ThreadPerTaskExecutor$shutdown(Class<?> callerClass, Executor executor);
+
+    void check$java_util_concurrent_ThreadPerTaskExecutor$shutdownNow(Class<?> callerClass, Executor executor);
+
+    void check$java_util_concurrent_ThreadPoolExecutor$shutdown(Class<?> callerClass, ThreadPoolExecutor threadPoolExecutor);
+
+    void check$java_util_concurrent_ThreadPoolExecutor$shutdownNow(Class<?> callerClass, ThreadPoolExecutor threadPoolExecutor);
+
+    void check$java_lang_Thread$setName(Class<?> callerClass, Thread thread, String name);
+
+    void check$java_lang_Thread$setPriority(Class<?> callerClass, Thread thread, int newPriority);
+
+    void check$java_lang_Thread$setUncaughtExceptionHandler(Class<?> callerClass, Thread thread, Thread.UncaughtExceptionHandler ueh);
+
+    void check$java_lang_ThreadGroup$setMaxPriority(Class<?> callerClass, ThreadGroup threadGroup, int pri);
+
 }

libs/entitlement/qa/entitled-plugin/src/main/java/org/elasticsearch/entitlement/qa/entitled/EntitledActions.java

@@ -9,8 +9,6 @@
 
 package org.elasticsearch.entitlement.qa.entitled;
 
-import org.elasticsearch.core.SuppressForbidden;
-
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -19,9 +17,8 @@
 public final class EntitledActions {
     private EntitledActions() {}
 
-    @SuppressForbidden(reason = "Exposes forbidden APIs for testing purposes")
-    static void System_clearProperty(String key) {
-        System.clearProperty(key);
+    public static Thread newThread(Runnable runnable, String name) {
+        return new Thread(runnable, name);
     }
 
     public static UserPrincipal getFileOwner(Path path) throws IOException {

libs/entitlement/qa/entitled-plugin/src/main/java/org/elasticsearch/entitlement/qa/entitled/EntitledPlugin.java

@@ -15,7 +15,9 @@
 import org.elasticsearch.plugins.ExtensiblePlugin;
 import org.elasticsearch.plugins.Plugin;
 
-import static org.elasticsearch.entitlement.qa.entitled.EntitledActions.System_clearProperty;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import static org.elasticsearch.entitlement.qa.entitled.EntitledActions.newThread;
 
 public class EntitledPlugin extends Plugin implements ExtensiblePlugin {
 
@@ -28,11 +30,19 @@ public static void selfTest() {
         selfTestNotEntitled();
     }
 
-    private static final String SELF_TEST_PROPERTY = "org.elasticsearch.entitlement.qa.selfTest";
-
     private static void selfTestEntitled() {
         logger.debug("selfTestEntitled");
-        System_clearProperty(SELF_TEST_PROPERTY);
+        AtomicBoolean threadRan = new AtomicBoolean(false);
+        try {
+            Thread testThread = newThread(() -> threadRan.set(true), "testThread");
+            testThread.start();
+            testThread.join();
+        } catch (InterruptedException e) {
+            throw new AssertionError(e);
+        }
+        if (threadRan.get() == false) {
+            throw new AssertionError("Self-test thread did not run");
+        }
     }
 
     private static void selfTestNotEntitled() {

libs/entitlement/qa/entitled-plugin/src/main/plugin-metadata/entitlement-policy.yaml

@@ -1,4 +1,2 @@
 org.elasticsearch.entitlement.qa.entitled:
-  - write_system_properties:
-      properties:
-        - org.elasticsearch.entitlement.qa.selfTest
+  - create_thread