Skip to content

Reduce duplicate and dead entitlements code #121409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jan 31, 2025
Merged

Reduce duplicate and dead entitlements code #121409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4e54c32
Refactor: remove duplicate canWrite methods.
prdoyle Jan 29, 2025
bf9a130
Refactor: just one neverEntitled.
prdoyle Jan 29, 2025
a29c74f
Remove dead code
prdoyle Jan 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 0 additions & 12 deletions ...ntitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTree.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,8 @@

package org.elasticsearch.entitlement.runtime.policy;

import org.elasticsearch.core.SuppressForbidden;
import org.elasticsearch.entitlement.runtime.policy.entitlements.FileEntitlement;

import java.io.File;
import java.nio.file.Path;
import java.util.ArrayList;
import java.util.Arrays;
Expand Down Expand Up @@ -51,20 +49,10 @@ boolean canRead(Path path) {
return checkPath(normalize(path), readPaths);
}

@SuppressForbidden(reason = "Explicitly checking File apis")
boolean canRead(File file) {
return checkPath(normalize(file.toPath()), readPaths);
}

boolean canWrite(Path path) {
return checkPath(normalize(path), writePaths);
}

@SuppressForbidden(reason = "Explicitly checking File apis")
boolean canWrite(File file) {
return checkPath(normalize(file.toPath()), writePaths);
}

private static String normalize(Path path) {
return path.toAbsolutePath().normalize().toString();
}
Expand Down
59 changes: 3 additions & 56 deletions ...entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,23 +169,7 @@ private static void validateEntitlementsPerModule(String sourceName, String modu
}

public void checkStartProcess(Class<?> callerClass) {
neverEntitled(callerClass, "start process");
}

private void neverEntitled(Class<?> callerClass, String operationDescription) {
var requestingClass = requestingClass(callerClass);
if (isTriviallyAllowed(requestingClass)) {
return;
}

throw new NotEntitledException(
Strings.format(
"Not entitled: caller [%s], module [%s], operation [%s]",
callerClass,
requestingClass.getModule() == null ? "<none>" : requestingClass.getModule().getName(),
operationDescription
)
);
neverEntitled(callerClass, () -> "start process");
}

/**
Expand Down Expand Up @@ -241,31 +225,9 @@ public void checkChangeNetworkHandling(Class<?> callerClass) {
checkChangeJVMGlobalState(callerClass);
}

/**
* Check for operations that can access sensitive network information, e.g. secrets, tokens or SSL sessions
*/
public void checkReadSensitiveNetworkInformation(Class<?> callerClass) {
neverEntitled(callerClass, "access sensitive network information");
}

@SuppressForbidden(reason = "Explicitly checking File apis")
public void checkFileRead(Class<?> callerClass, File file) {
var requestingClass = requestingClass(callerClass);
if (isTriviallyAllowed(requestingClass)) {
return;
}

ModuleEntitlements entitlements = getEntitlements(requestingClass);
if (entitlements.fileAccess().canRead(file) == false) {
throw new NotEntitledException(
Strings.format(
"Not entitled: caller [%s], module [%s], entitlement [file], operation [read], path [%s]",
callerClass,
requestingClass.getModule(),
file
)
);
}
checkFileRead(callerClass, file.toPath());
}

public void checkFileRead(Class<?> callerClass, Path path) {
Expand All @@ -289,22 +251,7 @@ public void checkFileRead(Class<?> callerClass, Path path) {

@SuppressForbidden(reason = "Explicitly checking File apis")
public void checkFileWrite(Class<?> callerClass, File file) {
var requestingClass = requestingClass(callerClass);
if (isTriviallyAllowed(requestingClass)) {
return;
}

ModuleEntitlements entitlements = getEntitlements(requestingClass);
if (entitlements.fileAccess().canWrite(file) == false) {
throw new NotEntitledException(
Strings.format(
"Not entitled: caller [%s], module [%s], entitlement [file], operation [write], path [%s]",
callerClass,
requestingClass.getModule(),
file
)
);
}
checkFileWrite(callerClass, file.toPath());
}

public void checkFileWrite(Class<?> callerClass, Path path) {
Expand Down
8 changes: 0 additions & 8 deletions ...lement/src/test/java/org/elasticsearch/entitlement/runtime/policy/PolicyManagerTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,6 @@ public void testRequestingClassFastPath() throws IOException, ClassNotFoundExcep
}

public void testRequestingModuleWithStackWalk() throws IOException, ClassNotFoundException {
var agentsClass = new TestAgent();
var entitlementsClass = makeClassInItsOwnModule(); // A class in the entitlements library itself
var requestingClass = makeClassInItsOwnModule(); // This guy is always the right answer
var instrumentedClass = makeClassInItsOwnModule(); // The class that called the check method
Expand Down Expand Up @@ -365,13 +364,6 @@ private static Class<?> makeClassInItsOwnModule() throws IOException, ClassNotFo
return layer.findLoader("org.example.plugin").loadClass("q.B");
}

private static Class<?> makeClassInItsOwnUnnamedModule() throws IOException, ClassNotFoundException {
final Path home = createTempDir();
Path jar = createMockPluginJar(home);
var layer = createLayerForJar(jar, "org.example.plugin");
return layer.findLoader("org.example.plugin").loadClass("q.B");
}

private static PolicyManager policyManager(String agentsPackageName, Module entitlementsModule) {
return new PolicyManager(createEmptyTestServerPolicy(), List.of(), Map.of(), c -> "test", agentsPackageName, entitlementsModule);
}
Expand Down