Skip to content

Use dynamic policy for entitled test plugin #121852

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Feb 7, 2025
Merged

Use dynamic policy for entitled test plugin #121852

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
952d2b4
Use dynamic policy for entitled test plugin
rjernst Feb 5, 2025
6c70eb7
[CI] Auto commit changes from spotless
Feb 5, 2025
5ec0602
Merge branch 'main' into entitlements/dynamic_entitled_policy
rjernst Feb 6, 2025
51f1447
Merge branch 'main' into entitlements/dynamic_entitled_policy
rjernst Feb 7, 2025
65c0f04
fix signature
rjernst Feb 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions ...tlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@
import java.nio.channels.SocketChannel;
import java.nio.channels.spi.SelectorProvider;
import java.nio.charset.Charset;
import java.nio.file.LinkOption;
import java.nio.file.OpenOption;
import java.nio.file.Path;
import java.nio.file.attribute.UserPrincipal;
Expand Down Expand Up @@ -514,6 +515,8 @@ public interface EntitlementChecker {
void check$java_util_Scanner$(Class<?> callerClass, File source, Charset charset);

// nio
void check$java_nio_file_Files$$getOwner(Class<?> callerClass, Path path, LinkOption... options);

void check$java_nio_file_Files$$probeContentType(Class<?> callerClass, Path path);

void check$java_nio_file_Files$$setOwner(Class<?> callerClass, Path path, UserPrincipal principal);
Expand Down
4 changes: 0 additions & 4 deletions libs/entitlement/qa/entitled-plugin/src/main/plugin-metadata/entitlement-policy.yaml
View file
Open in desktop

This file was deleted.

5 changes: 5 additions & 0 deletions ...ent-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,11 @@ static void createFileOutputStreamFileWithAppend() throws IOException {
new FileOutputStream(readWriteFile().toFile(), false).close();
}

@EntitlementTest(expectedAccess = PLUGINS)
static void filesGetOwner() throws IOException {
Files.getOwner(readFile());
}

@EntitlementTest(expectedAccess = PLUGINS)
static void filesProbeContentType() throws IOException {
Files.probeContentType(readFile());
Expand Down
3 changes: 2 additions & 1 deletion ...ent/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/AbstractEntitlementsIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@

import org.elasticsearch.client.Request;
import org.elasticsearch.client.Response;
import org.elasticsearch.entitlement.qa.EntitlementsTestRule.PolicyBuilder;
import org.elasticsearch.test.rest.ESRestTestCase;

import java.io.IOException;
Expand All @@ -22,7 +23,7 @@

public abstract class AbstractEntitlementsIT extends ESRestTestCase {

static final EntitlementsTestRule.PolicyBuilder ALLOWED_TEST_ENTITLEMENTS = (builder, tempDir) -> {
static final PolicyBuilder ALLOWED_TEST_ENTITLEMENTS = (builder, tempDir) -> {
builder.value("create_class_loader");
builder.value("set_https_connection_properties");
builder.value("inbound_network");
Expand Down
61 changes: 40 additions & 21 deletions ...ement/qa/src/javaRestTest/java/org/elasticsearch/entitlement/qa/EntitlementsTestRule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,9 +26,27 @@
import java.io.UncheckedIOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.List;
import java.util.Map;

class EntitlementsTestRule implements TestRule {

// entitlements that test methods may use, see EntitledActions
private static final PolicyBuilder ENTITLED_POLICY = (builder, tempDir) -> {
builder.value(Map.of("write_system_properties", Map.of("properties", List.of("org.elasticsearch.entitlement.qa.selfTest"))));
builder.value(
Map.of(
"files",
List.of(
Map.of("path", tempDir.resolve("read_dir"), "mode", "read"),
Map.of("path", tempDir.resolve("read_write_dir"), "mode", "read_write"),
Map.of("path", tempDir.resolve("read_file"), "mode", "read"),
Map.of("path", tempDir.resolve("read_write_file"), "mode", "read_write")
)
)
);
};

interface PolicyBuilder {
void build(XContentBuilder builder, Path tempDir) throws IOException;
}
Expand All @@ -51,7 +69,7 @@ protected void before() throws Throwable {
}
};
cluster = ElasticsearchCluster.local()
.module("entitled")
.module("entitled", spec -> buildEntitlements(spec, "org.elasticsearch.entitlement.qa.entitled", ENTITLED_POLICY))
.module("entitlement-test-plugin", spec -> setupEntitlements(spec, modular, policyBuilder))
.systemProperty("es.entitlements.enabled", "true")
.systemProperty("es.entitlements.testdir", () -> testDir.getRoot().getAbsolutePath())
Expand All @@ -65,29 +83,30 @@ public Statement apply(Statement statement, Description description) {
return ruleChain.apply(statement, description);
}

private void setupEntitlements(PluginInstallSpec spec, boolean modular, PolicyBuilder policyBuilder) {
String moduleName = modular ? "org.elasticsearch.entitlement.qa.test" : "ALL-UNNAMED";
if (policyBuilder != null) {
spec.withEntitlementsOverride(old -> {
try {
try (var builder = YamlXContent.contentBuilder()) {
builder.startObject();
builder.field(moduleName);
builder.startArray();
private void buildEntitlements(PluginInstallSpec spec, String moduleName, PolicyBuilder policyBuilder) {
spec.withEntitlementsOverride(old -> {
try (var builder = YamlXContent.contentBuilder()) {
builder.startObject();
builder.field(moduleName);
builder.startArray();

policyBuilder.build(builder, testDir.getRoot().toPath());
builder.endArray();
builder.endObject();
policyBuilder.build(builder, testDir.getRoot().toPath());
builder.endArray();
builder.endObject();

String policy = Strings.toString(builder);
System.out.println("Using entitlement policy:\n" + policy);
return Resource.fromString(policy);
}
String policy = Strings.toString(builder);
System.out.println("Using entitlement policy for module " + moduleName + ":\n" + policy);
return Resource.fromString(policy);
} catch (IOException e) {
throw new UncheckedIOException(e);
}
});
}

} catch (IOException e) {
throw new UncheckedIOException(e);
}
});
private void setupEntitlements(PluginInstallSpec spec, boolean modular, PolicyBuilder policyBuilder) {
Copy link
Contributor

@prdoyle prdoyle Feb 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The distinction between the names setupEntitlements and buildEntitlements is a bit subtle... but these are private helpers, so it's not too hard to just look at them and see what they do.

String moduleName = modular ? "org.elasticsearch.entitlement.qa.test" : "ALL-UNNAMED";
if (policyBuilder != null) {
buildEntitlements(spec, moduleName, policyBuilder);
}

if (modular == false) {
Expand Down
6 changes: 6 additions & 0 deletions .../main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@
import java.nio.channels.SocketChannel;
import java.nio.channels.spi.SelectorProvider;
import java.nio.charset.Charset;
import java.nio.file.LinkOption;
import java.nio.file.OpenOption;
import java.nio.file.Path;
import java.nio.file.attribute.UserPrincipal;
Expand Down Expand Up @@ -976,6 +977,11 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector

// nio

@Override
public void check$java_nio_file_Files$$getOwner(Class<?> callerClass, Path path, LinkOption... options) {
policyManager.checkFileRead(callerClass, path);
}

@Override
public void check$java_nio_file_Files$$probeContentType(Class<?> callerClass, Path path) {
policyManager.checkFileRead(callerClass, path);
Expand Down