Skip to content

[Entitlements] Add file read entitlement check to library load functions #122494

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ldematte merged 2 commits into from
Feb 14, 2025
Merged

[Entitlements] Add file read entitlement check to library load functions #122494

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
afbf3e6
Add file read entitlement check to library load functions
ldematte Feb 13, 2025
e9e859d
Merge branch 'main' into entitlements/read-entitlement-library-load
ldematte Feb 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .../src/main/java/org/elasticsearch/entitlement/qa/test/LoadNativeLibrariesCheckActions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,15 @@
class LoadNativeLibrariesCheckActions {
static void runtimeLoad() {
try {
Runtime.getRuntime().load("libSomeLibFile.so");
Runtime.getRuntime().load(FileCheckActions.readDir().resolve("libSomeLibFile.so").toString());
} catch (UnsatisfiedLinkError ignored) {
// The library does not exist, so we expect to fail loading it
}
}

static void systemLoad() {
try {
System.load("libSomeLibFile.so");
System.load(FileCheckActions.readDir().resolve("libSomeLibFile.so").toString());
} catch (UnsatisfiedLinkError ignored) {
// The library does not exist, so we expect to fail loading it
}
Expand Down
2 changes: 1 addition & 1 deletion ...lement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/NativeActions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ static void memorySegmentReinterpretWithSizeAndCleanup() {
@EntitlementTest(expectedAccess = PLUGINS)
static void symbolLookupWithPath() {
try {
SymbolLookup.libraryLookup(Path.of("/foo/bar/libFoo.so"), Arena.ofAuto());
SymbolLookup.libraryLookup(FileCheckActions.readDir().resolve("libFoo.so"), Arena.ofAuto());
} catch (IllegalArgumentException e) {
// IllegalArgumentException is thrown if path does not point to a valid library (and it does not)
}
Expand Down
6 changes: 3 additions & 3 deletions .../main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -835,7 +835,7 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector

@Override
public void check$java_lang_Runtime$load(Class<?> callerClass, Runtime that, String filename) {
// TODO: check filesystem entitlement READ
policyManager.checkFileRead(callerClass, Path.of(filename));
policyManager.checkLoadingNativeLibraries(callerClass);
}

Expand All @@ -846,7 +846,7 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector

@Override
public void check$java_lang_System$$load(Class<?> callerClass, String filename) {
// TODO: check filesystem entitlement READ
policyManager.checkFileRead(callerClass, Path.of(filename));
policyManager.checkLoadingNativeLibraries(callerClass);
}

Expand Down Expand Up @@ -930,7 +930,7 @@ public void checkSelectorProviderInheritedChannel(Class<?> callerClass, Selector

@Override
public void check$java_lang_foreign_SymbolLookup$$libraryLookup(Class<?> callerClass, Path path, Arena arena) {
// TODO: check filesystem entitlement READ
policyManager.checkFileRead(callerClass, path);
policyManager.checkLoadingNativeLibraries(callerClass);
}

Expand Down