From 7708ed6519f1cdd946eccf905b698db76aefcb37 Mon Sep 17 00:00:00 2001 From: Moritz Mack Date: Mon, 17 Feb 2025 09:47:34 +0100 Subject: [PATCH 1/2] [Entitlements] Add missing file entitlements for server --- .../EntitlementInitialization.java | 23 +++++++++++++++++-- muted-tests.yml | 8 ------- 2 files changed, 21 insertions(+), 10 deletions(-) diff --git a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java index 97b7eed01cc2c..d235b4315a24d 100644 --- a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java +++ b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java @@ -59,6 +59,7 @@ import java.util.stream.Stream; import java.util.stream.StreamSupport; +import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ; import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ_WRITE; /** @@ -149,8 +150,26 @@ private static PolicyManager createPolicyManager() { new ManageThreadsEntitlement(), new FilesEntitlement( List.of( - FilesEntitlement.FileData.ofPath(EntitlementBootstrap.bootstrapArgs().tempDir(), READ_WRITE), - FilesEntitlement.FileData.ofPath(EntitlementBootstrap.bootstrapArgs().logsDir(), READ_WRITE) + FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE), + FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE), + // OS release on Linux + FileData.ofPath(Path.of("/etc/os-release"), READ), + FileData.ofPath(Path.of("/etc/system-release"), READ), + FileData.ofPath(Path.of("/usr/lib/os-release"), READ), + // read max virtual memory areas + FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ), + FileData.ofPath(Path.of("/proc/meminfo"), READ), + // load averages on Linux + FileData.ofPath(Path.of("/proc/loadavg"), READ), + // control group stats on Linux. cgroup v2 stats are in an unpredicable + // location under `/sys/fs/cgroup`, so unfortunately we have to allow + // read access to the entire directory hierarchy. + FileData.ofPath(Path.of("/proc/self/cgroup"), READ), + FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ), + // // io stats on Linux + FileData.ofPath(Path.of("/proc/self/mountinfo"), READ), + FileData.ofPath(Path.of("/proc/diskstats"), READ), + FileData.ofPath(Path.of("/etc/os-release"), READ) ) ) ) diff --git a/muted-tests.yml b/muted-tests.yml index 66d6bf1d45085..78eddc1a09470 100644 --- a/muted-tests.yml +++ b/muted-tests.yml @@ -338,14 +338,6 @@ tests: - class: org.elasticsearch.entitlement.runtime.policy.PolicyParserFailureTests method: testEntitlementAbsolutePathWhenRelative issue: https://github.com/elastic/elasticsearch/issues/122666 -- class: org.elasticsearch.entitlement.qa.EntitlementsAllowedNonModularIT - issue: https://github.com/elastic/elasticsearch/issues/122568 -- class: org.elasticsearch.entitlement.qa.EntitlementsDeniedIT - issue: https://github.com/elastic/elasticsearch/issues/122566 -- class: org.elasticsearch.entitlement.qa.EntitlementsDeniedNonModularIT - issue: https://github.com/elastic/elasticsearch/issues/122569 -- class: org.elasticsearch.entitlement.qa.EntitlementsAllowedIT - issue: https://github.com/elastic/elasticsearch/issues/122680 - class: org.elasticsearch.smoketest.DocsClientYamlTestSuiteIT method: test {yaml=reference/snapshot-restore/apis/get-snapshot-api/line_408} issue: https://github.com/elastic/elasticsearch/issues/122681 From 0debe49413bf4539966ec799f13cf27637e4287c Mon Sep 17 00:00:00 2001 From: Moritz Mack Date: Mon, 17 Feb 2025 09:57:41 +0100 Subject: [PATCH 2/2] fix --- .../entitlement/initialization/EntitlementInitialization.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java index d235b4315a24d..328a6eae265ce 100644 --- a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java +++ b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java @@ -168,8 +168,7 @@ private static PolicyManager createPolicyManager() { FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ), // // io stats on Linux FileData.ofPath(Path.of("/proc/self/mountinfo"), READ), - FileData.ofPath(Path.of("/proc/diskstats"), READ), - FileData.ofPath(Path.of("/etc/os-release"), READ) + FileData.ofPath(Path.of("/proc/diskstats"), READ) ) ) )