Add an exclusive parameter for files entitlements

libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java

@@ -152,8 +152,8 @@ private static PolicyManager createPolicyManager() {
                     new CreateClassLoaderEntitlement(),
                     new FilesEntitlement(
                         List.of(
-                            FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE),
-                            FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)
+                            FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE, false),
+                            FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false)
                         )
                     )
                 )
@@ -172,29 +172,29 @@ private static PolicyManager createPolicyManager() {
                     new FilesEntitlement(
                         List.of(
                             // Base ES directories
-                            FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE),
-                            FileData.ofPath(bootstrapArgs.configDir(), READ),
-                            FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
-                            FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE),
-                            FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE),
+                            FileData.ofPath(bootstrapArgs.tempDir(), READ_WRITE, false),
+                            FileData.ofPath(bootstrapArgs.configDir(), READ, false),
+                            FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE, false),
+                            FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false),
+                            FileData.ofPath(bootstrapArgs.repoDirResolver().apply(""), READ_WRITE, false),
 
                             // OS release on Linux
-                            FileData.ofPath(Path.of("/etc/os-release"), READ),
-                            FileData.ofPath(Path.of("/etc/system-release"), READ),
-                            FileData.ofPath(Path.of("/usr/lib/os-release"), READ),
+                            FileData.ofPath(Path.of("/etc/os-release"), READ, false),
+                            FileData.ofPath(Path.of("/etc/system-release"), READ, false),
+                            FileData.ofPath(Path.of("/usr/lib/os-release"), READ, false),
                             // read max virtual memory areas
-                            FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ),
-                            FileData.ofPath(Path.of("/proc/meminfo"), READ),
+                            FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ, false),
+                            FileData.ofPath(Path.of("/proc/meminfo"), READ, false),
                             // load averages on Linux
-                            FileData.ofPath(Path.of("/proc/loadavg"), READ),
+                            FileData.ofPath(Path.of("/proc/loadavg"), READ, false),
                             // control group stats on Linux. cgroup v2 stats are in an unpredicable
                             // location under `/sys/fs/cgroup`, so unfortunately we have to allow
                             // read access to the entire directory hierarchy.
-                            FileData.ofPath(Path.of("/proc/self/cgroup"), READ),
-                            FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ),
+                            FileData.ofPath(Path.of("/proc/self/cgroup"), READ, false),
+                            FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ, false),
                             // // io stats on Linux
-                            FileData.ofPath(Path.of("/proc/self/mountinfo"), READ),
-                            FileData.ofPath(Path.of("/proc/diskstats"), READ)
+                            FileData.ofPath(Path.of("/proc/self/mountinfo"), READ, false),
+                            FileData.ofPath(Path.of("/proc/diskstats"), READ, false)
                         )
                     )
                 )
@@ -208,23 +208,25 @@ private static PolicyManager createPolicyManager() {
                     new ManageThreadsEntitlement(),
                     new FilesEntitlement(
                         List.of(
-                            FileData.ofPath(bootstrapArgs.configDir(), READ),
-                            FileData.ofPath(bootstrapArgs.tempDir(), READ),
-                            FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)
+                            FileData.ofPath(bootstrapArgs.configDir(), READ, false),
+                            FileData.ofPath(bootstrapArgs.tempDir(), READ, false),
+                            FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false)
                         )
                     )
                 )
             ),
             new Scope(
                 "org.apache.lucene.misc",
-                List.of(new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE))))
+                List.of(
+                    new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false)))
+                )
             ),
             new Scope("org.apache.logging.log4j.core", List.of(new ManageThreadsEntitlement())),
             new Scope(
                 "org.elasticsearch.nativeaccess",
                 List.of(
                     new LoadNativeLibrariesEntitlement(),
-                    new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE)))
+                    new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), FilesEntitlement.BaseDir.DATA, READ_WRITE, false)))
                 )
             )
         );
@@ -233,11 +235,17 @@ private static PolicyManager createPolicyManager() {
         if (trustStorePath != null) {
             Collections.addAll(
                 serverScopes,
-                new Scope("org.bouncycastle.fips.tls", List.of(new FilesEntitlement(List.of(FileData.ofPath(trustStorePath, READ))))),
+                new Scope(
+                    "org.bouncycastle.fips.tls",
+                    List.of(new FilesEntitlement(List.of(FileData.ofPath(trustStorePath, READ, false))))
+                ),
                 new Scope(
                     "org.bouncycastle.fips.core",
                     // read to lib dir is required for checksum validation
-                    List.of(new FilesEntitlement(List.of(FileData.ofPath(bootstrapArgs.libDir(), READ))), new ManageThreadsEntitlement())
+                    List.of(
+                        new FilesEntitlement(List.of(FileData.ofPath(bootstrapArgs.libDir(), READ, false))),
+                        new ManageThreadsEntitlement()
+                    )
                 )
             );
         }
@@ -251,8 +259,8 @@ private static PolicyManager createPolicyManager() {
             new ManageThreadsEntitlement(),
             new FilesEntitlement(
                 List.of(
-                    FileData.ofPath(Path.of("/co/elastic/apm/agent/"), READ),
-                    FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ)
+                    FileData.ofPath(Path.of("/co/elastic/apm/agent/"), READ, false),
+                    FileData.ofPath(Path.of("/agent/co/elastic/apm/agent/"), READ, false)
                 )
             )
         );

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTree.java

@@ -9,6 +9,7 @@
 
 package org.elasticsearch.entitlement.runtime.policy;
 
+import org.elasticsearch.entitlement.runtime.api.NotEntitledException;
 import org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement;
 
 import java.nio.file.Path;
@@ -23,17 +24,27 @@ public final class FileAccessTree {
 
     private static final String FILE_SEPARATOR = getDefaultFileSystem().getSeparator();
 
+    private final String[] exclusivePaths;
     private final String[] readPaths;
     private final String[] writePaths;
 
-    private FileAccessTree(FilesEntitlement filesEntitlement, PathLookup pathLookup) {
+    private FileAccessTree(FilesEntitlement filesEntitlement, PathLookup pathLookup, List<String> exclusivePaths) {
+        List<String> updatedExclusivePaths = new ArrayList<>();
         List<String> readPaths = new ArrayList<>();
         List<String> writePaths = new ArrayList<>();
         for (FilesEntitlement.FileData fileData : filesEntitlement.filesData()) {
             var mode = fileData.mode();
             var paths = fileData.resolvePaths(pathLookup);
             paths.forEach(path -> {
                 var normalized = normalizePath(path);
+                for (String exclusivePath : exclusivePaths) {
+                    if (normalized.equals(exclusivePath) == false) {
+                        if (normalized.startsWith(exclusivePath)) {
+                            // TODO: throw
+                        }
+                        updatedExclusivePaths.add(exclusivePath);
+                    }
+                }
                 if (mode == FilesEntitlement.Mode.READ_WRITE) {
                     writePaths.add(normalized);
                 }
@@ -49,12 +60,29 @@ private FileAccessTree(FilesEntitlement filesEntitlement, PathLookup pathLookup)
         readPaths.sort(String::compareTo);
         writePaths.sort(String::compareTo);
 
-        this.readPaths = readPaths.toArray(new String[0]);
-        this.writePaths = writePaths.toArray(new String[0]);
+        this.exclusivePaths = updatedExclusivePaths.toArray(new String[0]);
+        this.readPaths = pruneSortedPaths(readPaths).toArray(new String[0]);
+        this.writePaths = pruneSortedPaths(writePaths).toArray(new String[0]);
+    }
+
+    public static List<String> pruneSortedPaths(List<String> paths) {
+        List<String> prunedReadPaths = new ArrayList<>();
+        if (paths.isEmpty() == false) {
+            String currentPath = paths.get(0);
+            prunedReadPaths.add(currentPath);
+            for (int i = 1; i < paths.size(); ++i) {
+                String nextPath = paths.get(i);
+                if (nextPath.equals(currentPath) == false && nextPath.startsWith(currentPath) == false) {
+                    prunedReadPaths.add(nextPath);
+                    currentPath = nextPath;
+                }
+            }
+        }
+        return prunedReadPaths;
     }
 
-    public static FileAccessTree of(FilesEntitlement filesEntitlement, PathLookup pathLookup) {
-        return new FileAccessTree(filesEntitlement, pathLookup);
+    public static FileAccessTree of(FilesEntitlement filesEntitlement, PathLookup pathLookup, List<String> exclusivePaths) {
+        return new FileAccessTree(filesEntitlement, pathLookup, exclusivePaths);
     }
 
     boolean canRead(Path path) {
@@ -75,8 +103,8 @@ static String normalizePath(Path path) {
         return path.toAbsolutePath().normalize().toString();
     }
 
-    private static boolean checkPath(String path, String[] paths) {
-        if (paths.length == 0) {
+    private boolean checkPath(String path, String[] paths) {
+        if (paths.length == 0 || Arrays.binarySearch(exclusivePaths, path) >= 0) {
             return false;
         }
         int ndx = Arrays.binarySearch(paths, path);

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java

@@ -34,6 +34,8 @@
 import java.lang.module.ModuleFinder;
 import java.lang.module.ModuleReference;
 import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Comparator;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -103,7 +105,7 @@ ModuleEntitlements policyEntitlements(String componentName, List<Entitlement> en
         return new ModuleEntitlements(
             componentName,
             entitlements.stream().collect(groupingBy(Entitlement::getClass)),
-            FileAccessTree.of(filesEntitlement, pathLookup)
+            FileAccessTree.of(filesEntitlement, pathLookup, List.of())
         );
     }
 
@@ -143,6 +145,13 @@ private static Set<Module> findSystemModules() {
      */
     private final Module entitlementsModule;
 
+    /**
+     * Paths that are only allowed for a single module. Used to generate
+     * structures to indicate other modules aren't allowed to use these
+     * files in {@link FileAccessTree}s.
+     */
+    private final List<String> exclusivePaths;
+
     public PolicyManager(
         Policy serverPolicy,
         List<Entitlement> apmAgentEntitlements,
@@ -161,17 +170,24 @@ public PolicyManager(
         this.apmAgentPackageName = apmAgentPackageName;
         this.entitlementsModule = entitlementsModule;
         this.pathLookup = requireNonNull(pathLookup);
-        this.defaultFileAccess = FileAccessTree.of(FilesEntitlement.EMPTY, pathLookup);
+        this.defaultFileAccess = FileAccessTree.of(FilesEntitlement.EMPTY, pathLookup, List.of());
 
+        List<ExclusivePath> exclusivePaths = new ArrayList<>();
         for (var e : serverEntitlements.entrySet()) {
             validateEntitlementsPerModule(SERVER_COMPONENT_NAME, e.getKey(), e.getValue());
+            buildExclusivePathList(exclusivePaths, pathLookup, SERVER_COMPONENT_NAME, e.getKey(), e.getValue());
         }
         validateEntitlementsPerModule(APM_AGENT_COMPONENT_NAME, "unnamed", apmAgentEntitlements);
+        buildExclusivePathList(exclusivePaths, pathLookup, APM_AGENT_COMPONENT_NAME, "unnamed", apmAgentEntitlements);
         for (var p : pluginsEntitlements.entrySet()) {
             for (var m : p.getValue().entrySet()) {
                 validateEntitlementsPerModule(p.getKey(), m.getKey(), m.getValue());
+                buildExclusivePathList(exclusivePaths, pathLookup, p.getKey(), m.getKey(), m.getValue());
             }
         }
+        exclusivePaths.sort(Comparator.comparing(ExclusivePath::path));
+        validateExclusivePaths(exclusivePaths);
+        this.exclusivePaths = exclusivePaths.stream().map(ExclusivePath::path).toList();
     }
 
     private static Map<String, List<Entitlement>> buildScopeEntitlementsMap(Policy policy) {
@@ -190,6 +206,45 @@ private static void validateEntitlementsPerModule(String componentName, String m
         }
     }
 
+    private record ExclusivePath(String componentName, String moduleName, String path) {}
+
+    private static void buildExclusivePathList(
+        List<ExclusivePath> exclusivePaths,
+        PathLookup pathLookup,
+        String componentName,
+        String moduleName,
+        List<Entitlement> entitlements
+    ) {
+        for (var e : entitlements) {
+            if (e instanceof FilesEntitlement fe) {
+                for (FilesEntitlement.FileData fd : fe.filesData()) {
+                    if (fd.exclusive()) {
+                        List<Path> paths = fd.resolvePaths(pathLookup).toList();
+                        for (Path path : paths) {
+                            String pathStr = FileAccessTree.normalizePath(path);
+                            exclusivePaths.add(new ExclusivePath(componentName, moduleName, pathStr));
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    private static void validateExclusivePaths(List<ExclusivePath> exclusivePaths) {
+        if (exclusivePaths.isEmpty() == false) {
+            ExclusivePath currentExclusivePath = exclusivePaths.get(0);
+            for (int i = 1; i < exclusivePaths.size(); ++i) {
+                ExclusivePath nextPath = exclusivePaths.get(i);
+                if (nextPath.path().equals(currentExclusivePath.path())) {
+                    // TODO: throw
+                } else if (nextPath.path().startsWith(currentExclusivePath.path())) {
+                    // TODO: throw
+                }
+                currentExclusivePath = nextPath;
+            }
+        }
+    }
+
     public void checkStartProcess(Class<?> callerClass) {
         neverEntitled(callerClass, () -> "start process");
     }