[Entitlelments] Server policy patching via system property #124904

ldematte · 2025-03-14T17:47:49Z

This PR adds a mechanism to patch the server layer policy by merging entitlements from a policy provided via a system property (merge, not replace).

Since this is in server, it's difficult to test this with IT tests, so I ended up adding unit tests + testing manually, via

./gradlew run --debug-jvm -Dtests.jvm.argline="-Des.entitlements.server_policy=<base64 policy>"

add an entitlement to an existing scope:

versions:
  - 9.1.0
policy:
  java.desktop:
    - manage_threads

with base64

dmVyc2lvbnM6CiAgLSA5LjEuMApwb2xpY3k6CiAgamF2YS5kZXNrdG9wOgogICAgLSBtYW5hZ2VfdGhyZWFkcw==

Policy is parsed and patched

[2025-03-17T08:19:38,577][INFO ][o.e.e.r.p.PolicyUtils    ] [runTask-0] Using policy patch for layer [server]

Verified with the debugger that the entitlement is actually added to the scope.

add an entitlement to a new scope:

versions:
  - 9.1.0
policy:
  org.jruby.jcodings:
    - manage_threads

with base64

dmVyc2lvbnM6CiAgLSA5LjEuMApwb2xpY3k6CiAgb3JnLmpydWJ5Lmpjb2RpbmdzOgogICAgLSBtYW5hZ2VfdGhyZWFkcw==

Policy is parsed and patched

[2025-03-17T08:19:38,577][INFO ][o.e.e.r.p.PolicyUtils    ] [runTask-0] Using policy patch for layer [server]

Verified with the debugger that the scope with the entitlement is actually added to the policy.

try to add an invalid policy

versions:
  - 9.1.0
policy:
  java.xml:
    - manage_threads

with base64

dmVyc2lvbnM6CiAgLSA5LjEuMApwb2xpY3k6CiAgamF2YS54bWw6CiAgICAtIG1hbmFnZV90aHJlYWRz

Policy is parsed and discarded

[2025-03-17T08:24:20,930][WARN ][o.e.e.r.p.PolicyUtils    ] [runTask-0] Found a policy patch with invalid content. The patch will not be applied. Layer [server]
java.lang.IllegalStateException: Invalid module name in policy: layer [server] does not have module [java.xml]; available modules [org.elasticsearch.plugin.analysis, org.jruby.jcodings, org.apache.lucene.suggest, org.elasticsearch.cli, org.apache.lucene.core, org.elasticsearch.xcontent, org.elasticsearch.lz4, org.elasticsearch.geo, org.elasticsearch.simdvec, ecs.logging.core, org.apache.logging.log4j, org.apache.lucene.sandbox, org.apache.lucene.queryparser, org.lz4.java, org.apache.lucene.memory, org.elasticsearch.tdigest, log4j2.ecs.layout, org.jruby.joni, org.apache.lucene.queries, org.apache.logging.log4j.core, org.elasticsearch.nativeaccess, org.elasticsearch.grok, org.apache.lucene.grouping, jopt.simple, org.apache.lucene.analysis.common, org.apache.lucene.misc, org.apache.lucene.join, org.apache.lucene.backward_codecs, org.elasticsearch.securesm, HdrHistogram, java.desktop, org.apache.lucene.highlighter, org.elasticsearch.logging, org.apache.lucene.facet, org.elasticsearch.base, hppc, org.elasticsearch.server, org.elasticsearch.plugin]; policy path [<patch>]

Relates to ES-11009

...ntitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyParserUtils.java

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyUtils.java

…-override-server

elasticsearchmachine · 2025-03-14T22:26:05Z

Pinging @elastic/es-core-infra (Team:Core/Infra)

…-override-server

mosche

LGTM 👍

Might have missed this, but wondering why we're handling server and plugin overrides differently. Plugin overrides always require the full policy, for server we merge a patch with the existing policy. Considering we're supporting merges, should we do the same for plugins or do we want to be able to remove entitlements this way as well (e.g. to fix a security issue).

If handling plugins and server consistently, we might as well use es.entitlements.policy.server for the server patch.

ldematte · 2025-03-17T10:59:44Z

but wondering why we're handling server and plugin overrides differently. Plugin overrides always require the full policy, for server we merge a patch with the existing policy. Considering we're supporting merges, should we do the same for plugins or do we want to be able to remove entitlements this way as well (e.g. to fix a security issue).

Yes, I have a follow-up PR for that, should be ready this morning.

…24904) This PR adds a mechanism to patch the server layer policy by merging entitlements from a policy provided via a system property (merge, not replace).

elasticsearchmachine · 2025-03-17T11:02:00Z

💚 Backport successful

Status	Branch	Result
✅	8.18
✅	8.x
✅	9.0

…24904) This PR adds a mechanism to patch the server layer policy by merging entitlements from a policy provided via a system property (merge, not replace).

ldematte · 2025-03-17T11:44:50Z

Follow-up here: #125011

…125009) This PR adds a mechanism to patch the server layer policy by merging entitlements from a policy provided via a system property (merge, not replace).

…4904) (#125008) * [Entitlelments] Server policy patching via system property (#124904) This PR adds a mechanism to patch the server layer policy by merging entitlements from a policy provided via a system property (merge, not replace). * change to support 8.x language level

…24904) (#125007) * [Entitlelments] Server policy patching via system property (#124904) This PR adds a mechanism to patch the server layer policy by merging entitlements from a policy provided via a system property (merge, not replace). * change to support 8.x language level

With #124904 we introduced server policy patching via system properties; now that we have the possibility to merge policies and scopes, it's worth applying the same mechanism to plugin policies too. This PR changes the behaviour of plugin policy overrides; now they are not replacing the policy entirely, but patch it by adding the entitlements and scopes specified in the "patch policy"

…5011) With elastic#124904 we introduced server policy patching via system properties; now that we have the possibility to merge policies and scopes, it's worth applying the same mechanism to plugin policies too. This PR changes the behaviour of plugin policy overrides; now they are not replacing the policy entirely, but patch it by adding the entitlements and scopes specified in the "patch policy"

…125086) With #124904 we introduced server policy patching via system properties; now that we have the possibility to merge policies and scopes, it's worth applying the same mechanism to plugin policies too. This PR changes the behaviour of plugin policy overrides; now they are not replacing the policy entirely, but patch it by adding the entitlements and scopes specified in the "patch policy"

…125087) With #124904 we introduced server policy patching via system properties; now that we have the possibility to merge policies and scopes, it's worth applying the same mechanism to plugin policies too. This PR changes the behaviour of plugin policy overrides; now they are not replacing the policy entirely, but patch it by adding the entitlements and scopes specified in the "patch policy"

…125078) With #124904 we introduced server policy patching via system properties; now that we have the possibility to merge policies and scopes, it's worth applying the same mechanism to plugin policies too. This PR changes the behaviour of plugin policy overrides; now they are not replacing the policy entirely, but patch it by adding the entitlements and scopes specified in the "patch policy"

…24904) This PR adds a mechanism to patch the server layer policy by merging entitlements from a policy provided via a system property (merge, not replace).

…5011) With elastic#124904 we introduced server policy patching via system properties; now that we have the possibility to merge policies and scopes, it's worth applying the same mechanism to plugin policies too. This PR changes the behaviour of plugin policy overrides; now they are not replacing the policy entirely, but patch it by adding the entitlements and scopes specified in the "patch policy"

server policy patching via system property (merge, not replace)

a74551e

ldematte added the :Core/Infra/Entitlements Entitlements infrastructure label Mar 14, 2025

elasticsearchmachine added the v9.1.0 label Mar 14, 2025

renaming

a105803

prdoyle reviewed Mar 14, 2025

View reviewed changes

cleaner mergeEntitlements

cd3135a

prdoyle reviewed Mar 14, 2025

View reviewed changes

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyUtils.java Outdated Show resolved Hide resolved

ldematte added 3 commits March 14, 2025 23:08

Merge remote-tracking branch 'upstream/main' into entitlements/policy…

a65deae

…-override-server

unit tests

d7104a0

renaming

6f379dd

ldematte added >non-issue auto-backport Automatically create backport pull requests when merged v8.18.1 v8.19.0 v9.0.1 labels Mar 14, 2025

ldematte marked this pull request as ready for review March 14, 2025 22:25

ldematte requested a review from a team as a code owner March 14, 2025 22:25

elasticsearchmachine added the Team:Core/Infra Meta label for core/infra team label Mar 14, 2025

ldematte and others added 2 commits March 17, 2025 08:13

Merge remote-tracking branch 'upstream/main' into entitlements/policy…

c451ce0

…-override-server

Merge branch 'main' into entitlements/policy-override-server

5061c1e

mosche approved these changes Mar 17, 2025

View reviewed changes

ldematte merged commit ef3b835 into elastic:main Mar 17, 2025
18 checks passed

ldematte deleted the entitlements/policy-override-server branch March 17, 2025 11:00

ldematte mentioned this pull request Mar 17, 2025

[8.18] [Entitlelments] Server policy patching via system property (#124904) #125007

Merged

ldematte mentioned this pull request Mar 17, 2025

[8.x] [Entitlelments] Server policy patching via system property (#124904) #125008

Merged

ldematte mentioned this pull request Mar 17, 2025

[9.0] [Entitlelments] Server policy patching via system property (#124904) #125009

Merged

ldematte mentioned this pull request Mar 17, 2025

[Entitlements] Uniform server and plugins policy patching #125011

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Entitlelments] Server policy patching via system property #124904

[Entitlelments] Server policy patching via system property #124904

Uh oh!

ldematte commented Mar 14, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticsearchmachine commented Mar 14, 2025

Uh oh!

mosche left a comment

Uh oh!

ldematte commented Mar 17, 2025

Uh oh!

Uh oh!

elasticsearchmachine commented Mar 17, 2025

Uh oh!

ldematte commented Mar 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

[Entitlelments] Server policy patching via system property #124904

[Entitlelments] Server policy patching via system property #124904

Uh oh!

Conversation

ldematte commented Mar 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticsearchmachine commented Mar 14, 2025

Uh oh!

mosche left a comment

Choose a reason for hiding this comment

Uh oh!

ldematte commented Mar 17, 2025

Uh oh!

Uh oh!

elasticsearchmachine commented Mar 17, 2025

💚 Backport successful

Uh oh!

ldematte commented Mar 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ldematte commented Mar 14, 2025 •

edited

Loading