Skip to content

Move FilesEntitlements validation to a separate class #127703

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 5, 2025
Merged

Move FilesEntitlements validation to a separate class #127703

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1af3ce5
Move FilesEntitlements validation to a separate class
ldematte May 5, 2025
787e475
Merge remote-tracking branch 'upstream/main' into entitlements/extrac…
ldematte May 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 1 addition & 72 deletions ...src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@

import org.elasticsearch.core.Booleans;
import org.elasticsearch.core.PathUtils;
import org.elasticsearch.core.Strings;
import org.elasticsearch.core.internal.provider.ProviderLocator;
import org.elasticsearch.entitlement.bootstrap.EntitlementBootstrap;
import org.elasticsearch.entitlement.bridge.EntitlementChecker;
Expand All @@ -21,7 +20,6 @@
import org.elasticsearch.entitlement.instrumentation.MethodKey;
import org.elasticsearch.entitlement.instrumentation.Transformer;
import org.elasticsearch.entitlement.runtime.api.ElasticsearchEntitlementChecker;
import org.elasticsearch.entitlement.runtime.policy.FileAccessTree;
import org.elasticsearch.entitlement.runtime.policy.PathLookup;
import org.elasticsearch.entitlement.runtime.policy.Policy;
import org.elasticsearch.entitlement.runtime.policy.PolicyManager;
Expand Down Expand Up @@ -60,7 +58,6 @@
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
Expand Down Expand Up @@ -345,7 +342,7 @@ private static PolicyManager createPolicyManager() {
)
);

validateFilesEntitlements(pluginPolicies, pathLookup);
FilesEntitlementsValidation.validate(pluginPolicies, pathLookup);

return new PolicyManager(
serverPolicy,
Expand All @@ -359,74 +356,6 @@ private static PolicyManager createPolicyManager() {
);
}

// package visible for tests
static void validateFilesEntitlements(Map<String, Policy> pluginPolicies, PathLookup pathLookup) {
Set<Path> readAccessForbidden = new HashSet<>();
pathLookup.getBaseDirPaths(PLUGINS).forEach(p -> readAccessForbidden.add(p.toAbsolutePath().normalize()));
pathLookup.getBaseDirPaths(MODULES).forEach(p -> readAccessForbidden.add(p.toAbsolutePath().normalize()));
pathLookup.getBaseDirPaths(LIB).forEach(p -> readAccessForbidden.add(p.toAbsolutePath().normalize()));
Set<Path> writeAccessForbidden = new HashSet<>();
pathLookup.getBaseDirPaths(CONFIG).forEach(p -> writeAccessForbidden.add(p.toAbsolutePath().normalize()));
for (var pluginPolicy : pluginPolicies.entrySet()) {
for (var scope : pluginPolicy.getValue().scopes()) {
var filesEntitlement = scope.entitlements()
.stream()
.filter(x -> x instanceof FilesEntitlement)
.map(x -> ((FilesEntitlement) x))
.findFirst();
if (filesEntitlement.isPresent()) {
var fileAccessTree = FileAccessTree.withoutExclusivePaths(filesEntitlement.get(), pathLookup, null);
validateReadFilesEntitlements(pluginPolicy.getKey(), scope.moduleName(), fileAccessTree, readAccessForbidden);
validateWriteFilesEntitlements(pluginPolicy.getKey(), scope.moduleName(), fileAccessTree, writeAccessForbidden);
}
}
}
}

private static IllegalArgumentException buildValidationException(
String componentName,
String moduleName,
Path forbiddenPath,
FilesEntitlement.Mode mode
) {
return new IllegalArgumentException(
Strings.format(
"policy for module [%s] in [%s] has an invalid file entitlement. Any path under [%s] is forbidden for mode [%s].",
moduleName,
componentName,
forbiddenPath,
mode
)
);
}

private static void validateReadFilesEntitlements(
String componentName,
String moduleName,
FileAccessTree fileAccessTree,
Set<Path> readForbiddenPaths
) {

for (Path forbiddenPath : readForbiddenPaths) {
if (fileAccessTree.canRead(forbiddenPath)) {
throw buildValidationException(componentName, moduleName, forbiddenPath, READ);
}
}
}

private static void validateWriteFilesEntitlements(
String componentName,
String moduleName,
FileAccessTree fileAccessTree,
Set<Path> writeForbiddenPaths
) {
for (Path forbiddenPath : writeForbiddenPaths) {
if (fileAccessTree.canWrite(forbiddenPath)) {
throw buildValidationException(componentName, moduleName, forbiddenPath, READ_WRITE);
}
}
}

private static Path getUserHome() {
String userHome = System.getProperty("user.home");
if (userHome == null) {
Expand Down
98 changes: 98 additions & 0 deletions ...c/main/java/org/elasticsearch/entitlement/initialization/FilesEntitlementsValidation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the "Elastic License
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
* Public License v 1"; you may not use this file except in compliance with, at
* your election, the "Elastic License 2.0", the "GNU Affero General Public
* License v3.0 only", or the "Server Side Public License, v 1".
*/

package org.elasticsearch.entitlement.initialization;

import org.elasticsearch.core.Strings;
import org.elasticsearch.entitlement.runtime.policy.FileAccessTree;
import org.elasticsearch.entitlement.runtime.policy.PathLookup;
import org.elasticsearch.entitlement.runtime.policy.Policy;
import org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement;

import java.nio.file.Path;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.CONFIG;
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.LIB;
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.MODULES;
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.PLUGINS;
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ;
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ_WRITE;

class FilesEntitlementsValidation {

static void validate(Map<String, Policy> pluginPolicies, PathLookup pathLookup) {
Set<Path> readAccessForbidden = new HashSet<>();
pathLookup.getBaseDirPaths(PLUGINS).forEach(p -> readAccessForbidden.add(p.toAbsolutePath().normalize()));
pathLookup.getBaseDirPaths(MODULES).forEach(p -> readAccessForbidden.add(p.toAbsolutePath().normalize()));
pathLookup.getBaseDirPaths(LIB).forEach(p -> readAccessForbidden.add(p.toAbsolutePath().normalize()));
Set<Path> writeAccessForbidden = new HashSet<>();
pathLookup.getBaseDirPaths(CONFIG).forEach(p -> writeAccessForbidden.add(p.toAbsolutePath().normalize()));
for (var pluginPolicy : pluginPolicies.entrySet()) {
for (var scope : pluginPolicy.getValue().scopes()) {
var filesEntitlement = scope.entitlements()
.stream()
.filter(x -> x instanceof FilesEntitlement)
.map(x -> ((FilesEntitlement) x))
.findFirst();
if (filesEntitlement.isPresent()) {
var fileAccessTree = FileAccessTree.withoutExclusivePaths(filesEntitlement.get(), pathLookup, null);
validateReadFilesEntitlements(pluginPolicy.getKey(), scope.moduleName(), fileAccessTree, readAccessForbidden);
validateWriteFilesEntitlements(pluginPolicy.getKey(), scope.moduleName(), fileAccessTree, writeAccessForbidden);
}
}
}
}

private static IllegalArgumentException buildValidationException(
String componentName,
String moduleName,
Path forbiddenPath,
FilesEntitlement.Mode mode
) {
return new IllegalArgumentException(
Strings.format(
"policy for module [%s] in [%s] has an invalid file entitlement. Any path under [%s] is forbidden for mode [%s].",
moduleName,
componentName,
forbiddenPath,
mode
)
);
}

private static void validateReadFilesEntitlements(
String componentName,
String moduleName,
FileAccessTree fileAccessTree,
Set<Path> readForbiddenPaths
) {

for (Path forbiddenPath : readForbiddenPaths) {
if (fileAccessTree.canRead(forbiddenPath)) {
throw buildValidationException(componentName, moduleName, forbiddenPath, READ);
}
}
}

private static void validateWriteFilesEntitlements(
String componentName,
String moduleName,
FileAccessTree fileAccessTree,
Set<Path> writeForbiddenPaths
) {
for (Path forbiddenPath : writeForbiddenPaths) {
if (fileAccessTree.canWrite(forbiddenPath)) {
throw buildValidationException(componentName, moduleName, forbiddenPath, READ_WRITE);
}
}
}
}
10 changes: 5 additions & 5 deletions ...ation/EntitlementInitializationTests.java → ...ion/FilesEntitlementsValidationTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
import static org.hamcrest.Matchers.endsWith;
import static org.hamcrest.Matchers.startsWith;

public class EntitlementInitializationTests extends ESTestCase {
public class FilesEntitlementsValidationTests extends ESTestCase {

private static PathLookup TEST_PATH_LOOKUP;

Expand Down Expand Up @@ -75,7 +75,7 @@ public void testValidationPass() {
)
)
);
EntitlementInitialization.validateFilesEntitlements(Map.of("plugin", policy), TEST_PATH_LOOKUP);
FilesEntitlementsValidation.validate(Map.of("plugin", policy), TEST_PATH_LOOKUP);
}

public void testValidationFailForRead() {
Expand All @@ -94,7 +94,7 @@ public void testValidationFailForRead() {

var ex = expectThrows(
IllegalArgumentException.class,
() -> EntitlementInitialization.validateFilesEntitlements(Map.of("plugin", policy), TEST_PATH_LOOKUP)
() -> FilesEntitlementsValidation.validate(Map.of("plugin", policy), TEST_PATH_LOOKUP)
);
assertThat(
ex.getMessage(),
Expand All @@ -119,7 +119,7 @@ public void testValidationFailForRead() {

ex = expectThrows(
IllegalArgumentException.class,
() -> EntitlementInitialization.validateFilesEntitlements(Map.of("plugin2", policy2), TEST_PATH_LOOKUP)
() -> FilesEntitlementsValidation.validate(Map.of("plugin2", policy2), TEST_PATH_LOOKUP)
);
assertThat(
ex.getMessage(),
Expand All @@ -145,7 +145,7 @@ public void testValidationFailForWrite() {

var ex = expectThrows(
IllegalArgumentException.class,
() -> EntitlementInitialization.validateFilesEntitlements(Map.of("plugin", policy), TEST_PATH_LOOKUP)
() -> FilesEntitlementsValidation.validate(Map.of("plugin", policy), TEST_PATH_LOOKUP)
);
assertThat(
ex.getMessage(),
Expand Down