Split PolicyChecker from PolicyManager #128004

prdoyle · 2025-05-09T22:05:46Z

PolicyManager has a number of responsibilities, including at least:

Determining the entitlements granted to a given requesting class
Two dozen check methods that determine whether some required entitlement is present

This PR splits those into two objects, with the immediate consequence being that we can now swap in a PolicyManagerForTesting that modifies the behaviour.

With this change, the design looks as follows:

The EntitlementChecker interface has one method per sensitive JDK method. Its implementation (called ElasticsearchEntitlementChecker) determines which kind of check we should do for each method. Its methods are all one-liners that call PolicyChecker.
The PolicyChecker interface has one method per distinct kind of check (about 27 methods in total). Its implementation (PolicyCheckerImpl) has the job of determining the caller class, querying the PolicyManager to determine what entitlements are granted to that class, and then checking whether the required entitlements are present.
The PolicyManager class determines, for a given caller class, what entitlements that class has been granted, and whether it is trivially allowed.

It's PolicyManager that implements getEntitlements and isTriviallyAllowed. The idea is that we'd create a PolicyManagerForTesting that would override these to provide the required semantics when running in junit.

elasticsearchmachine · 2025-05-12T13:42:32Z

Pinging @elastic/es-core-infra (Team:Core/Infra)

ldematte

I'm neutral wrt to this design; it is different from what I thought we discussed (keep one PolicyManager, inject different behaviours for entitlements resolution in test vs prod) but it might be OK.
But if we go in this direction, there are a couple of things that did not need to change (see comments) and I think they need to be reverted.

...entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/PathActions.java

...ment/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementCheckerUtils.java

...nt/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java

ldematte · 2025-05-19T14:49:07Z

...src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java

    }

    @Override
    public void check$java_net_URL$openConnection(Class<?> callerClass, java.net.URL that) {
-        checkEntitlementForUrl(callerClass, that);
+        policyChecker.checkEntitlementForUrl(callerClass, that);


I don't understand why these were moved - they were private to EntitlementChecker, why widen their visibility?

(I prefer the way they are, and leave them out of the interface so it just have the "basic blocks", but I'm OK with moving them and exposing them if you feel strongly about it)

Before, some of the check utility methods were in ElasticsearchEntitlementChecker and some were in PolicyManager, with no clear reason to pick one or the other. Now, all the check utilities are in PolicyChecker, leaving EntitlementChecker with nothing but the one-liner methods describing which entitlement is required for each sensitive JDK method.

ldematte

One question to consider, but I'm fine either way. LGTM

ldematte · 2025-05-28T08:34:10Z

...ntitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyCheckerImpl.java

+    private static boolean isPathOnDefaultFilesystem(Path path) {
+        var pathFileSystemClass = path.getFileSystem().getClass();
+        if (path.getFileSystem().getClass() != DEFAULT_FILESYSTEM_CLASS) {
+            PolicyManager.generalLogger.trace(


Nit: I find it strange this uses PolicyManager logger; I guess it is for having more consistent logs, but it can be confusing I think.

Agreed, this is an unusual thing to do. I can change it to use PolicyCheckerImpl, especially since it's a trace log.

I think I was concerned that we already have some alerting on PolicyManager logs and didn't want to worry about those. But we definitely don't have alerts on this one, so that reasoning isn't really sound.

Your call :) I'm OK with keeping it unchanged if you are worried about something like alerts

elasticsearchmachine · 2025-05-28T16:49:49Z

💔 Backport failed

Status	Branch	Result
❌	8.19	Commit could not be cherrypicked due to conflicts
✅	9.0
❌	8.18	Commit could not be cherrypicked due to conflicts

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 128004

* Split PolicyChecker from PolicyManager * Restore EntitlementCheckerUtils * [CI] Auto commit changes from spotless --------- Co-authored-by: elasticsearchmachine <[email protected]>

* Split PolicyChecker from PolicyManager (#128004) * Split PolicyChecker from PolicyManager * Restore EntitlementCheckerUtils * [CI] Auto commit changes from spotless --------- Co-authored-by: elasticsearchmachine <[email protected]> * PolicyChecker change in JavaXX entitlement checkers --------- Co-authored-by: elasticsearchmachine <[email protected]>

* Split PolicyChecker from PolicyManager * Restore EntitlementCheckerUtils * [CI] Auto commit changes from spotless --------- Co-authored-by: elasticsearchmachine <[email protected]>

* Split PolicyChecker from PolicyManager * Restore EntitlementCheckerUtils * [CI] Auto commit changes from spotless --------- Co-authored-by: elasticsearchmachine <[email protected]> (cherry picked from commit ba50798) # Conflicts: # libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/api/ElasticsearchEntitlementChecker.java

mosche · 2025-07-24T09:40:47Z

💚 All backports created successfully

Status	Branch	Result
✅	8.18

Questions ?

Please refer to the Backport tool documentation

elasticsearchmachine added the v9.1.0 label May 9, 2025

prdoyle added >refactoring auto-backport Automatically create backport pull requests when merged v8.19.0 :Core/Infra/Entitlements Entitlements infrastructure v8.18.2 v9.0.2 labels May 9, 2025

prdoyle force-pushed the externalized-cache branch from 5d95452 to 60de9dc Compare May 12, 2025 13:38

prdoyle marked this pull request as ready for review May 12, 2025 13:42

prdoyle requested a review from a team as a code owner May 12, 2025 13:42

elasticsearchmachine added the Team:Core/Infra Meta label for core/infra team label May 12, 2025

prdoyle force-pushed the externalized-cache branch 2 times, most recently from 6b023dc to cba405d Compare May 12, 2025 14:15

prdoyle mentioned this pull request May 12, 2025

Split out EntitlementsCache #127774

Closed

prdoyle force-pushed the externalized-cache branch from caef5bc to 6d17a3a Compare May 12, 2025 15:22

Split PolicyChecker from PolicyManager

8530cc1

prdoyle force-pushed the externalized-cache branch from 6d17a3a to 8530cc1 Compare May 12, 2025 17:02

ldematte requested changes May 19, 2025

View reviewed changes

elasticsearchmachine added v8.18.3 v9.0.3 and removed v8.18.2 v9.0.2 labels May 22, 2025

prdoyle and others added 3 commits May 27, 2025 14:35

Restore EntitlementCheckerUtils

a4392b5

Merge remote-tracking branch 'upstream/main' into externalized-cache

d6b5b51

[CI] Auto commit changes from spotless

f34478b

ldematte approved these changes May 28, 2025

View reviewed changes

prdoyle merged commit ba50798 into elastic:main May 28, 2025
18 checks passed

prdoyle mentioned this pull request May 28, 2025

[9.0] Split PolicyChecker from PolicyManager (#128004) #128587

Merged

elasticsearchmachine added the backport pending label May 28, 2025

prdoyle removed the v8.18.3 label May 29, 2025

prdoyle mentioned this pull request May 29, 2025

[8.19] Split PolicyChecker from PolicyManager (#128004) #128641

Merged

mosche added the v8.18.5 label Jul 24, 2025

mosche mentioned this pull request Jul 24, 2025

[8.18] Split PolicyChecker from PolicyManager (#128004) #131813

Closed

mosche removed the backport pending label Jul 24, 2025

Uh oh!

Split PolicyChecker from PolicyManager #128004

Split PolicyChecker from PolicyManager #128004

Uh oh!

Conversation

prdoyle commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticsearchmachine commented May 12, 2025

Uh oh!

ldematte left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ldematte May 19, 2025

Choose a reason for hiding this comment

Uh oh!

ldematte May 20, 2025

Choose a reason for hiding this comment

Uh oh!

prdoyle May 27, 2025

Choose a reason for hiding this comment

Uh oh!

ldematte left a comment

Choose a reason for hiding this comment

Uh oh!

ldematte May 28, 2025

Choose a reason for hiding this comment

Uh oh!

prdoyle May 28, 2025

Choose a reason for hiding this comment

Uh oh!

prdoyle May 28, 2025

Choose a reason for hiding this comment

Uh oh!

ldematte May 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticsearchmachine commented May 28, 2025

💔 Backport failed

Uh oh!

mosche commented Jul 24, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

prdoyle commented May 9, 2025 •

edited

Loading