Skip to content

Commit b7c15ee

Browse files
ldematteywangd
ldematte
authored and
ywangd
committed
Extract hardcoded entitlements creation to a separate class (elastic#127698)
Moving creation of hardcoded entitlements (server policy + APM agent) to a separate class
1 parent 24b9017 commit b7c15ee

File tree

2 files changed

+212
-171
lines changed

2 files changed

+212
-171
lines changed

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java‎

Lines changed: 2 additions & 171 deletions
Original file line numberDiff line numberDiff line change
@@ -16,42 +16,13 @@
1616
import org.elasticsearch.entitlement.runtime.policy.PathLookup;
1717
import org.elasticsearch.entitlement.runtime.policy.Policy;
1818
import org.elasticsearch.entitlement.runtime.policy.PolicyManager;
19-
import org.elasticsearch.entitlement.runtime.policy.PolicyUtils;
20-
import org.elasticsearch.entitlement.runtime.policy.Scope;
21-
import org.elasticsearch.entitlement.runtime.policy.entitlements.CreateClassLoaderEntitlement;
22-
import org.elasticsearch.entitlement.runtime.policy.entitlements.Entitlement;
23-
import org.elasticsearch.entitlement.runtime.policy.entitlements.ExitVMEntitlement;
24-
import org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement;
25-
import org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.FileData;
26-
import org.elasticsearch.entitlement.runtime.policy.entitlements.InboundNetworkEntitlement;
27-
import org.elasticsearch.entitlement.runtime.policy.entitlements.LoadNativeLibrariesEntitlement;
28-
import org.elasticsearch.entitlement.runtime.policy.entitlements.ManageThreadsEntitlement;
29-
import org.elasticsearch.entitlement.runtime.policy.entitlements.OutboundNetworkEntitlement;
30-
import org.elasticsearch.entitlement.runtime.policy.entitlements.ReadStoreAttributesEntitlement;
31-
import org.elasticsearch.entitlement.runtime.policy.entitlements.SetHttpsConnectionPropertiesEntitlement;
32-
import org.elasticsearch.entitlement.runtime.policy.entitlements.WriteSystemPropertiesEntitlement;
3319

3420
import java.lang.instrument.Instrumentation;
3521
import java.lang.reflect.Constructor;
3622
import java.lang.reflect.InvocationTargetException;
37-
import java.nio.file.Path;
38-
import java.util.ArrayList;
39-
import java.util.Collections;
40-
import java.util.List;
4123
import java.util.Map;
4224
import java.util.Set;
4325

44-
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.CONFIG;
45-
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.DATA;
46-
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.LIB;
47-
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.LOGS;
48-
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.MODULES;
49-
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.PLUGINS;
50-
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.SHARED_REPO;
51-
import static org.elasticsearch.entitlement.runtime.policy.Platform.LINUX;
52-
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ;
53-
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ_WRITE;
54-
5526
/**
5627
* Called by the agent during {@code agentmain} to configure the entitlement system,
5728
* instantiate and configure an {@link EntitlementChecker},
@@ -105,151 +76,11 @@ private static PolicyManager createPolicyManager() {
10576
Map<String, Policy> pluginPolicies = bootstrapArgs.pluginPolicies();
10677
PathLookup pathLookup = bootstrapArgs.pathLookup();
10778

108-
List<Scope> serverScopes = new ArrayList<>();
109-
List<FileData> serverModuleFileDatas = new ArrayList<>();
110-
Collections.addAll(
111-
serverModuleFileDatas,
112-
// Base ES directories
113-
FileData.ofBaseDirPath(PLUGINS, READ),
114-
FileData.ofBaseDirPath(MODULES, READ),
115-
FileData.ofBaseDirPath(CONFIG, READ),
116-
FileData.ofBaseDirPath(LOGS, READ_WRITE),
117-
FileData.ofBaseDirPath(LIB, READ),
118-
FileData.ofBaseDirPath(DATA, READ_WRITE),
119-
FileData.ofBaseDirPath(SHARED_REPO, READ_WRITE),
120-
// exclusive settings file
121-
FileData.ofRelativePath(Path.of("operator/settings.json"), CONFIG, READ_WRITE).withExclusive(true),
122-
// OS release on Linux
123-
FileData.ofPath(Path.of("/etc/os-release"), READ).withPlatform(LINUX),
124-
FileData.ofPath(Path.of("/etc/system-release"), READ).withPlatform(LINUX),
125-
FileData.ofPath(Path.of("/usr/lib/os-release"), READ).withPlatform(LINUX),
126-
// read max virtual memory areas
127-
FileData.ofPath(Path.of("/proc/sys/vm/max_map_count"), READ).withPlatform(LINUX),
128-
FileData.ofPath(Path.of("/proc/meminfo"), READ).withPlatform(LINUX),
129-
// load averages on Linux
130-
FileData.ofPath(Path.of("/proc/loadavg"), READ).withPlatform(LINUX),
131-
// control group stats on Linux. cgroup v2 stats are in an unpredicable
132-
// location under `/sys/fs/cgroup`, so unfortunately we have to allow
133-
// read access to the entire directory hierarchy.
134-
FileData.ofPath(Path.of("/proc/self/cgroup"), READ).withPlatform(LINUX),
135-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ).withPlatform(LINUX),
136-
// // io stats on Linux
137-
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ).withPlatform(LINUX),
138-
FileData.ofPath(Path.of("/proc/diskstats"), READ).withPlatform(LINUX)
139-
);
140-
if (pathLookup.pidFile() != null) {
141-
serverModuleFileDatas.add(FileData.ofPath(pathLookup.pidFile(), READ_WRITE));
142-
}
143-
144-
Collections.addAll(
145-
serverScopes,
146-
new Scope(
147-
"org.elasticsearch.base",
148-
List.of(
149-
new CreateClassLoaderEntitlement(),
150-
new FilesEntitlement(
151-
List.of(
152-
// TODO: what in es.base is accessing shared repo?
153-
FileData.ofBaseDirPath(SHARED_REPO, READ_WRITE),
154-
FileData.ofBaseDirPath(DATA, READ_WRITE)
155-
)
156-
)
157-
)
158-
),
159-
new Scope("org.elasticsearch.xcontent", List.of(new CreateClassLoaderEntitlement())),
160-
new Scope(
161-
"org.elasticsearch.server",
162-
List.of(
163-
new ExitVMEntitlement(),
164-
new ReadStoreAttributesEntitlement(),
165-
new CreateClassLoaderEntitlement(),
166-
new InboundNetworkEntitlement(),
167-
new LoadNativeLibrariesEntitlement(),
168-
new ManageThreadsEntitlement(),
169-
new FilesEntitlement(serverModuleFileDatas)
170-
)
171-
),
172-
new Scope("java.desktop", List.of(new LoadNativeLibrariesEntitlement())),
173-
new Scope("org.apache.httpcomponents.httpclient", List.of(new OutboundNetworkEntitlement())),
174-
new Scope(
175-
"org.apache.lucene.core",
176-
List.of(
177-
new LoadNativeLibrariesEntitlement(),
178-
new ManageThreadsEntitlement(),
179-
new FilesEntitlement(List.of(FileData.ofBaseDirPath(CONFIG, READ), FileData.ofBaseDirPath(DATA, READ_WRITE)))
180-
)
181-
),
182-
new Scope(
183-
"org.apache.lucene.misc",
184-
List.of(new FilesEntitlement(List.of(FileData.ofBaseDirPath(DATA, READ_WRITE))), new ReadStoreAttributesEntitlement())
185-
),
186-
new Scope(
187-
"org.apache.logging.log4j.core",
188-
List.of(new ManageThreadsEntitlement(), new FilesEntitlement(List.of(FileData.ofBaseDirPath(LOGS, READ_WRITE))))
189-
),
190-
new Scope(
191-
"org.elasticsearch.nativeaccess",
192-
List.of(new LoadNativeLibrariesEntitlement(), new FilesEntitlement(List.of(FileData.ofBaseDirPath(DATA, READ_WRITE))))
193-
)
194-
);
195-
196-
// conditionally add FIPS entitlements if FIPS only functionality is enforced
197-
if (Booleans.parseBoolean(System.getProperty("org.bouncycastle.fips.approved_only"), false)) {
198-
// if custom trust store is set, grant read access to its location, otherwise use the default JDK trust store
199-
String trustStore = System.getProperty("javax.net.ssl.trustStore");
200-
Path trustStorePath = trustStore != null
201-
? Path.of(trustStore)
202-
: Path.of(System.getProperty("java.home")).resolve("lib/security/jssecacerts");
203-
204-
Collections.addAll(
205-
serverScopes,
206-
new Scope(
207-
"org.bouncycastle.fips.tls",
208-
List.of(
209-
new FilesEntitlement(List.of(FileData.ofPath(trustStorePath, READ))),
210-
new ManageThreadsEntitlement(),
211-
new OutboundNetworkEntitlement()
212-
)
213-
),
214-
new Scope(
215-
"org.bouncycastle.fips.core",
216-
// read to lib dir is required for checksum validation
217-
List.of(new FilesEntitlement(List.of(FileData.ofBaseDirPath(LIB, READ))), new ManageThreadsEntitlement())
218-
)
219-
);
220-
}
221-
222-
var serverPolicy = new Policy(
223-
"server",
224-
bootstrapArgs.serverPolicyPatch() == null
225-
? serverScopes
226-
: PolicyUtils.mergeScopes(serverScopes, bootstrapArgs.serverPolicyPatch().scopes())
227-
);
228-
229-
// agents run without a module, so this is a special hack for the apm agent
230-
// this should be removed once https://github.com/elastic/elasticsearch/issues/109335 is completed
231-
// See also modules/apm/src/main/plugin-metadata/entitlement-policy.yaml
232-
List<Entitlement> agentEntitlements = List.of(
233-
new CreateClassLoaderEntitlement(),
234-
new ManageThreadsEntitlement(),
235-
new SetHttpsConnectionPropertiesEntitlement(),
236-
new OutboundNetworkEntitlement(),
237-
new WriteSystemPropertiesEntitlement(Set.of("AsyncProfiler.safemode")),
238-
new LoadNativeLibrariesEntitlement(),
239-
new FilesEntitlement(
240-
List.of(
241-
FileData.ofBaseDirPath(LOGS, READ_WRITE),
242-
FileData.ofPath(Path.of("/proc/meminfo"), READ),
243-
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ)
244-
)
245-
)
246-
);
247-
24879
FilesEntitlementsValidation.validate(pluginPolicies, pathLookup);
24980

25081
return new PolicyManager(
251-
serverPolicy,
252-
agentEntitlements,
82+
HardcodedEntitlements.serverPolicy(pathLookup.pidFile(), bootstrapArgs.serverPolicyPatch()),
83+
HardcodedEntitlements.agentEntitlements(),
25384
pluginPolicies,
25485
EntitlementBootstrap.bootstrapArgs().scopeResolver(),
25586
EntitlementBootstrap.bootstrapArgs().sourcePaths(),

0 commit comments

Comments
 (0)