Skip to content

Commit 1234f97

Browse files
jdconradjdconrad
authored
Refactor file path resolution for entitlements (#127040)
This change refactors the known directory resolution such as modules, plugins, lib, etc. into a PathLookup. This is one of the steps towards allowing unit tests to provide their own PathLookup for resolution so we can enable entitlements there. ES-11584
1 parent bc0e1d0 commit 1234f97

File tree

12 files changed

+242
-224
lines changed

12 files changed

+242
-224
lines changed

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/bootstrap/EntitlementBootstrap.java

+26-32
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,11 @@
1515
import com.sun.tools.attach.VirtualMachine;
1616

1717
import org.elasticsearch.core.Nullable;
18+
import org.elasticsearch.core.PathUtils;
1819
import org.elasticsearch.core.SuppressForbidden;
1920
import org.elasticsearch.entitlement.initialization.EntitlementInitialization;
21+
import org.elasticsearch.entitlement.runtime.policy.PathLookup;
22+
import org.elasticsearch.entitlement.runtime.policy.PathLookupImpl;
2023
import org.elasticsearch.entitlement.runtime.policy.Policy;
2124
import org.elasticsearch.logging.LogManager;
2225
import org.elasticsearch.logging.Logger;
@@ -37,35 +40,15 @@ public record BootstrapArgs(
3740
@Nullable Policy serverPolicyPatch,
3841
Map<String, Policy> pluginPolicies,
3942
Function<Class<?>, String> pluginResolver,
40-
Function<String, Stream<String>> settingResolver,
41-
Path[] dataDirs,
42-
Path[] sharedRepoDirs,
43-
Path configDir,
44-
Path libDir,
45-
Path modulesDir,
46-
Path pluginsDir,
43+
PathLookup pathLookup,
4744
Map<String, Path> sourcePaths,
48-
Path logsDir,
49-
Path tempDir,
50-
Path pidFile,
5145
Set<Class<?>> suppressFailureLogClasses
5246
) {
5347
public BootstrapArgs {
5448
requireNonNull(pluginPolicies);
5549
requireNonNull(pluginResolver);
56-
requireNonNull(settingResolver);
57-
requireNonNull(dataDirs);
58-
if (dataDirs.length == 0) {
59-
throw new IllegalArgumentException("must provide at least one data directory");
60-
}
61-
requireNonNull(sharedRepoDirs);
62-
requireNonNull(configDir);
63-
requireNonNull(libDir);
64-
requireNonNull(modulesDir);
65-
requireNonNull(pluginsDir);
50+
requireNonNull(pathLookup);
6651
requireNonNull(sourcePaths);
67-
requireNonNull(logsDir);
68-
requireNonNull(tempDir);
6952
requireNonNull(suppressFailureLogClasses);
7053
}
7154
}
@@ -121,23 +104,34 @@ public static void bootstrap(
121104
serverPolicyPatch,
122105
pluginPolicies,
123106
pluginResolver,
124-
settingResolver,
125-
dataDirs,
126-
sharedRepoDirs,
127-
configDir,
128-
libDir,
129-
modulesDir,
130-
pluginsDir,
107+
new PathLookupImpl(
108+
getUserHome(),
109+
configDir,
110+
dataDirs,
111+
sharedRepoDirs,
112+
libDir,
113+
modulesDir,
114+
pluginsDir,
115+
logsDir,
116+
tempDir,
117+
pidFile,
118+
settingResolver
119+
),
131120
sourcePaths,
132-
logsDir,
133-
tempDir,
134-
pidFile,
135121
suppressFailureLogClasses
136122
);
137123
exportInitializationToAgent();
138124
loadAgent(findAgentJar());
139125
}
140126

127+
private static Path getUserHome() {
128+
String userHome = System.getProperty("user.home");
129+
if (userHome == null) {
130+
throw new IllegalStateException("user.home system property is required");
131+
}
132+
return PathUtils.get(userHome);
133+
}
134+
141135
@SuppressForbidden(reason = "The VirtualMachine API is the only way to attach a java agent dynamically")
142136
private static void loadAgent(String agentPath) {
143137
try {

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java

+34-59
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,9 @@
5858
import java.nio.file.attribute.FileAttribute;
5959
import java.nio.file.spi.FileSystemProvider;
6060
import java.util.ArrayList;
61-
import java.util.Arrays;
6261
import java.util.Collections;
6362
import java.util.HashMap;
63+
import java.util.HashSet;
6464
import java.util.List;
6565
import java.util.Map;
6666
import java.util.Set;
@@ -70,10 +70,14 @@
7070
import java.util.stream.Stream;
7171
import java.util.stream.StreamSupport;
7272

73+
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.CONFIG;
74+
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.DATA;
75+
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.LIB;
76+
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.LOGS;
77+
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.MODULES;
78+
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.PLUGINS;
79+
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.SHARED_REPO;
7380
import static org.elasticsearch.entitlement.runtime.policy.Platform.LINUX;
74-
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.BaseDir.CONFIG;
75-
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.BaseDir.DATA;
76-
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.BaseDir.SHARED_REPO;
7781
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ;
7882
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ_WRITE;
7983

@@ -165,27 +169,20 @@ private static Class<?>[] findClassesToRetransform(Class<?>[] loadedClasses, Set
165169
private static PolicyManager createPolicyManager() {
166170
EntitlementBootstrap.BootstrapArgs bootstrapArgs = EntitlementBootstrap.bootstrapArgs();
167171
Map<String, Policy> pluginPolicies = bootstrapArgs.pluginPolicies();
168-
var pathLookup = new PathLookup(
169-
getUserHome(),
170-
bootstrapArgs.configDir(),
171-
bootstrapArgs.dataDirs(),
172-
bootstrapArgs.sharedRepoDirs(),
173-
bootstrapArgs.tempDir(),
174-
bootstrapArgs.settingResolver()
175-
);
172+
PathLookup pathLookup = bootstrapArgs.pathLookup();
176173

177174
List<Scope> serverScopes = new ArrayList<>();
178175
List<FileData> serverModuleFileDatas = new ArrayList<>();
179176
Collections.addAll(
180177
serverModuleFileDatas,
181178
// Base ES directories
182-
FileData.ofPath(bootstrapArgs.pluginsDir(), READ),
183-
FileData.ofPath(bootstrapArgs.modulesDir(), READ),
184-
FileData.ofPath(bootstrapArgs.configDir(), READ),
185-
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
186-
FileData.ofPath(bootstrapArgs.libDir(), READ),
187-
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE),
188-
FileData.ofRelativePath(Path.of(""), SHARED_REPO, READ_WRITE),
179+
FileData.ofBaseDirPath(PLUGINS, READ),
180+
FileData.ofBaseDirPath(MODULES, READ),
181+
FileData.ofBaseDirPath(CONFIG, READ),
182+
FileData.ofBaseDirPath(LOGS, READ_WRITE),
183+
FileData.ofBaseDirPath(LIB, READ),
184+
FileData.ofBaseDirPath(DATA, READ_WRITE),
185+
FileData.ofBaseDirPath(SHARED_REPO, READ_WRITE),
189186
// exclusive settings file
190187
FileData.ofRelativePath(Path.of("operator/settings.json"), CONFIG, READ_WRITE).withExclusive(true),
191188
// OS release on Linux
@@ -206,8 +203,8 @@ private static PolicyManager createPolicyManager() {
206203
FileData.ofPath(Path.of("/proc/self/mountinfo"), READ).withPlatform(LINUX),
207204
FileData.ofPath(Path.of("/proc/diskstats"), READ).withPlatform(LINUX)
208205
);
209-
if (bootstrapArgs.pidFile() != null) {
210-
serverModuleFileDatas.add(FileData.ofPath(bootstrapArgs.pidFile(), READ_WRITE));
206+
if (pathLookup.pidFile() != null) {
207+
serverModuleFileDatas.add(FileData.ofPath(pathLookup.pidFile(), READ_WRITE));
211208
}
212209

213210
Collections.addAll(
@@ -219,8 +216,8 @@ private static PolicyManager createPolicyManager() {
219216
new FilesEntitlement(
220217
List.of(
221218
// TODO: what in es.base is accessing shared repo?
222-
FileData.ofRelativePath(Path.of(""), SHARED_REPO, READ_WRITE),
223-
FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE)
219+
FileData.ofBaseDirPath(SHARED_REPO, READ_WRITE),
220+
FileData.ofBaseDirPath(DATA, READ_WRITE)
224221
)
225222
)
226223
)
@@ -245,25 +242,17 @@ private static PolicyManager createPolicyManager() {
245242
List.of(
246243
new LoadNativeLibrariesEntitlement(),
247244
new ManageThreadsEntitlement(),
248-
new FilesEntitlement(
249-
List.of(FileData.ofPath(bootstrapArgs.configDir(), READ), FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE))
250-
)
245+
new FilesEntitlement(List.of(FileData.ofBaseDirPath(CONFIG, READ), FileData.ofBaseDirPath(DATA, READ_WRITE)))
251246
)
252247
),
253-
new Scope(
254-
"org.apache.lucene.misc",
255-
List.of(new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE))))
256-
),
248+
new Scope("org.apache.lucene.misc", List.of(new FilesEntitlement(List.of(FileData.ofBaseDirPath(DATA, READ_WRITE))))),
257249
new Scope(
258250
"org.apache.logging.log4j.core",
259-
List.of(new ManageThreadsEntitlement(), new FilesEntitlement(List.of(FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE))))
251+
List.of(new ManageThreadsEntitlement(), new FilesEntitlement(List.of(FileData.ofBaseDirPath(LOGS, READ_WRITE))))
260252
),
261253
new Scope(
262254
"org.elasticsearch.nativeaccess",
263-
List.of(
264-
new LoadNativeLibrariesEntitlement(),
265-
new FilesEntitlement(List.of(FileData.ofRelativePath(Path.of(""), DATA, READ_WRITE)))
266-
)
255+
List.of(new LoadNativeLibrariesEntitlement(), new FilesEntitlement(List.of(FileData.ofBaseDirPath(DATA, READ_WRITE))))
267256
)
268257
);
269258

@@ -288,7 +277,7 @@ private static PolicyManager createPolicyManager() {
288277
new Scope(
289278
"org.bouncycastle.fips.core",
290279
// read to lib dir is required for checksum validation
291-
List.of(new FilesEntitlement(List.of(FileData.ofPath(bootstrapArgs.libDir(), READ))), new ManageThreadsEntitlement())
280+
List.of(new FilesEntitlement(List.of(FileData.ofBaseDirPath(LIB, READ))), new ManageThreadsEntitlement())
292281
)
293282
);
294283
}
@@ -312,21 +301,14 @@ private static PolicyManager createPolicyManager() {
312301
new LoadNativeLibrariesEntitlement(),
313302
new FilesEntitlement(
314303
List.of(
315-
FileData.ofPath(bootstrapArgs.logsDir(), READ_WRITE),
304+
FileData.ofBaseDirPath(LOGS, READ_WRITE),
316305
FileData.ofPath(Path.of("/proc/meminfo"), READ),
317306
FileData.ofPath(Path.of("/sys/fs/cgroup/"), READ)
318307
)
319308
)
320309
);
321310

322-
validateFilesEntitlements(
323-
pluginPolicies,
324-
pathLookup,
325-
bootstrapArgs.configDir(),
326-
bootstrapArgs.pluginsDir(),
327-
bootstrapArgs.modulesDir(),
328-
bootstrapArgs.libDir()
329-
);
311+
validateFilesEntitlements(pluginPolicies, pathLookup);
330312

331313
return new PolicyManager(
332314
serverPolicy,
@@ -341,21 +323,14 @@ private static PolicyManager createPolicyManager() {
341323
);
342324
}
343325

344-
private static Set<Path> pathSet(Path... paths) {
345-
return Arrays.stream(paths).map(x -> x.toAbsolutePath().normalize()).collect(Collectors.toUnmodifiableSet());
346-
}
347-
348326
// package visible for tests
349-
static void validateFilesEntitlements(
350-
Map<String, Policy> pluginPolicies,
351-
PathLookup pathLookup,
352-
Path configDir,
353-
Path pluginsDir,
354-
Path modulesDir,
355-
Path libDir
356-
) {
357-
var readAccessForbidden = pathSet(pluginsDir, modulesDir, libDir);
358-
var writeAccessForbidden = pathSet(configDir);
327+
static void validateFilesEntitlements(Map<String, Policy> pluginPolicies, PathLookup pathLookup) {
328+
Set<Path> readAccessForbidden = new HashSet<>();
329+
pathLookup.getBaseDirPaths(PLUGINS).forEach(p -> readAccessForbidden.add(p.toAbsolutePath().normalize()));
330+
pathLookup.getBaseDirPaths(MODULES).forEach(p -> readAccessForbidden.add(p.toAbsolutePath().normalize()));
331+
pathLookup.getBaseDirPaths(LIB).forEach(p -> readAccessForbidden.add(p.toAbsolutePath().normalize()));
332+
Set<Path> writeAccessForbidden = new HashSet<>();
333+
pathLookup.getBaseDirPaths(CONFIG).forEach(p -> writeAccessForbidden.add(p.toAbsolutePath().normalize()));
359334
for (var pluginPolicy : pluginPolicies.entrySet()) {
360335
for (var scope : pluginPolicy.getValue().scopes()) {
361336
var filesEntitlement = scope.entitlements()

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTree.java

+4-2
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@
3434
import static java.util.Comparator.comparing;
3535
import static org.elasticsearch.core.PathUtils.getDefaultFileSystem;
3636
import static org.elasticsearch.entitlement.runtime.policy.FileUtils.PATH_ORDER;
37+
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.CONFIG;
38+
import static org.elasticsearch.entitlement.runtime.policy.PathLookup.BaseDir.TEMP;
3739
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ_WRITE;
3840

3941
public final class FileAccessTree {
@@ -167,9 +169,9 @@ private FileAccessTree(FilesEntitlement filesEntitlement, PathLookup pathLookup,
167169
}
168170

169171
// everything has access to the temp dir, config dir, to their own dir (their own jar files) and the jdk
170-
addPathAndMaybeLink.accept(pathLookup.tempDir(), READ_WRITE);
172+
pathLookup.getBaseDirPaths(TEMP).forEach(tempPath -> addPathAndMaybeLink.accept(tempPath, READ_WRITE));
171173
// TODO: this grants read access to the config dir for all modules until explicit read entitlements can be added
172-
addPathAndMaybeLink.accept(pathLookup.configDir(), Mode.READ);
174+
pathLookup.getBaseDirPaths(CONFIG).forEach(configPath -> addPathAndMaybeLink.accept(configPath, Mode.READ));
173175
if (componentPath != null) {
174176
addPathAndMaybeLink.accept(componentPath, Mode.READ);
175177
}

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PathLookup.java

+24-9
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,29 @@
1010
package org.elasticsearch.entitlement.runtime.policy;
1111

1212
import java.nio.file.Path;
13-
import java.util.function.Function;
1413
import java.util.stream.Stream;
1514

16-
public record PathLookup(
17-
Path homeDir,
18-
Path configDir,
19-
Path[] dataDirs,
20-
Path[] sharedRepoDirs,
21-
Path tempDir,
22-
Function<String, Stream<String>> settingResolver
23-
) {}
15+
/**
16+
* Resolves paths for known directories checked by entitlements.
17+
*/
18+
public interface PathLookup {
19+
enum BaseDir {
20+
USER_HOME,
21+
CONFIG,
22+
DATA,
23+
SHARED_REPO,
24+
LIB,
25+
MODULES,
26+
PLUGINS,
27+
LOGS,
28+
TEMP
29+
}
30+
31+
Path pidFile();
32+
33+
Stream<Path> getBaseDirPaths(BaseDir baseDir);
34+
35+
Stream<Path> resolveRelativePaths(BaseDir baseDir, Path relativePath);
36+
37+
Stream<Path> resolveSettingPaths(BaseDir baseDir, String settingName);
38+
}

0 commit comments

Comments
 (0)