mirror of https://github.com/apache/lucene.git
109 lines
5.0 KiB
Plaintext
109 lines
5.0 KiB
Plaintext
/*
|
|
* Licensed to the Apache Software Foundation (ASF) under one or more
|
|
* contributor license agreements. See the NOTICE file distributed with
|
|
* this work for additional information regarding copyright ownership.
|
|
* The ASF licenses this file to You under the Apache License, Version 2.0
|
|
* (the "License"); you may not use this file except in compliance with
|
|
* the License. You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
// Policy file for lucene tests. Please keep minimal and avoid wildcards.
|
|
|
|
grant {
|
|
// 3rd party jar resources (where symlinks are not supported), test-files/ resources
|
|
permission java.io.FilePermission "${common.dir}${/}-", "read";
|
|
// system jar resources, and let TestIndexWriterOnJRECrash fork its jvm
|
|
permission java.io.FilePermission "${java.home}${/}-", "read,execute";
|
|
|
|
// write only to sandbox
|
|
permission java.io.FilePermission "${java.io.tmpdir}", "read,write";
|
|
permission java.io.FilePermission "${java.io.tmpdir}${/}-", "read,write,delete";
|
|
permission java.io.FilePermission "${tests.linedocsfile}", "read";
|
|
|
|
// misc HardlinkCopyDirectoryWrapper needs this to test if hardlinks can be created
|
|
permission java.nio.file.LinkPermission "hard";
|
|
// needed by SSD detection tests in TestIOUtils (creates symlinks)
|
|
permission java.nio.file.LinkPermission "symbolic";
|
|
|
|
// needed by randomizedtesting runner to identify test methods.
|
|
permission java.lang.RuntimePermission "accessDeclaredMembers";
|
|
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
|
|
// needed by certain tests to redirect sysout/syserr:
|
|
permission java.lang.RuntimePermission "setIO";
|
|
// needed by randomized runner to catch failures from other threads:
|
|
permission java.lang.RuntimePermission "setDefaultUncaughtExceptionHandler";
|
|
// needed by randomized runner getTopThreadGroup:
|
|
permission java.lang.RuntimePermission "modifyThreadGroup";
|
|
// needed by tests e.g. shutting down executors:
|
|
permission java.lang.RuntimePermission "modifyThread";
|
|
// needed for tons of test hacks etc
|
|
permission java.lang.RuntimePermission "getStackTrace";
|
|
// needed for mock filesystems in tests
|
|
permission java.lang.RuntimePermission "fileSystemProvider";
|
|
// needed for test of IOUtils.spins (maybe it can be avoided)
|
|
permission java.lang.RuntimePermission "getFileStoreAttributes";
|
|
// analyzers/uima: needed by lucene expressions' JavascriptCompiler
|
|
permission java.lang.RuntimePermission "createClassLoader";
|
|
// needed to test unmap hack on platforms that support it
|
|
permission java.lang.RuntimePermission "accessClassInPackage.sun.misc";
|
|
// needed by cyberneko usage by benchmarks on J9
|
|
permission java.lang.RuntimePermission "accessClassInPackage.org.apache.xerces.util";
|
|
// needed by jacoco to dump coverage
|
|
permission java.lang.RuntimePermission "shutdownHooks";
|
|
// needed by org.apache.logging.log4j
|
|
permission java.lang.RuntimePermission "getenv.*";
|
|
permission java.lang.RuntimePermission "getClassLoader";
|
|
permission java.lang.RuntimePermission "setContextClassLoader";
|
|
|
|
// allows LuceneTestCase#runWithRestrictedPermissions to execute with lower (or no) permission
|
|
permission java.security.SecurityPermission "createAccessControlContext";
|
|
|
|
// read access to all system properties.
|
|
permission java.util.PropertyPermission "*", "read";
|
|
|
|
// write access to only these.
|
|
|
|
// environment randomization
|
|
permission java.util.PropertyPermission "user.language", "write";
|
|
permission java.util.PropertyPermission "user.timezone", "write";
|
|
|
|
// CMS randomization
|
|
permission java.util.PropertyPermission "lucene.cms.override_core_count", "write";
|
|
permission java.util.PropertyPermission "lucene.cms.override_spins", "write";
|
|
|
|
// used by nested tests? (e.g. TestLeaveFilesIfTestFails). TODO: look into this
|
|
permission java.util.PropertyPermission "tests.runnested", "write";
|
|
|
|
// Used by LuceneTestCase to set up TestRuleRestoreSystemProperties.
|
|
// TODO: move it to Solr or modify TestRuleRestoreSystemProperties not to fail on inaccessible properties?
|
|
permission java.util.PropertyPermission "solr.data.dir", "write";
|
|
permission java.util.PropertyPermission "solr.solr.home", "write";
|
|
permission java.util.PropertyPermission "solr.directoryFactory", "write";
|
|
};
|
|
|
|
|
|
// Grant all permissions to Gradle test runner classes.
|
|
|
|
grant codeBase "file:${gradle.lib.dir}${/}-" {
|
|
permission java.security.AllPermission;
|
|
};
|
|
|
|
grant codeBase "file:${gradle.worker.jar}" {
|
|
permission java.security.AllPermission;
|
|
};
|
|
|
|
grant {
|
|
// Allow reading gradle worker JAR.
|
|
permission java.io.FilePermission "${gradle.worker.jar}", "read";
|
|
// Allow reading from classpath JARs (resources).
|
|
permission java.io.FilePermission "${gradle.user.home}${/}-", "read";
|
|
};
|