honeymoose/OpenSearch
1
0
Fork 0
mirror of https://github.com/honeymoose/OpenSearch.git synced 2025-03-24 17:09:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: Add versionless alias to all security policy codebase properties (#26756)

Browse Source 
This is a followup to #26521. This commit expands the alias added for
the elasticsearch client codebase to all codebases. The original full
jar name property is left intact. This only adds an alias without the
version, which should help ease the pain in updating any versions (ES
itself or dependencies).
This commit is contained in:
Ryan Ernst 2017-11-10 11:00:09 -08:00 committed by GitHub
parent bec5d43228
commit 8b9e23de93
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 29 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
core/src/main/java/org/elasticsearch/bootstrap/Security.java
View File

@ -199,28 +199,28 @@ final class Security {
try {
// set codebase properties
for (URL url : codebases) {
String shortName = PathUtils.get(url.toURI()).getFileName().toString();
if (shortName.endsWith(".jar") == false) {
String fileName = PathUtils.get(url.toURI()).getFileName().toString();
if (fileName.endsWith(".jar") == false) {
continue; // tests :(
}
String property = "codebase." + shortName;
if (shortName.startsWith("elasticsearch-rest-client")) {
// The rest client is currently the only example where we have an elasticsearch built artifact
// which needs special permissions in policy files when used. This temporary solution is to
// pass in an extra system property that omits the -version.jar suffix the other properties have.
// That allows the snapshots to reference snapshot builds of the client, and release builds to
// referenced release builds of the client, all with the same grant statements.
final String esVersion = Version.CURRENT + (Build.CURRENT.isSnapshot() ? "-SNAPSHOT" : "");
final int index = property.indexOf("-" + esVersion + ".jar");
assert index >= 0;
String restClientAlias = property.substring(0, index);
propertiesSet.add(restClientAlias);
System.setProperty(restClientAlias, url.toString());
// We attempt to use a versionless identifier for each codebase. This assumes a specific version
// format in the jar filename. While we cannot ensure all jars in all plugins use this format, nonconformity
// only means policy grants would need to include the entire jar filename as they always have before.
String property = "codebase." + fileName;
String aliasProperty = "codebase." + fileName.replaceFirst("-\\d+\\.\\d+.*\\.jar", "");
if (aliasProperty.equals(property) == false) {
propertiesSet.add(aliasProperty);
String previous = System.setProperty(aliasProperty, url.toString());
if (previous != null) {
throw new IllegalStateException("codebase property already set: " + aliasProperty + " -> " + previous +
", cannot set to " + url.toString());
}
}
propertiesSet.add(property);
String previous = System.setProperty(property, url.toString());
if (previous != null) {
throw new IllegalStateException("codebase property already set: " + shortName + "->" + previous);
throw new IllegalStateException("codebase property already set: " + property + " -> " + previous +
", cannot set to " + url.toString());
}
}
return Policy.getInstance("JavaPolicy", new URIParameter(policyFile.toURI()));

6
core/src/main/resources/org/elasticsearch/bootstrap/security.policy
View File

@ -24,14 +24,14 @@
//// SecurityManager impl:
//// Must have all permissions to properly perform access checks
grant codeBase "${codebase.securesm-1.1.jar}" {
grant codeBase "${codebase.securesm}" {
permission java.security.AllPermission;
};
//// Very special jar permissions:
//// These are dangerous permissions that we don't want to grant to everything.
grant codeBase "${codebase.lucene-core-7.1.0.jar}" {
grant codeBase "${codebase.lucene-core}" {
// needed to allow MMapDirectory's "unmap hack" (die unmap hack, die)
// java 8 package
permission java.lang.RuntimePermission "accessClassInPackage.sun.misc";
@ -42,7 +42,7 @@ grant codeBase "${codebase.lucene-core-7.1.0.jar}" {
permission java.lang.RuntimePermission "accessDeclaredMembers";
};
grant codeBase "${codebase.lucene-misc-7.1.0.jar}" {
grant codeBase "${codebase.lucene-misc}" {
// needed to allow shard shrinking to use hard-links if possible via lucenes HardlinkCopyDirectoryWrapper
permission java.nio.file.LinkPermission "hard";
};

14
core/src/main/resources/org/elasticsearch/bootstrap/test-framework.policy
View File

@ -21,7 +21,7 @@
//// These are mock objects and test management that we allow test framework libs
//// to provide on our behalf. But tests themselves cannot do this stuff!
grant codeBase "${codebase.securemock-1.2.jar}" {
grant codeBase "${codebase.securemock}" {
// needed to access ReflectionFactory (see below)
permission java.lang.RuntimePermission "accessClassInPackage.sun.reflect";
// needed for reflection in ibm jdk
@ -33,7 +33,7 @@ grant codeBase "${codebase.securemock-1.2.jar}" {
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
};
grant codeBase "${codebase.lucene-test-framework-7.1.0.jar}" {
grant codeBase "${codebase.lucene-test-framework}" {
// needed by RamUsageTester
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
// needed for testing hardlinks in StoreRecoveryTests since we install MockFS
@ -42,7 +42,7 @@ grant codeBase "${codebase.lucene-test-framework-7.1.0.jar}" {
permission java.lang.RuntimePermission "accessDeclaredMembers";
};
grant codeBase "${codebase.randomizedtesting-runner-2.5.2.jar}" {
grant codeBase "${codebase.randomizedtesting-runner}" {
// optionally needed for access to private test methods (e.g. beforeClass)
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
// needed to fail tests on uncaught exceptions from other threads
@ -53,12 +53,12 @@ grant codeBase "${codebase.randomizedtesting-runner-2.5.2.jar}" {
permission java.lang.RuntimePermission "accessDeclaredMembers";
};
grant codeBase "${codebase.junit-4.12.jar}" {
grant codeBase "${codebase.junit}" {
// needed for TestClass creation
permission java.lang.RuntimePermission "accessDeclaredMembers";
};
grant codeBase "${codebase.mocksocket-1.2.jar}" {
grant codeBase "${codebase.mocksocket}" {
// mocksocket makes and accepts socket connections
permission java.net.SocketPermission "*", "accept,connect";
};
@ -70,12 +70,12 @@ grant codeBase "${codebase.elasticsearch-rest-client}" {
permission java.net.NetPermission "getProxySelector";
};
grant codeBase "${codebase.httpcore-nio-4.4.5.jar}" {
grant codeBase "${codebase.httpcore-nio}" {
// httpcore makes socket connections for rest tests
permission java.net.SocketPermission "*", "connect";
};
grant codeBase "${codebase.httpasyncclient-4.1.2.jar}" {
grant codeBase "${codebase.httpasyncclient}" {
// httpasyncclient makes socket connections for rest tests
permission java.net.SocketPermission "*", "connect";
// rest client uses system properties which gets the default proxy

2
modules/reindex/src/main/plugin-metadata/plugin-security.policy
View File

@ -27,7 +27,7 @@ grant codeBase "${codebase.elasticsearch-rest-client}" {
permission java.net.NetPermission "getProxySelector";
};
grant codeBase "${codebase.httpasyncclient-4.1.2.jar}" {
grant codeBase "${codebase.httpasyncclient}" {
// rest client uses system properties which gets the default proxy
permission java.net.NetPermission "getProxySelector";
};

4
modules/transport-netty4/src/main/plugin-metadata/plugin-security.policy
View File

@ -17,7 +17,7 @@
* under the License.
*/
grant codeBase "${codebase.netty-common-4.1.13.Final.jar}" {
grant codeBase "${codebase.netty-common}" {
// for reading the system-wide configuration for the backlog of established sockets
permission java.io.FilePermission "/proc/sys/net/core/somaxconn", "read";
@ -25,7 +25,7 @@ grant codeBase "${codebase.netty-common-4.1.13.Final.jar}" {
permission java.net.SocketPermission "*", "accept,connect";
};
grant codeBase "${codebase.netty-transport-4.1.13.Final.jar}" {
grant codeBase "${codebase.netty-transport}" {
// Netty NioEventLoop wants to change this, because of https://bugs.openjdk.java.net/browse/JDK-6427854
// the bug says it only happened rarely, and that its fixed, but apparently it still happens rarely!
permission java.util.PropertyPermission "sun.nio.ch.bugLevel", "write";