honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add missing permission to repository-s3 

Repository-S3 needs a special permission because of problems in AmazonS3Client: when no region is set on a AmazonS3Client instance, the AWS SDK loads all known partitions from a JSON file and uses a Jackson's ObjectMapper for that: this one, in version 2.5.3 with the default binding options, tries to suppress access checks of ctor/field/method and thus requires this special permission. AWS must be fixed to uses Jackson correctly and have the correct modifiers on binded classes.

This must be fixed in aws sdk (see https://github.com/aws/aws-sdk-java/issues/766) but in the meanwhile we have no choice.

closes #18539
This commit is contained in:
Tanguy Leroux 2016-06-28 17:07:04 +02:00
parent d24cc65cad
commit 9bfc23e958
2 changed files with 39 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
plugins/repository-s3/src/main/java/org/elasticsearch/cloud/aws/blobstore/S3BlobContainer.java
View File

@ -26,6 +26,7 @@ import com.amazonaws.services.s3.model.ObjectListing;
import com.amazonaws.services.s3.model.ObjectMetadata;
import com.amazonaws.services.s3.model.S3Object;
import com.amazonaws.services.s3.model.S3ObjectSummary;
import org.elasticsearch.SpecialPermission;
import org.elasticsearch.common.Nullable;
import org.elasticsearch.common.blobstore.BlobMetaData;
import org.elasticsearch.common.blobstore.BlobPath;
@ -40,6 +41,9 @@ import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.security.AccessController;
import java.security.PrivilegedActionException;
import java.security.PrivilegedExceptionAction;
import java.util.Map;
/**
@ -60,8 +64,14 @@ public class S3BlobContainer extends AbstractBlobContainer {
@Override
public boolean blobExists(String blobName) {
try {
blobStore.client().getObjectMetadata(blobStore.bucket(), buildKey(blobName));
return true;
return doPrivileged(() -> {
try {
blobStore.client().getObjectMetadata(blobStore.bucket(), buildKey(blobName));
return true;
} catch (AmazonS3Exception e) {
return false;
}
});
} catch (AmazonS3Exception e) {
return false;
} catch (Throwable e) {
@ -180,4 +190,19 @@ public class S3BlobContainer extends AbstractBlobContainer {
return keyPath + blobName;
}
/**
* + * Executes a {@link PrivilegedExceptionAction} with privileges enabled.
* +
*/
<T> T doPrivileged(PrivilegedExceptionAction<T> operation) throws IOException {
SecurityManager sm = System.getSecurityManager();
if (sm != null) {
sm.checkPermission(new SpecialPermission());
}
try {
return AccessController.doPrivileged(operation);
} catch (PrivilegedActionException e) {
throw (IOException) e.getException();
}
}
}

12
plugins/repository-s3/src/main/plugin-metadata/plugin-security.policy
View File

@ -22,4 +22,16 @@ grant {
// TODO: get these fixed in aws sdk
permission java.lang.RuntimePermission "accessDeclaredMembers";
permission java.lang.RuntimePermission "getClassLoader";
// Needed because of problems in AmazonS3Client:
// When no region is set on a AmazonS3Client instance, the
// AWS SDK loads all known partitions from a JSON file and
// uses a Jackson's ObjectMapper for that: this one, in
// version 2.5.3 with the default binding options, tries
// to suppress access checks of ctor/field/method and thus
// requires this special permission. AWS must be fixed to
// uses Jackson correctly and have the correct modifiers
// on binded classes.
// TODO: get these fixed in aws sdk
// See https://github.com/aws/aws-sdk-java/issues/766
permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
};