|
| 1 | +/* |
| 2 | + * Licensed to Elasticsearch under one or more contributor |
| 3 | + * license agreements. See the NOTICE file distributed with |
| 4 | + * this work for additional information regarding copyright |
| 5 | + * ownership. Elasticsearch licenses this file to you under |
| 6 | + * the Apache License, Version 2.0 (the "License"); you may |
| 7 | + * not use this file except in compliance with the License. |
| 8 | + * You may obtain a copy of the License at |
| 9 | + * |
| 10 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 11 | + * |
| 12 | + * Unless required by applicable law or agreed to in writing, |
| 13 | + * software distributed under the License is distributed on an |
| 14 | + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 15 | + * KIND, either express or implied. See the License for the |
| 16 | + * specific language governing permissions and limitations |
| 17 | + * under the License. |
| 18 | + */ |
| 19 | + |
| 20 | +package org.elasticsearch.plugins; |
| 21 | + |
| 22 | +import org.elasticsearch.common.cli.Terminal; |
| 23 | +import org.elasticsearch.common.cli.Terminal.Verbosity; |
| 24 | +import org.elasticsearch.env.Environment; |
| 25 | + |
| 26 | +import java.io.IOException; |
| 27 | +import java.nio.file.Files; |
| 28 | +import java.nio.file.Path; |
| 29 | +import java.security.NoSuchAlgorithmException; |
| 30 | +import java.security.Permission; |
| 31 | +import java.security.PermissionCollection; |
| 32 | +import java.security.Permissions; |
| 33 | +import java.security.Policy; |
| 34 | +import java.security.URIParameter; |
| 35 | +import java.security.UnresolvedPermission; |
| 36 | +import java.util.Collections; |
| 37 | +import java.util.Comparator; |
| 38 | +import java.util.List; |
| 39 | + |
| 40 | +class PluginSecurity { |
| 41 | + |
| 42 | + /** |
| 43 | + * Reads plugin policy, prints/confirms exceptions |
| 44 | + */ |
| 45 | + static void readPolicy(Path file, Terminal terminal, Environment environment, boolean batch) throws IOException { |
| 46 | + PermissionCollection permissions = parsePermissions(terminal, file, environment.tmpFile()); |
| 47 | + List<Permission> requested = Collections.list(permissions.elements()); |
| 48 | + if (requested.isEmpty()) { |
| 49 | + terminal.print(Verbosity.VERBOSE, "plugin has a policy file with no additional permissions"); |
| 50 | + return; |
| 51 | + } |
| 52 | + |
| 53 | + // sort permissions in a reasonable order |
| 54 | + Collections.sort(requested, new Comparator<Permission>() { |
| 55 | + @Override |
| 56 | + public int compare(Permission o1, Permission o2) { |
| 57 | + int cmp = o1.getClass().getName().compareTo(o2.getClass().getName()); |
| 58 | + if (cmp == 0) { |
| 59 | + String name1 = o1.getName(); |
| 60 | + String name2 = o2.getName(); |
| 61 | + if (name1 == null) { |
| 62 | + name1 = ""; |
| 63 | + } |
| 64 | + if (name2 == null) { |
| 65 | + name2 = ""; |
| 66 | + } |
| 67 | + cmp = name1.compareTo(name2); |
| 68 | + if (cmp == 0) { |
| 69 | + String actions1 = o1.getActions(); |
| 70 | + String actions2 = o2.getActions(); |
| 71 | + if (actions1 == null) { |
| 72 | + actions1 = ""; |
| 73 | + } |
| 74 | + if (actions2 == null) { |
| 75 | + actions2 = ""; |
| 76 | + } |
| 77 | + cmp = actions1.compareTo(actions2); |
| 78 | + } |
| 79 | + } |
| 80 | + return cmp; |
| 81 | + } |
| 82 | + }); |
| 83 | + |
| 84 | + terminal.println(Verbosity.NORMAL, "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); |
| 85 | + terminal.println(Verbosity.NORMAL, "@ WARNING: plugin requires additional permissions @"); |
| 86 | + terminal.println(Verbosity.NORMAL, "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); |
| 87 | + // print all permissions: |
| 88 | + for (Permission permission : requested) { |
| 89 | + terminal.println(Verbosity.NORMAL, "* %s", formatPermission(permission)); |
| 90 | + } |
| 91 | + terminal.println(Verbosity.NORMAL, "See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html"); |
| 92 | + terminal.println(Verbosity.NORMAL, "for descriptions of what these permissions allow and the associated risks."); |
| 93 | + if (!batch) { |
| 94 | + terminal.println(Verbosity.NORMAL); |
| 95 | + String text = terminal.readText("Continue with installation? [y/N]"); |
| 96 | + if (!text.equalsIgnoreCase("y")) { |
| 97 | + throw new RuntimeException("installation aborted by user"); |
| 98 | + } |
| 99 | + } |
| 100 | + } |
| 101 | + |
| 102 | + /** Format permission type, name, and actions into a string */ |
| 103 | + static String formatPermission(Permission permission) { |
| 104 | + StringBuilder sb = new StringBuilder(); |
| 105 | + |
| 106 | + String clazz = null; |
| 107 | + if (permission instanceof UnresolvedPermission) { |
| 108 | + clazz = ((UnresolvedPermission) permission).getUnresolvedType(); |
| 109 | + } else { |
| 110 | + clazz = permission.getClass().getName(); |
| 111 | + } |
| 112 | + sb.append(clazz); |
| 113 | + |
| 114 | + String name = null; |
| 115 | + if (permission instanceof UnresolvedPermission) { |
| 116 | + name = ((UnresolvedPermission) permission).getUnresolvedName(); |
| 117 | + } else { |
| 118 | + name = permission.getName(); |
| 119 | + } |
| 120 | + if (name != null && name.length() > 0) { |
| 121 | + sb.append(' '); |
| 122 | + sb.append(name); |
| 123 | + } |
| 124 | + |
| 125 | + String actions = null; |
| 126 | + if (permission instanceof UnresolvedPermission) { |
| 127 | + actions = ((UnresolvedPermission) permission).getUnresolvedActions(); |
| 128 | + } else { |
| 129 | + actions = permission.getActions(); |
| 130 | + } |
| 131 | + if (actions != null && actions.length() > 0) { |
| 132 | + sb.append(' '); |
| 133 | + sb.append(actions); |
| 134 | + } |
| 135 | + return sb.toString(); |
| 136 | + } |
| 137 | + |
| 138 | + /** |
| 139 | + * Parses plugin policy into a set of permissions |
| 140 | + */ |
| 141 | + static PermissionCollection parsePermissions(Terminal terminal, Path file, Path tmpDir) throws IOException { |
| 142 | + // create a zero byte file for "comparison" |
| 143 | + // this is necessary because the default policy impl automatically grants two permissions: |
| 144 | + // 1. permission to exitVM (which we ignore) |
| 145 | + // 2. read permission to the code itself (e.g. jar file of the code) |
| 146 | + |
| 147 | + Path emptyPolicyFile = Files.createTempFile(tmpDir, "empty", "tmp"); |
| 148 | + final Policy emptyPolicy; |
| 149 | + try { |
| 150 | + emptyPolicy = Policy.getInstance("JavaPolicy", new URIParameter(emptyPolicyFile.toUri())); |
| 151 | + } catch (NoSuchAlgorithmException e) { |
| 152 | + throw new RuntimeException(e); |
| 153 | + } |
| 154 | + PluginManager.tryToDeletePath(terminal, emptyPolicyFile); |
| 155 | + |
| 156 | + // parse the plugin's policy file into a set of permissions |
| 157 | + final Policy policy; |
| 158 | + try { |
| 159 | + policy = Policy.getInstance("JavaPolicy", new URIParameter(file.toUri())); |
| 160 | + } catch (NoSuchAlgorithmException e) { |
| 161 | + throw new RuntimeException(e); |
| 162 | + } |
| 163 | + PermissionCollection permissions = policy.getPermissions(PluginSecurity.class.getProtectionDomain()); |
| 164 | + // this method is supported with the specific implementation we use, but just check for safety. |
| 165 | + if (permissions == Policy.UNSUPPORTED_EMPTY_COLLECTION) { |
| 166 | + throw new UnsupportedOperationException("JavaPolicy implementation does not support retrieving permissions"); |
| 167 | + } |
| 168 | + PermissionCollection actualPermissions = new Permissions(); |
| 169 | + for (Permission permission : Collections.list(permissions.elements())) { |
| 170 | + if (!emptyPolicy.implies(PluginSecurity.class.getProtectionDomain(), permission)) { |
| 171 | + actualPermissions.add(permission); |
| 172 | + } |
| 173 | + } |
| 174 | + actualPermissions.setReadOnly(); |
| 175 | + return actualPermissions; |
| 176 | + } |
| 177 | +} |
0 commit comments