Process execution checks and IT tests #119010
Conversation
prdoyle
added
>non-issue
:Core/Infra/Core
|
Pinging @elastic/es-core-infra (Team:Core/Infra) |
...ntitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java
Outdated
Show resolved
Hide resolved
| try (var classLoader = new URLClassLoader("test", new URL[0], RestEntitlementsCheckAction.class.getClassLoader())) { | ||
| logger.info("Created URLClassLoader [{}]", classLoader.getName()); | ||
| } catch (IOException e) { | ||
| throw new UncheckedIOException(e); | ||
| } | ||
| } | ||
|
|
||
| private static void processBuilder_start() { | ||
| // TODO: processBuilder().start(); |
There was a problem hiding this comment.
We can still construct a process builder, right? I suggest trying to start a jvm, since you can find the executable for the current jvm through java.home sysprop.
There was a problem hiding this comment.
Ok let me add that in a follow-on PR.
I've been passing an empty string for the command on the theory that the command doesn't matter, since whatever happens, it won't throw NotEntitledException and is therefore distinguishable from the correct behaviour.
There was a problem hiding this comment.
Follow-on PR is #119100.
💔 Backport failed
You can use sqren/backport to manually backport by running |
* Process creation checks and IT tests * Remove process queries; only forbid execution
* Process creation checks and IT tests * Remove process queries; only forbid execution
|
I did the backport manually in #119106 |
This implements checks for the process-creation methods listed under our Process Execution tab.
Supersedes #118796.
Limitation
I'm unable to test the sensitive instance methods in the
entitlement-deniedplugin because I'm not sure how to create an instance.One idea was to create them in the
entitlement-allowedplugin, which does have permission, and then pass them toentitlement-deniedbycreateComponentsand dependency injection, but when I started to code that, it seemed like a lot of complexity, and I wanted to check that's how we wanted to proceed before putting the effort into getting it working.