Skip to content

[Java Agent] Create OpenSearch replacement for AccessController.doPrivileged #18339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
cwperks opened this issue May 19, 2025 · 0 comments · May be fixed by #18346
Open

[Java Agent] Create OpenSearch replacement for AccessController.doPrivileged #18339

cwperks opened this issue May 19, 2025 · 0 comments · May be fixed by #18346
Labels
enhancement Enhancement or improvement to existing feature or request Plugins untriaged

Comments

@cwperks
Copy link
Member

cwperks commented May 19, 2025

Is your feature request related to a problem? Please describe

For the 3.0.0 release, it was necessary to limit how the Java Agent performed StackWalking to bring it in parity with the Java Security Manager (See #17894). In that PR, the logic to extract ProtectionDomains from the callstack was limited to frames before AccessController.doPrivileged.

In the JDK, the AccessController is marked for removal and calls within the JDK are being removed (for example: openjdk/jdk24u@db7ee3d).

OpenSearch will need a replacement that plugins can use to replace their imports with the Java Agent equivalents.

Describe the solution you'd like

There are some instances of using AccessController-related code from the JDK like AccessControlContext that I don't believe OpenSearch should provide a replacement for.

i.e.

OpenSearch/plugins/ingest-attachment/src/main/java/org/opensearch/ingest/attachment/TikaImpl.java

Lines 140 to 187 in 93d5356

@SuppressWarnings("removal")
private static final AccessControlContext RESTRICTED_CONTEXT = new AccessControlContext(
new ProtectionDomain[] { new ProtectionDomain(null, getRestrictedPermissions()) }
);
// compute some minimal permissions for parsers. they only get r/w access to the java temp directory,
// the ability to load some resources from JARs, and read sysprops
@SuppressForbidden(reason = "adds access to tmp directory")
static PermissionCollection getRestrictedPermissions() {
Permissions perms = new Permissions();
// property/env access needed for parsing
perms.add(new PropertyPermission("*", "read"));
perms.add(new RuntimePermission("getenv.TIKA_CONFIG"));
try {
// add permissions for resource access:
// classpath
addReadPermissions(perms, JarHell.parseClassPath());
// plugin jars
if (TikaImpl.class.getClassLoader() instanceof URLClassLoader) {
URL[] urls = ((URLClassLoader) TikaImpl.class.getClassLoader()).getURLs();
Set<URL> set = new LinkedHashSet<>(Arrays.asList(urls));
if (set.size() != urls.length) {
throw new AssertionError("duplicate jars: " + Arrays.toString(urls));
}
addReadPermissions(perms, set);
}
// jvm's java.io.tmpdir (needs read/write)
FilePermissionUtils.addDirectoryPath(
perms,
"java.io.tmpdir",
PathUtils.get(System.getProperty("java.io.tmpdir")),
"read,readlink,write,delete",
false
);
} catch (IOException e) {
throw new UncheckedIOException(e);
}
// current hacks needed for POI/PDFbox issues:
perms.add(new SecurityPermission("putProviderProperty.BC"));
perms.add(new SecurityPermission("insertProvider"));
perms.add(new ReflectPermission("suppressAccessChecks"));
perms.add(new RuntimePermission("accessClassInPackage.sun.java2d.cmm.kcms"));
// xmlbeans, use by POI, needs to get the context classloader
perms.add(new RuntimePermission("getClassLoader"));
perms.setReadOnly();
return perms;
}

Related component

Plugins

Describe alternatives you've considered

Figure out an alternative that does not require additional grants in policy files.

Additional context

No response
@cwperks cwperks added enhancement Enhancement or improvement to existing feature or request untriaged labels May 19, 2025
@cwperks cwperks linked a pull request May 20, 2025 that will close this issue
Open
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement Enhancement or improvement to existing feature or request Plugins untriaged
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Create equivalents of JSM's AccessController in the java agent cwperks/OpenSearch
1 participant
@cwperks