Is your feature request related to a problem? Please describe
For the 3.0.0 release, it was necessary to limit how the Java Agent performed StackWalking to bring it in parity with the Java Security Manager (See #17894). In that PR, the logic to extract ProtectionDomains from the callstack was limited to frames before AccessController.doPrivileged.
In the JDK, the AccessController is marked for removal and calls within the JDK are being removed (for example: openjdk/jdk24u@db7ee3d).
OpenSearch will need a replacement that plugins can use to replace their imports with the Java Agent equivalents.
Describe the solution you'd like
There are some instances of using AccessController-related code from the JDK like AccessControlContext that I don't believe OpenSearch should provide a replacement for.
i.e.
|
@SuppressWarnings("removal") |
|
private static final AccessControlContext RESTRICTED_CONTEXT = new AccessControlContext( |
|
new ProtectionDomain[] { new ProtectionDomain(null, getRestrictedPermissions()) } |
|
); |
|
|
|
// compute some minimal permissions for parsers. they only get r/w access to the java temp directory, |
|
// the ability to load some resources from JARs, and read sysprops |
|
@SuppressForbidden(reason = "adds access to tmp directory") |
|
static PermissionCollection getRestrictedPermissions() { |
|
Permissions perms = new Permissions(); |
|
// property/env access needed for parsing |
|
perms.add(new PropertyPermission("*", "read")); |
|
perms.add(new RuntimePermission("getenv.TIKA_CONFIG")); |
|
|
|
try { |
|
// add permissions for resource access: |
|
// classpath |
|
addReadPermissions(perms, JarHell.parseClassPath()); |
|
// plugin jars |
|
if (TikaImpl.class.getClassLoader() instanceof URLClassLoader) { |
|
URL[] urls = ((URLClassLoader) TikaImpl.class.getClassLoader()).getURLs(); |
|
Set<URL> set = new LinkedHashSet<>(Arrays.asList(urls)); |
|
if (set.size() != urls.length) { |
|
throw new AssertionError("duplicate jars: " + Arrays.toString(urls)); |
|
} |
|
addReadPermissions(perms, set); |
|
} |
|
// jvm's java.io.tmpdir (needs read/write) |
|
FilePermissionUtils.addDirectoryPath( |
|
perms, |
|
"java.io.tmpdir", |
|
PathUtils.get(System.getProperty("java.io.tmpdir")), |
|
"read,readlink,write,delete", |
|
false |
|
); |
|
} catch (IOException e) { |
|
throw new UncheckedIOException(e); |
|
} |
|
// current hacks needed for POI/PDFbox issues: |
|
perms.add(new SecurityPermission("putProviderProperty.BC")); |
|
perms.add(new SecurityPermission("insertProvider")); |
|
perms.add(new ReflectPermission("suppressAccessChecks")); |
|
perms.add(new RuntimePermission("accessClassInPackage.sun.java2d.cmm.kcms")); |
|
// xmlbeans, use by POI, needs to get the context classloader |
|
perms.add(new RuntimePermission("getClassLoader")); |
|
perms.setReadOnly(); |
|
return perms; |
|
} |
Related component
Plugins
Describe alternatives you've considered
Figure out an alternative that does not require additional grants in policy files.
Additional context
No response
