Skip to content

Commit a6fce2a

Browse files
retareta
committed
[Security Manager Replacement] Native Java Agent (dynamic code rewriting, must be low overhead)
Signed-off-by: Andriy Redko <[email protected]> Signed-off-by: Andriy Redko <[email protected]>
1 parent 1acba95 commit a6fce2a

File tree

64 files changed

+4701
-81
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+4701
-81
lines changed

‎build.gradle

+7-1
Original file line numberDiff line numberDiff line change
@@ -433,12 +433,18 @@ gradle.projectsEvaluated {
433433

434434
project.tasks.withType(Test) { task ->
435435
if (task != null) {
436-
if (BuildParams.runtimeJavaVersion > JavaVersion.VERSION_17) {
436+
if (BuildParams.runtimeJavaVersion > JavaVersion.VERSION_17 && BuildParams.runtimeJavaVersion <= JavaVersion.VERSION_23) {
437437
task.jvmArgs += ["-Djava.security.manager=allow"]
438438
}
439439
if (BuildParams.runtimeJavaVersion >= JavaVersion.VERSION_20) {
440440
task.jvmArgs += ["--add-modules=jdk.incubator.vector"]
441441
}
442+
443+
// Add Java Agent for security sandboxing
444+
if (!(project.path in [':build-tools', ":libs:agent-sm:bootstrap", ":libs:agent-sm:agent"])) {
445+
dependsOn(project(':libs:agent-sm:agent').copyJars)
446+
jvmArgs += ["-javaagent:" + project(':libs:agent-sm:agent').jar.archiveFile.get()]
447+
}
442448
}
443449
}
444450

‎buildSrc/build.gradle

+2-2
Original file line numberDiff line numberDiff line change
@@ -110,12 +110,12 @@ dependencies {
110110
api 'com.netflix.nebula:gradle-info-plugin:12.1.6'
111111
api 'org.apache.rat:apache-rat:0.15'
112112
api "commons-io:commons-io:${props.getProperty('commonsio')}"
113-
api "net.java.dev.jna:jna:5.14.0"
113+
api "net.java.dev.jna:jna:5.16.0"
114114
api 'com.gradleup.shadow:shadow-gradle-plugin:8.3.5'
115115
api 'org.jdom:jdom2:2.0.6.1'
116116
api "org.jetbrains.kotlin:kotlin-stdlib-jdk8:${props.getProperty('kotlin')}"
117117
api 'de.thetaphi:forbiddenapis:3.8'
118-
api 'com.avast.gradle:gradle-docker-compose-plugin:0.17.6'
118+
api 'com.avast.gradle:gradle-docker-compose-plugin:0.17.12'
119119
api "org.yaml:snakeyaml:${props.getProperty('snakeyaml')}"
120120
api 'org.apache.maven:maven-model:3.9.6'
121121
api 'com.networknt:json-schema-validator:1.2.0'

‎buildSrc/src/main/java/org/opensearch/gradle/OpenSearchTestBasePlugin.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,8 @@ public void execute(Task t) {
115115
test.jvmArgs("--illegal-access=warn");
116116
}
117117
}
118-
if (test.getJavaVersion().compareTo(JavaVersion.VERSION_17) > 0) {
118+
if (test.getJavaVersion().compareTo(JavaVersion.VERSION_17) > 0
119+
&& test.getJavaVersion().compareTo(JavaVersion.VERSION_24) < 0) {
119120
test.jvmArgs("-Djava.security.manager=allow");
120121
}
121122
}

‎buildSrc/src/main/java/org/opensearch/gradle/test/DistroTestPlugin.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,9 @@
7777
import java.util.stream.Stream;
7878

7979
public class DistroTestPlugin implements Plugin<Project> {
80-
private static final String SYSTEM_JDK_VERSION = "21.0.6+7";
80+
private static final String SYSTEM_JDK_VERSION = "23.0.2+7";
8181
private static final String SYSTEM_JDK_VENDOR = "adoptium";
82-
private static final String GRADLE_JDK_VERSION = "21.0.6+7";
82+
private static final String GRADLE_JDK_VERSION = "23.0.2+7";
8383
private static final String GRADLE_JDK_VENDOR = "adoptium";
8484

8585
// all distributions used by distro tests. this is temporary until tests are per distribution

‎client/rest-high-level/src/test/resources/org/opensearch/bootstrap/test.policy

+1
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,5 @@
88

99
grant {
1010
permission java.net.SocketPermission "*", "connect,resolve";
11+
permission java.net.NetPermission "accessUnixDomainSocket";
1112
};

‎distribution/archives/build.gradle

+9
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,9 @@ CopySpec archiveFiles(CopySpec modulesFiles, String distributionType, String pla
3838
into('lib') {
3939
with libFiles()
4040
}
41+
into('agent') {
42+
with agentFiles()
43+
}
4144
into('config') {
4245
dirPermissions {
4346
unix 0750
@@ -226,3 +229,9 @@ subprojects {
226229

227230
group = "org.opensearch.distribution"
228231
}
232+
233+
tasks.each {
234+
if (it.name.startsWith("build")) {
235+
it.dependsOn project(':libs:agent-sm:agent').copyJars, project(':libs:agent-sm:agent').assemble
236+
}
237+
}

‎distribution/build.gradle

+6
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,12 @@ configure(subprojects.findAll { ['archives', 'packages'].contains(it.name) }) {
357357
}
358358
}
359359

360+
agentFiles = {
361+
copySpec {
362+
from(project(':libs:agent-sm:agent').copyJars)
363+
}
364+
}
365+
360366
modulesFiles = { platform ->
361367
copySpec {
362368
eachFile {

‎distribution/src/config/jvm.options

+4-1
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ ${error.file}
7777
9-:-Xlog:gc*,gc+age=trace,safepoint:file=${loggc}:utctime,pid,tags:filecount=32,filesize=64m
7878

7979
# Explicitly allow security manager (https://bugs.openjdk.java.net/browse/JDK-8270380)
80-
18-:-Djava.security.manager=allow
80+
18-23:-Djava.security.manager=allow
8181

8282
# JDK 20+ Incubating Vector Module for SIMD optimizations;
8383
# disabling may reduce performance on vector optimized lucene
@@ -89,3 +89,6 @@ ${error.file}
8989
# See please https://bugs.openjdk.org/browse/JDK-8341127 (openjdk/jdk#21283)
9090
23:-XX:CompileCommand=dontinline,java/lang/invoke/MethodHandle.setAsTypeCache
9191
23:-XX:CompileCommand=dontinline,java/lang/invoke/MethodHandle.asTypeUncached
92+
93+
# It should be JDK-24 (but we cannot bring JDK-24 since Gradle does not support it yet)
94+
21-:-javaagent:agent/opensearch-agent-3.0.0-SNAPSHOT.jar

‎distribution/tools/launchers/src/main/java/org/opensearch/tools/launchers/SystemJvmOptions.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ static List<String> systemJvmOptions() {
8585
}
8686

8787
private static String allowSecurityManagerOption() {
88-
if (Runtime.version().feature() > 17) {
88+
if (Runtime.version().feature() > 17 && Runtime.version().feature() < 24) {
8989
return "-Djava.security.manager=allow";
9090
} else {
9191
return "";

‎gradle/ide.gradle

+1-1
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ if (System.getProperty('idea.active') == 'true') {
8282
runConfigurations {
8383
defaults(JUnit) {
8484
vmParameters = '-ea -Djava.locale.providers=SPI,CLDR'
85-
if (BuildParams.runtimeJavaVersion > JavaVersion.VERSION_17) {
85+
if (BuildParams.runtimeJavaVersion > JavaVersion.VERSION_17 && BuildParams.runtimeJavaVersion < JavaVersion.VERSION_24) {
8686
vmParameters += ' -Djava.security.manager=allow'
8787
}
8888
}

‎gradle/libs.versions.toml

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ opensearch = "3.0.0"
33
lucene = "10.1.0"
44

55
bundled_jdk_vendor = "adoptium"
6-
bundled_jdk = "21.0.6+7"
6+
bundled_jdk = "23.0.2+7"
77

88
# optional dependencies
99
spatial4j = "0.7"
@@ -31,7 +31,7 @@ grpc = "1.68.2"
3131
json_smart = "2.5.2"
3232

3333
# when updating the JNA version, also update the version in buildSrc/build.gradle
34-
jna = "5.13.0"
34+
jna = "5.16.0"
3535

3636
netty = "4.1.118.Final"
3737
joda = "2.12.7"
@@ -70,9 +70,9 @@ password4j = "1.8.2"
7070
randomizedrunner = "2.7.1"
7171
junit = "4.13.2"
7272
hamcrest = "2.1"
73-
mockito = "5.14.2"
73+
mockito = "5.16.0"
7474
objenesis = "3.3"
75-
bytebuddy = "1.15.10"
75+
bytebuddy = "1.17.3"
7676

7777
# benchmark dependencies
7878
jmh = "1.35"

‎gradle/missing-javadoc.gradle

+1
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ configure([
106106
project(":libs:opensearch-secure-sm"),
107107
project(":libs:opensearch-ssl-config"),
108108
project(":libs:opensearch-x-content"),
109+
project(":libs:agent-sm:agent-policy"),
109110
project(":modules:aggs-matrix-stats"),
110111
project(":modules:analysis-common"),
111112
project(":modules:geo"),

‎libs/agent-sm/agent-policy/build.gradle

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*
8+
* Modifications Copyright OpenSearch Contributors. See
9+
* GitHub history for details.
10+
*/
11+
12+
// This file is intentionally blank. All configuration of the
13+
// distribution is done in the parent project.
14+
15+
// See please https://docs.gradle.org/8.5/userguide/upgrading_version_8.html#deprecated_missing_project_directory
16+
17+
apply plugin: 'opensearch.build'
18+
apply plugin: 'opensearch.publish'
19+
20+
ext {
21+
// Do not fail on 'warning: using incubating module(s): jdk.incubator.vector'
22+
failOnJavadocWarning = false
23+
}
24+
25+
base {
26+
archivesName = 'opensearch-agent-policy'
27+
}
28+
29+
disableTasks('forbiddenApisMain')
30+
31+
test.enabled = false
32+
testingConventions.enabled = false

‎libs/agent-sm/agent-policy/src/main/java/org/opensearch/package-info.java

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*/
8+
9+
/**
10+
* Java Agent Policy
11+
*/
12+
package org.opensearch;

0 commit comments

Comments
 (0)