Examples with PermissionCollection java.security.PermissionCollection used on opensource projects

Example 51 with PermissionCollection

use of java.security.PermissionCollection in project elasticsearch by elastic.

the class PluginSecurity method parsePermissions.

/**
     * Parses plugin policy into a set of permissions
     */
static PermissionCollection parsePermissions(Terminal terminal, Path file, Path tmpDir) throws IOException {
    // create a zero byte file for "comparison"
    // this is necessary because the default policy impl automatically grants two permissions:
    // 1. permission to exitVM (which we ignore)
    // 2. read permission to the code itself (e.g. jar file of the code)
    Path emptyPolicyFile = Files.createTempFile(tmpDir, "empty", "tmp");
    final Policy emptyPolicy;
    try {
        emptyPolicy = Policy.getInstance("JavaPolicy", new URIParameter(emptyPolicyFile.toUri()));
    } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException(e);
    }
    IOUtils.rm(emptyPolicyFile);
    // parse the plugin's policy file into a set of permissions
    final Policy policy;
    try {
        policy = Policy.getInstance("JavaPolicy", new URIParameter(file.toUri()));
    } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException(e);
    }
    PermissionCollection permissions = policy.getPermissions(PluginSecurity.class.getProtectionDomain());
    // this method is supported with the specific implementation we use, but just check for safety.
    if (permissions == Policy.UNSUPPORTED_EMPTY_COLLECTION) {
        throw new UnsupportedOperationException("JavaPolicy implementation does not support retrieving permissions");
    }
    PermissionCollection actualPermissions = new Permissions();
    for (Permission permission : Collections.list(permissions.elements())) {
        if (!emptyPolicy.implies(PluginSecurity.class.getProtectionDomain(), permission)) {
            actualPermissions.add(permission);
        }
    }
    actualPermissions.setReadOnly();
    return actualPermissions;
}

Example 52 with PermissionCollection

use of java.security.PermissionCollection in project elasticsearch by elastic.

the class ClassPermissionTests method testPermissionCollection.

public void testPermissionCollection() {
    ClassPermission math = new ClassPermission("java.lang.Math");
    PermissionCollection collection = math.newPermissionCollection();
    collection.add(math);
    assertTrue(collection.implies(new ClassPermission("java.lang.Math")));
    assertFalse(collection.implies(new ClassPermission("pkg.MyClass")));
}

Example 53 with PermissionCollection

use of java.security.PermissionCollection in project elasticsearch by elastic.

the class ClassPermissionTests method testPermissionCollectionWildcards.

public void testPermissionCollectionWildcards() {
    ClassPermission lang = new ClassPermission("java.lang.*");
    PermissionCollection collection = lang.newPermissionCollection();
    collection.add(lang);
    assertTrue(collection.implies(new ClassPermission("java.lang.Math")));
    assertFalse(collection.implies(new ClassPermission("pkg.MyClass")));
}

Example 54 with PermissionCollection

use of java.security.PermissionCollection in project elasticsearch by elastic.

the class PluginSecurityTests method testParseTwoPermissions.

/** Test that we can parse the set of permissions correctly for a complex policy */
public void testParseTwoPermissions() throws Exception {
    assumeTrue("test cannot run with security manager enabled", System.getSecurityManager() == null);
    Path scratch = createTempDir();
    Path testFile = this.getDataPath("security/complex-plugin-security.policy");
    Permissions expected = new Permissions();
    expected.add(new RuntimePermission("getClassLoader"));
    expected.add(new RuntimePermission("closeClassLoader"));
    PermissionCollection actual = PluginSecurity.parsePermissions(Terminal.DEFAULT, testFile, scratch);
    assertEquals(expected, actual);
}

Example 55 with PermissionCollection

use of java.security.PermissionCollection in project elasticsearch by elastic.

the class ESPolicyUnitTests method testListen.

public void testListen() {
    assumeTrue("test cannot run with security manager", System.getSecurityManager() == null);
    final PermissionCollection noPermissions = new Permissions();
    final ESPolicy policy = new ESPolicy(noPermissions, Collections.emptyMap(), true);
    assertFalse(policy.implies(new ProtectionDomain(ESPolicyUnitTests.class.getProtectionDomain().getCodeSource(), noPermissions), new SocketPermission("localhost:" + randomFrom(0, randomIntBetween(49152, 65535)), "listen")));
}