- 
                Notifications
    
You must be signed in to change notification settings  - Fork 25.6k
 
[Entitlements] Implement entry point definitions via checker function signature #116754
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Entitlements] Implement entry point definitions via checker function signature #116754
Conversation
| 
           Pinging @elastic/es-core-infra (Team:Core/Infra)  | 
    
        
          
                ...nt/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java
          
            Show resolved
            Hide resolved
        
              
          
                ...tlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/InstrumentationTarget.java
              
                Outdated
          
            Show resolved
            Hide resolved
        
      There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
First initial pass. I'm intending to take a second look...
        
          
                ...tlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/InstrumentationTarget.java
              
                Outdated
          
            Show resolved
            Hide resolved
        
              
          
                ...nt/src/main/java/org/elasticsearch/entitlement/initialization/EntitlementInitialization.java
          
            Show resolved
            Hide resolved
        
              
          
                ...main/java/org/elasticsearch/entitlement/instrumentation/impl/InstrumentationServiceImpl.java
              
                Outdated
          
            Show resolved
            Hide resolved
        
      …mentation-targets
| 
           The annotation name  
 In an earlier branch of mine, I used the name   | 
    
| 
           As discussed in the sync, removed annotations in favour of "name mangling", i.e. using only the function signature (name + arguments) to identify the method to instrument.  | 
    
| 
           @elasticmachine update branch  | 
    
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just some debatable style comments. If you disagree with all of them, I think this is mergeable as-is. 😂
        
          
                ...main/java/org/elasticsearch/entitlement/instrumentation/impl/InstrumentationServiceImpl.java
              
                Outdated
          
            Show resolved
            Hide resolved
        
      | String.format( | ||
| Locale.ROOT, | ||
| "Checker method %s has incorrect name format. " | ||
| + "It should be either check$$methodName (instance) or check$package_ClassName$methodName (static)", | 
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Huh, that's kind of clever, but I'm torn on it. On the one hand, this reduces redundancy because the class could already be derived from the argument list in the case of an instance method. But on the other hand, a uniform name-mangling convention seems desirable too. 🤔
        
          
                ...java/org/elasticsearch/entitlement/instrumentation/impl/InstrumentationServiceImplTests.java
              
                Outdated
          
            Show resolved
            Hide resolved
        
      …mentation-targets
          💔 Backport failed
 You can use sqren/backport to manually backport by running   | 
    
* [Entitlements] Consider only system modules in the boot layer (#117017) * [Entitlements] Implement entry point definitions via checker function signature (#116754) * Policy manager for entitlements (#116695) * Add java version variants of entitlements checker (#116878) As each version of Java is released, there may be additional methods we want to instrument for entitlements. Since new methods won't exist in the base version of Java that Elasticsearch is compiled with, we need to hava different classes and compilation for each version. This commit adds a scaffolding for adding the classes for new versions of Java. Unfortunately it requires several classes in different locations. But hopefully these are infrequent enough that the boilerplate is ok. We could consider adding a helper Gradle task to templatize the new classes in the future if it is too cumbersome. Note that the example for Java23 does not have anything meaningful in it yet, it's only meant as an example until we find go through classes and methods that were added after Java 21. * Spotless --------- Co-authored-by: Lorenzo Dematté <lorenzo.dematte@elastic.co> Co-authored-by: Jack Conradson <osjdconrad@gmail.com> Co-authored-by: Patrick Doyle <patrick.doyle@elastic.co>
This PR implements automatic entry-point description for Instrumenter, implementing Option 1 from Entitlement checks and entry-point definition.
It introduces one annotation (@InstrumentationTarget) to use onEntitlementCheckermethods to specify which method in the JVM the check is targeting. The annotation will be used to populate aMethodKey, like before.This PR also changes the way to describe the checker method to inject in the target prologue: before, it was a
java.reflect.Method, now it's simple record namedCheckerMethod.This is because we decided to avoid using reflection, and use ASM to scan and find functions, so to avoid any chance of loading additional types before instrumentation.
EDIT:
After discussing options we the team, we came up with the idea to avoid using annotations and try and express everything in one place (in this case, the function signature, name + arguments).
The name and arguments of the checker will directly point to the class/method to instrument (always by populating a
MethodKey, like before.Examples: