diff --git a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyCheckerImpl.java b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyCheckerImpl.java index 97236e653f4ba..acfdbb0caded7 100644 --- a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyCheckerImpl.java +++ b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyCheckerImpl.java @@ -137,7 +137,7 @@ private void neverEntitled(Class callerClass, Supplier operationDescr requestingClass, operationDescription.get() ), - callerClass, + requestingClass, entitlements ); } @@ -249,7 +249,7 @@ public void checkFileRead(Class callerClass, Path path, boolean followLinks) requestingClass, realPath == null ? path : Strings.format("%s -> %s", path, realPath) ), - callerClass, + requestingClass, entitlements ); } @@ -281,7 +281,7 @@ public void checkFileWrite(Class callerClass, Path path) { requestingClass, path ), - callerClass, + requestingClass, entitlements ); } @@ -358,8 +358,8 @@ public void checkAllNetworkAccess(Class callerClass) { } var classEntitlements = policyManager.getEntitlements(requestingClass); - checkFlagEntitlement(classEntitlements, InboundNetworkEntitlement.class, requestingClass, callerClass); - checkFlagEntitlement(classEntitlements, OutboundNetworkEntitlement.class, requestingClass, callerClass); + checkFlagEntitlement(classEntitlements, InboundNetworkEntitlement.class, requestingClass); + checkFlagEntitlement(classEntitlements, OutboundNetworkEntitlement.class, requestingClass); } @Override @@ -376,16 +376,15 @@ public void checkWriteProperty(Class callerClass, String property) { ModuleEntitlements entitlements = policyManager.getEntitlements(requestingClass); if (entitlements.getEntitlements(WriteSystemPropertiesEntitlement.class).anyMatch(e -> e.properties().contains(property))) { - entitlements.logger() - .debug( - () -> Strings.format( - "Entitled: component [%s], module [%s], class [%s], entitlement [write_system_properties], property [%s]", - entitlements.componentName(), - entitlements.moduleName(), - requestingClass, - property - ) - ); + PolicyManager.generalLogger.debug( + () -> Strings.format( + "Entitled: component [%s], module [%s], class [%s], entitlement [write_system_properties], property [%s]", + entitlements.componentName(), + entitlements.moduleName(), + requestingClass, + property + ) + ); return; } notEntitled( @@ -396,7 +395,7 @@ public void checkWriteProperty(Class callerClass, String property) { requestingClass, property ), - callerClass, + requestingClass, entitlements ); } @@ -437,8 +436,7 @@ Optional findRequestingFrame(Stream entitlementClass, - Class requestingClass, - Class callerClass + Class requestingClass ) { if (classEntitlements.hasEntitlement(entitlementClass) == false) { notEntitled( @@ -449,27 +447,26 @@ private void checkFlagEntitlement( requestingClass, PolicyParser.buildEntitlementNameFromClass(entitlementClass) ), - callerClass, + requestingClass, classEntitlements ); } - classEntitlements.logger() - .debug( - () -> Strings.format( - "Entitled: component [%s], module [%s], class [%s], entitlement [%s]", - classEntitlements.componentName(), - classEntitlements.moduleName(), - requestingClass, - PolicyParser.buildEntitlementNameFromClass(entitlementClass) - ) - ); + PolicyManager.generalLogger.debug( + () -> Strings.format( + "Entitled: component [%s], module [%s], class [%s], entitlement [%s]", + classEntitlements.componentName(), + classEntitlements.moduleName(), + requestingClass, + PolicyParser.buildEntitlementNameFromClass(entitlementClass) + ) + ); } - private void notEntitled(String message, Class callerClass, ModuleEntitlements entitlements) { + private void notEntitled(String message, Class requestingClass, ModuleEntitlements entitlements) { var exception = new NotEntitledException(message); // Don't emit a log for suppressed packages, e.g. packages containing self tests - if (suppressFailureLogPackages.contains(callerClass.getPackage()) == false) { - entitlements.logger().warn("Not entitled: {}", message, exception); + if (suppressFailureLogPackages.contains(requestingClass.getPackage()) == false) { + entitlements.logger(requestingClass).warn("Not entitled: {}", message, exception); } throw exception; } @@ -480,7 +477,7 @@ public void checkEntitlementPresent(Class callerClass, Class, List> entitlementsByType, - FileAccessTree fileAccess, - Logger logger + FileAccessTree fileAccess ) { public ModuleEntitlements { @@ -143,6 +142,12 @@ public Stream getEntitlements(Class entitlementCla } return entitlements.stream().map(entitlementClass::cast); } + + Logger logger(Class requestingClass) { + var packageName = requestingClass.getPackageName(); + var loggerSuffix = "." + componentName + "." + ((moduleName == null) ? ALL_UNNAMED : moduleName) + "." + packageName; + return LogManager.getLogger(PolicyManager.class.getName() + loggerSuffix); + } } private FileAccessTree getDefaultFileAccess(Collection componentPaths) { @@ -151,13 +156,7 @@ private FileAccessTree getDefaultFileAccess(Collection componentPaths) { // pkg private for testing ModuleEntitlements defaultEntitlements(String componentName, Collection componentPaths, String moduleName) { - return new ModuleEntitlements( - componentName, - moduleName, - Map.of(), - getDefaultFileAccess(componentPaths), - getLogger(componentName, moduleName) - ); + return new ModuleEntitlements(componentName, moduleName, Map.of(), getDefaultFileAccess(componentPaths)); } // pkg private for testing @@ -177,8 +176,7 @@ ModuleEntitlements policyEntitlements( componentName, moduleName, entitlements.stream().collect(groupingBy(Entitlement::getClass)), - FileAccessTree.of(componentName, moduleName, filesEntitlement, pathLookup, componentPaths, exclusivePaths), - getLogger(componentName, moduleName) + FileAccessTree.of(componentName, moduleName, filesEntitlement, pathLookup, componentPaths, exclusivePaths) ); } @@ -288,21 +286,6 @@ private static void validateEntitlementsPerModule( } } - private static Logger getLogger(String componentName, String moduleName) { - var loggerSuffix = "." + componentName + "." + ((moduleName == null) ? ALL_UNNAMED : moduleName); - return MODULE_LOGGERS.computeIfAbsent(PolicyManager.class.getName() + loggerSuffix, LogManager::getLogger); - } - - /** - * We want to use the same {@link Logger} object for a given name, because we want {@link ModuleEntitlements} - * {@code equals} and {@code hashCode} to work. - *

- * This would not be required if LogManager - * memoized the loggers, - * but here we are. - */ - private static final ConcurrentHashMap MODULE_LOGGERS = new ConcurrentHashMap<>(); - protected ModuleEntitlements getEntitlements(Class requestingClass) { return moduleEntitlementsMap.computeIfAbsent(requestingClass.getModule(), m -> computeEntitlements(requestingClass)); }