|
| 1 | +/* |
| 2 | + * Licensed to Elasticsearch under one or more contributor |
| 3 | + * license agreements. See the NOTICE file distributed with |
| 4 | + * this work for additional information regarding copyright |
| 5 | + * ownership. Elasticsearch licenses this file to you under |
| 6 | + * the Apache License, Version 2.0 (the "License"); you may |
| 7 | + * not use this file except in compliance with the License. |
| 8 | + * You may obtain a copy of the License at |
| 9 | + * |
| 10 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 11 | + * |
| 12 | + * Unless required by applicable law or agreed to in writing, |
| 13 | + * software distributed under the License is distributed on an |
| 14 | + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 15 | + * KIND, either express or implied. See the License for the |
| 16 | + * specific language governing permissions and limitations |
| 17 | + * under the License. |
| 18 | + */ |
| 19 | + |
| 20 | +package org.elasticsearch; |
| 21 | + |
| 22 | +import java.security.BasicPermission; |
| 23 | + |
| 24 | +/** |
| 25 | + * Elasticsearch-specific permission to check before entering |
| 26 | + * {@code AccessController.doPrivileged()} blocks. |
| 27 | + * <p> |
| 28 | + * We try to avoid these blocks in our code and keep security simple, |
| 29 | + * but we need them for a few special places to contain hacks for third |
| 30 | + * party code, or dangerous things used by scripting engines. |
| 31 | + * <p> |
| 32 | + * All normal code has this permission, but checking this before truncating the stack |
| 33 | + * prevents unprivileged code (e.g. scripts), which do not have it, from gaining elevated |
| 34 | + * privileges. |
| 35 | + * <p> |
| 36 | + * In other words, don't do this: |
| 37 | + * <br> |
| 38 | + * <pre><code> |
| 39 | + * // throw away all information about caller and run with our own privs |
| 40 | + * AccessController.doPrivileged( |
| 41 | + * ... |
| 42 | + * ); |
| 43 | + * </code></pre> |
| 44 | + * <br> |
| 45 | + * Instead do this; |
| 46 | + * <br> |
| 47 | + * <pre><code> |
| 48 | + * // check caller first, to see if they should be allowed to do this |
| 49 | + * SecurityManager sm = System.getSecurityManager(); |
| 50 | + * if (sm != null) { |
| 51 | + * sm.checkPermission(new SpecialPermission()); |
| 52 | + * } |
| 53 | + * // throw away all information about caller and run with our own privs |
| 54 | + * AccessController.doPrivileged( |
| 55 | + * ... |
| 56 | + * ); |
| 57 | + * </code></pre> |
| 58 | + */ |
| 59 | +public final class SpecialPermission extends BasicPermission { |
| 60 | + |
| 61 | + private static final long serialVersionUID = -4129500096157408168L; |
| 62 | + |
| 63 | + /** |
| 64 | + * Creates a new SpecialPermision object. |
| 65 | + */ |
| 66 | + public SpecialPermission() { |
| 67 | + // TODO: if we really need we can break out name (e.g. "hack" or "scriptEngineService" or whatever). |
| 68 | + // but let's just keep it simple if we can. |
| 69 | + super("*"); |
| 70 | + } |
| 71 | + |
| 72 | + /** |
| 73 | + * Creates a new SpecialPermission object. |
| 74 | + * This constructor exists for use by the {@code Policy} object to instantiate new Permission objects. |
| 75 | + * |
| 76 | + * @param name ignored |
| 77 | + * @param actions ignored |
| 78 | + */ |
| 79 | + public SpecialPermission(String name, String actions) { |
| 80 | + this(); |
| 81 | + } |
| 82 | +} |
0 commit comments