[Security Manager Replacement] Phase off SecurityManager usage in favor of Java Agent #17861

reta · 2025-04-09T12:07:30Z

Description

Phase off SecurityManager usage in favor of Java Agent

⚠️⚠️⚠️ High risks of breaking all third-party and non-core plugins due to the changes in how the security verification is going to be performed. ⚠️⚠️⚠️

Related Issues

Closes #17662

Check List

Functionality includes testing.
API changes companion pull request created, if applicable.
Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

libs/agent-sm/agent/src/main/java/org/opensearch/javaagent/Agent.java

github-actions · 2025-04-09T12:25:36Z

❌ Gradle check result for e4b0865: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-04-09T12:52:57Z

❌ Gradle check result for 5f67ad7: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

…or of Java Agent Signed-off-by: Andriy Redko <[email protected]>

distribution/src/config/jvm.options

kumargu · 2025-04-09T13:14:57Z

overall LGTM!. thank-you @reta for this beautiful work!

github-actions · 2025-04-09T13:49:38Z

✅ Gradle check result for ebbd764: SUCCESS

codecov · 2025-04-09T13:50:41Z

Codecov Report

Attention: Patch coverage is 16.66667% with 10 lines in your changes missing coverage. Please review.

Project coverage is 72.34%. Comparing base (7b6108b) to head (ebbd764).
Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
...c/main/java/org/opensearch/bootstrap/Security.java	12.50%	7 Missing ⚠️
...java/org/opensearch/bootstrap/BootstrapChecks.java	33.33%	1 Missing and 1 partial ⚠️
.../src/main/java/org/opensearch/javaagent/Agent.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #17861      +/-   ##
============================================
- Coverage     72.44%   72.34%   -0.11%     
+ Complexity    66483    66436      -47     
============================================
  Files          5409     5407       -2     
  Lines        308282   308167     -115     
  Branches      44759    44737      -22     
============================================
- Hits         223344   222950     -394     
- Misses        66608    67027     +419     
+ Partials      18330    18190     -140

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

server/src/main/java/org/opensearch/bootstrap/BootstrapChecks.java

client/rest-high-level/src/test/resources/org/opensearch/bootstrap/test.policy

peterzhuamazon · 2025-04-09T18:07:15Z

We will onboard this to RC1 since it is merged early.

Thanks.

…or of Java Agent (opensearch-project#17861) Signed-off-by: Andriy Redko <[email protected]> Signed-off-by: Sriram Ganesh <[email protected]>

skumawat2025 · 2025-04-18T05:18:00Z

Hi @reta
After pulling the latest change i am facing issues in building a non-core plugin.

MyPluginIT > classMethod FAILED
    java.lang.NoClassDefFoundError: org/opensearch/javaagent/bootstrap/AgentPolicy$AnyCanExit
        at org.opensearch.bootstrap.BootstrapForTesting.<clinit>(BootstrapForTesting.java:191)
        at org.opensearch.test.OpenSearchTestCase.<clinit>(OpenSearchTestCase.java:331)
        at java.base/java.lang.Class.forName0(Native Method)
        at java.base/java.lang.Class.forName(Class.java:534)
        at java.base/java.lang.Class.forName(Class.java:513)
        at com.carrotsearch.randomizedtesting.RandomizedRunner$2.run(RandomizedRunner.java:623)

        Caused by:
        java.lang.ClassNotFoundException: org.opensearch.javaagent.bootstrap.AgentPolicy$AnyCanExit
            at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
            at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
            at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
            ... 6 more


Suite: Test class com.amazon.myplugin.MyPluginITPluginIT
  2> java.lang.NoClassDefFoundError: org/opensearch/javaagent/bootstrap/AgentPolicy$AnyCanExit
        at org.opensearch.bootstrap.BootstrapForTesting.<clinit>(BootstrapForTesting.java:191)
        at org.opensearch.test.OpenSearchTestCase.<clinit>(OpenSearchTestCase.java:331)
        at java.base/java.lang.Class.forName0(Native Method)
        at java.base/java.lang.Class.forName(Class.java:534)
        at java.base/java.lang.Class.forName(Class.java:513)
        at com.carrotsearch.randomizedtesting.RandomizedRunner$2.run(RandomizedRunner.java:623)

        Caused by:
        java.lang.ClassNotFoundException: org.opensearch.javaagent.bootstrap.AgentPolicy$AnyCanExit
            at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
            at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
            at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
            ... 6 more

And i doubt this is related to the Java Agent changes that we have done. Can you please take a look and suggest if its related and any resolution?

peterzhuamazon · 2025-04-18T08:38:58Z

Hi @reta After pulling the latest change i am facing issues in building a non-core plugin.

MyPluginIT > classMethod FAILED
    java.lang.NoClassDefFoundError: org/opensearch/javaagent/bootstrap/AgentPolicy$AnyCanExit
        at org.opensearch.bootstrap.BootstrapForTesting.<clinit>(BootstrapForTesting.java:191)
        at org.opensearch.test.OpenSearchTestCase.<clinit>(OpenSearchTestCase.java:331)
        at java.base/java.lang.Class.forName0(Native Method)
        at java.base/java.lang.Class.forName(Class.java:534)
        at java.base/java.lang.Class.forName(Class.java:513)
        at com.carrotsearch.randomizedtesting.RandomizedRunner$2.run(RandomizedRunner.java:623)

        Caused by:
        java.lang.ClassNotFoundException: org.opensearch.javaagent.bootstrap.AgentPolicy$AnyCanExit
            at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
            at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
            at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
            ... 6 more


Suite: Test class com.amazon.myplugin.MyPluginITPluginIT
  2> java.lang.NoClassDefFoundError: org/opensearch/javaagent/bootstrap/AgentPolicy$AnyCanExit
        at org.opensearch.bootstrap.BootstrapForTesting.<clinit>(BootstrapForTesting.java:191)
        at org.opensearch.test.OpenSearchTestCase.<clinit>(OpenSearchTestCase.java:331)
        at java.base/java.lang.Class.forName0(Native Method)
        at java.base/java.lang.Class.forName(Class.java:534)
        at java.base/java.lang.Class.forName(Class.java:513)
        at com.carrotsearch.randomizedtesting.RandomizedRunner$2.run(RandomizedRunner.java:623)

        Caused by:
        java.lang.ClassNotFoundException: org.opensearch.javaagent.bootstrap.AgentPolicy$AnyCanExit
            at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
            at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
            at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
            ... 6 more

And i doubt this is related to the Java Agent changes that we have done. Can you please take a look and suggest if its related and any resolution?

opensearch-project/ml-commons@f9edbb0

reta · 2025-04-18T12:30:05Z

And i doubt this is related to the Java Agent changes that we have done. Can you please take a look and suggest if its related and any resolution?

Hi @skumawat2025 , I cannot reproduce the issue locally (and on CI as well), the error is related to Java agent changes but should be addressed (@peterzhuamazon pointed out the right commit).

reta added security Anything security related skip-changelog labels Apr 9, 2025

reta added the v3.0.0 Issues and PRs related to version 3.0.0 label Apr 9, 2025

github-actions bot added the enhancement Enhancement or improvement to existing feature or request label Apr 9, 2025

reta mentioned this pull request Apr 9, 2025

[POC] [Security Manager Replacement] Native Java Agent (dynamic code rewriting, must be low overhead) #16731

Closed

3 tasks

reta commented Apr 9, 2025

View reviewed changes

libs/agent-sm/agent/src/main/java/org/opensearch/javaagent/Agent.java Show resolved Hide resolved

reta force-pushed the issue-17662 branch from e4b0865 to 5f67ad7 Compare April 9, 2025 12:47

reta removed the skip-changelog label Apr 9, 2025

[Security Manager Replacement] Phase off SecurityManager usage in fav…

ebbd764

…or of Java Agent Signed-off-by: Andriy Redko <[email protected]>

reta force-pushed the issue-17662 branch from 5f67ad7 to ebbd764 Compare April 9, 2025 12:56

kumargu reviewed Apr 9, 2025

View reviewed changes

distribution/src/config/jvm.options Show resolved Hide resolved

cwperks reviewed Apr 9, 2025

View reviewed changes

server/src/main/java/org/opensearch/bootstrap/BootstrapChecks.java Show resolved Hide resolved

andrross reviewed Apr 9, 2025

View reviewed changes

client/rest-high-level/src/test/resources/org/opensearch/bootstrap/test.policy Show resolved Hide resolved

peterzhuamazon mentioned this pull request Apr 9, 2025

[RELEASE] Release version 3.0.0 opensearch-project/opensearch-build#3747

Open

66 tasks

andrross approved these changes Apr 9, 2025

View reviewed changes

andrross merged commit 18b0d1c into opensearch-project:main Apr 9, 2025
33 of 49 checks passed

cwperks mentioned this pull request Apr 9, 2025

Remove reference to removed class org.opensearch.secure_sm.SecureSM #17867

Merged

3 tasks

harshavamsi mentioned this pull request Apr 10, 2025

[BUG] IntelliJ local gradle build is broken post introduction of Java agent #17883

Closed

This was referenced Apr 14, 2025

[AUTOCUT] Gradle Check Flaky Test Report for S3BlobStoreRepositoryTests #14299

Open

[AUTOCUT] Gradle Check Flaky Test Report for SegmentReplicationResizeRequestIT #17552

Open

andrross mentioned this pull request Apr 18, 2025

Permanently turn-off Security Manager (JSM) starting 3.0 #17181

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Manager Replacement] Phase off SecurityManager usage in favor of Java Agent #17861

[Security Manager Replacement] Phase off SecurityManager usage in favor of Java Agent #17861

reta commented Apr 9, 2025 •

edited

Loading

github-actions bot commented Apr 9, 2025

github-actions bot commented Apr 9, 2025

kumargu commented Apr 9, 2025

github-actions bot commented Apr 9, 2025

codecov bot commented Apr 9, 2025 •

edited

Loading

peterzhuamazon commented Apr 9, 2025

skumawat2025 commented Apr 18, 2025

peterzhuamazon commented Apr 18, 2025

reta commented Apr 18, 2025

[Security Manager Replacement] Phase off SecurityManager usage in favor of Java Agent #17861

[Security Manager Replacement] Phase off SecurityManager usage in favor of Java Agent #17861

Conversation

reta commented Apr 9, 2025 • edited Loading

Description

Related Issues

Check List

github-actions bot commented Apr 9, 2025

github-actions bot commented Apr 9, 2025

kumargu commented Apr 9, 2025

github-actions bot commented Apr 9, 2025

codecov bot commented Apr 9, 2025 • edited Loading

Codecov Report

peterzhuamazon commented Apr 9, 2025

skumawat2025 commented Apr 18, 2025

peterzhuamazon commented Apr 18, 2025

reta commented Apr 18, 2025

reta commented Apr 9, 2025 •

edited

Loading

codecov bot commented Apr 9, 2025 •

edited

Loading