- * There are a few major problems that require custom {@code SecurityManager} logic to fix: - *
- * Additionally it enforces threadgroup security with the following rules: - *
- * If java security debugging ({@code java.security.debug}) is enabled, and this SecurityManager - * is installed, it will emit additional debugging information when threadgroup access checks fail. - * - * @see SecurityManager#checkAccess(Thread) - * @see SecurityManager#checkAccess(ThreadGroup) - * @see - * http://cs.oswego.edu/pipermail/concurrency-interest/2009-August/006508.html - */ -public class SecureSM extends SecurityManager { - - private final String[] classesThatCanExit; - - /** - * Creates a new security manager where no packages can exit nor halt the virtual machine. - */ - public SecureSM() { - this(new String[0]); - } - - /** - * Creates a new security manager with the specified list of regular expressions as the those that class names will be tested against to - * check whether or not a class can exit or halt the virtual machine. - * - * @param classesThatCanExit the list of classes that can exit or halt the virtual machine - */ - public SecureSM(final String[] classesThatCanExit) { - this.classesThatCanExit = classesThatCanExit; - } - - /** - * Creates a new security manager with a standard set of test packages being the only packages that can exit or halt the virtual - * machine. The packages that can exit are: - *
org.apache.maven.surefire.booter.com.carrotsearch.ant.tasks.junit4.org.eclipse.internal.junit.runner.com.intellij.rt.execution.junit.- * {@link SecureSM} enforces ThreadGroup security: threads with - * {@code RuntimePermission("modifyThread")} or {@code RuntimePermission("modifyThreadGroup")} - * are only allowed to modify their current thread group or an ancestor of that group. - *
- * In some cases (e.g. test runners), code needs to manipulate arbitrary threads,
- * so this Permission provides for that: the targets {@code modifyArbitraryThread} and
- * {@code modifyArbitraryThreadGroup} allow a thread blanket access to any group.
- *
- * @see ThreadGroup
- * @see SecureSM
- */
-public final class ThreadPermission extends BasicPermission {
-
- /**
- * Creates a new ThreadPermission object.
- *
- * @param name target name
- */
- public ThreadPermission(String name) {
- super(name);
- }
-
- /**
- * Creates a new ThreadPermission object.
- * This constructor exists for use by the {@code Policy} object to instantiate new Permission objects.
- *
- * @param name target name
- * @param actions ignored
- */
- public ThreadPermission(String name, String actions) {
- super(name, actions);
- }
-}
diff --git a/libs/secure-sm/src/test/java/org/elasticsearch/secure_sm/SecureSMTests.java b/libs/secure-sm/src/test/java/org/elasticsearch/secure_sm/SecureSMTests.java
deleted file mode 100644
index 965696d13613..000000000000
--- a/libs/secure-sm/src/test/java/org/elasticsearch/secure_sm/SecureSMTests.java
+++ /dev/null
@@ -1,158 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the "Elastic License
- * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
- * Public License v 1"; you may not use this file except in compliance with, at
- * your election, the "Elastic License 2.0", the "GNU Affero General Public
- * License v3.0 only", or the "Server Side Public License, v 1".
- */
-
-package org.elasticsearch.secure_sm;
-
-import com.carrotsearch.randomizedtesting.JUnit3MethodProvider;
-import com.carrotsearch.randomizedtesting.RandomizedRunner;
-import com.carrotsearch.randomizedtesting.RandomizedTest;
-import com.carrotsearch.randomizedtesting.annotations.TestMethodProviders;
-
-import org.elasticsearch.jdk.RuntimeVersionFeature;
-import org.junit.BeforeClass;
-import org.junit.runner.RunWith;
-
-import java.security.Permission;
-import java.security.Policy;
-import java.security.ProtectionDomain;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Set;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.stream.Collectors;
-
-/** Simple tests for SecureSM */
-@TestMethodProviders({ JUnit3MethodProvider.class })
-@RunWith(RandomizedRunner.class)
-public class SecureSMTests extends org.junit.Assert {
-
- @BeforeClass
- public static void initialize() {
- RandomizedTest.assumeFalse(
- "SecurityManager has been permanently removed in JDK 24",
- RuntimeVersionFeature.isSecurityManagerAvailable() == false
- );
- // install a mock security policy:
- // AllPermission to source code
- // ThreadPermission not granted anywhere else
- final var sourceCode = Set.of(SecureSM.class.getProtectionDomain(), RandomizedRunner.class.getProtectionDomain());
- Policy.setPolicy(new Policy() {
- @Override
- public boolean implies(ProtectionDomain domain, Permission permission) {
- if (sourceCode.contains(domain)) {
- return true;
- } else if (permission instanceof ThreadPermission) {
- return false;
- }
- return true;
- }
- });
- System.setSecurityManager(SecureSM.createTestSecureSM());
- }
-
- @SuppressForbidden(reason = "testing that System#exit is blocked")
- public void testTryToExit() {
- try {
- System.exit(1);
- fail("did not hit expected exception");
- } catch (SecurityException expected) {}
- }
-
- public void testClassCanExit() {
- assertTrue(SecureSM.classCanExit("org.apache.maven.surefire.booter.CommandReader", SecureSM.TEST_RUNNER_PACKAGES));
- assertTrue(SecureSM.classCanExit("com.carrotsearch.ant.tasks.junit4.slave.JvmExit", SecureSM.TEST_RUNNER_PACKAGES));
- assertTrue(SecureSM.classCanExit("org.eclipse.jdt.internal.junit.runner.RemoteTestRunner", SecureSM.TEST_RUNNER_PACKAGES));
- assertTrue(SecureSM.classCanExit("com.intellij.rt.execution.junit.JUnitStarter", SecureSM.TEST_RUNNER_PACKAGES));
- assertTrue(SecureSM.classCanExit("org.elasticsearch.Foo", new String[] { "org.elasticsearch.Foo" }));
- assertFalse(SecureSM.classCanExit("org.elasticsearch.Foo", new String[] { "org.elasticsearch.Bar" }));
- }
-
- public void testCreateThread() throws Exception {
- Thread t = new Thread();
- t.start();
- t.join();
- // no exception
- }
-
- public void testCreateThreadGroup() throws Exception {
- Thread t = new Thread(new ThreadGroup("childgroup"), "child");
- t.start();
- t.join();
- // no exception
- }
-
- public void testModifyChild() throws Exception {
- final AtomicBoolean interrupted = new AtomicBoolean(false);
- Thread t = new Thread(new ThreadGroup("childgroup"), "child") {
- @Override
- public void run() {
- try {
- Thread.sleep(Long.MAX_VALUE);
- } catch (InterruptedException expected) {
- interrupted.set(true);
- }
- }
- };
- t.start();
- t.interrupt();
- t.join();
- // no exception
- assertTrue(interrupted.get());
- }
-
- public void testNoModifySibling() throws Exception {
- final AtomicBoolean interrupted1 = new AtomicBoolean(false);
- final AtomicBoolean interrupted2 = new AtomicBoolean(false);
-
- final Thread t1 = new Thread(new ThreadGroup("childgroup"), "child") {
- @Override
- public void run() {
- try {
- Thread.sleep(Long.MAX_VALUE);
- } catch (InterruptedException expected) {
- interrupted1.set(true);
- }
- }
- };
- t1.start();
-
- Thread t2 = new Thread(new ThreadGroup("anothergroup"), "another child") {
- @Override
- public void run() {
- try {
- Thread.sleep(Long.MAX_VALUE);
- } catch (InterruptedException expected) {
- interrupted2.set(true);
- try {
- t1.interrupt(); // try to bogusly interrupt our sibling
- fail("did not hit expected exception");
- } catch (SecurityException expected2) {}
- }
- }
- };
- t2.start();
- t2.interrupt();
- t2.join();
- // sibling attempted to but was not able to muck with its other sibling
- assertTrue(interrupted2.get());
- assertFalse(interrupted1.get());
- // but we are the parent and can terminate
- t1.interrupt();
- t1.join();
- assertTrue(interrupted1.get());
- }
-
- public void testParallelStreamThreadGroup() throws Exception {
- List