Add a policy parser for Java Agent #17753
Conversation
kumargu
requested review from
anasalkouz,
andrross,
ashking94,
bugmakerrrrrr,
Bukhtawar,
CEHENKLE,
cwperks,
dblock,
dbwiddis,
gbbafna,
jainankitk,
kotwanikunal,
linuxpi,
mch2,
msfroh,
nknize,
owaiskazi19,
reta,
Rishikesh1159,
sachinpkale,
saratvemulapalli,
shwetathareja,
sohami and
VachaShah
as code owners
kumargu
force-pushed
the
policy_parser_java_agent
branch
2 times, most recently
from
72e5c43 to
49d2dde
Compare
|
❌ Gradle check result for 49d2dde: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
|
@kumargu Can you fix the precommit failures? |
kumargu
force-pushed
the
policy_parser_java_agent
branch
from
49d2dde to
2808d74
Compare
|
❌ Gradle check result for b33f1e9: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
libs/agent-sm/agent-policy/src/main/java/org/opensearch/secure_sm/policy/PolicyParser.java
Outdated
Show resolved
Hide resolved
libs/agent-sm/agent-policy/src/main/java/org/opensearch/secure_sm/policy/PolicyEntry.java
Outdated
Show resolved
Hide resolved
libs/agent-sm/agent-policy/src/main/java/org/opensearch/secure_sm/policy/GrantEntry.java
Outdated
Show resolved
Hide resolved
libs/agent-sm/agent-policy/src/main/java/org/opensearch/secure_sm/policy/PermissionEntry.java
Outdated
Show resolved
Hide resolved
kumargu
force-pushed
the
policy_parser_java_agent
branch
from
b33f1e9 to
1a4a456
Compare
|
❌ Gradle check result for 75b2a94: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
kumargu
force-pushed
the
policy_parser_java_agent
branch
from
75b2a94 to
22f63b3
Compare
|
❌ Gradle check result for 1d85a2d: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Signed-off-by: Gulshan <[email protected]>
Signed-off-by: Andrew Ross <[email protected]>
kumargu
force-pushed
the
policy_parser_java_agent
branch
from
1d85a2d to
14a3b25
Compare
Signed-off-by: Andrew Ross <[email protected]>
| disableTasks('forbiddenApisMain') | ||
|
|
||
| dependencies { | ||
| testImplementation(project(":test:framework")) |
There was a problem hiding this comment.
@kumargu sorry I am late - we cannot depend on :test:framework here since it will introduce cycle: :test:framework -> :agent -> :agent-policy :(
* Add a policy parser for java agent Signed-off-by: Gulshan <[email protected]> * Url no depricated version of url resolution Signed-off-by: Gulshan <[email protected]> * Remove unused methods and switch to modern Java collections Signed-off-by: Gulshan <[email protected]> * Use record classes and other small refactorings Signed-off-by: Andrew Ross <[email protected]> --------- Signed-off-by: Gulshan <[email protected]> Signed-off-by: Andrew Ross <[email protected]> Co-authored-by: Andrew Ross <[email protected]>
Description
The PR write a parser to parse
java-security-managerstyle policies supporting parsing Grants, Permissions and Codebases in policy files. The primary reason being: Policy parser would be removed in JDK24 and upwards. Our our policy parser would although exist needed for JAVA agent intercepting calls based on a policy. The policy grammer remains same as in JDK to support backward compatibility and avoid breaking existing plugins. The grammer however will not support Principals, KeyStore, Aliasing and Signing -- we don't need those complex stuff.The parser uses tokenization (common for parsers) to generate token and a then a Recursive Descent Parser to scan over matching token. We also support expansion of variables in CodeBase to fully keep it backward compatibility.
Related Issues
#17659
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.