Skip to content

Commit 8964f63

Browse files
retareta
authored
Fix FileInterceptor's delete calls for Unix Domain Sockets on Windows (#17873)
* Fix FileInterceptor's delete calls for Unix Domain Sockets on Windows Signed-off-by: Andriy Redko <drreta@gmail.com> * Added NetPermission check for UNIX Domain Socket deletion on Windows Signed-off-by: Andriy Redko <drreta@gmail.com> --------- Signed-off-by: Andriy Redko <drreta@gmail.com>
1 parent 18a3b75 commit 8964f63

File tree

1 file changed

+53
-41
lines changed

1 file changed

+53
-41
lines changed

‎libs/agent-sm/agent/src/main/java/org/opensearch/javaagent/FileInterceptor.java

Lines changed: 53 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
import java.io.FilePermission;
1414
import java.lang.reflect.Method;
15+
import java.net.NetPermission;
1516
import java.nio.file.OpenOption;
1617
import java.nio.file.Path;
1718
import java.nio.file.Paths;
@@ -71,59 +72,70 @@ public static void intercept(@Advice.AllArguments Object[] args, @Advice.Origin
7172
boolean isMutating = name.equals("move") || name.equals("write") || name.startsWith("create");
7273
final boolean isDelete = isMutating == false ? name.startsWith("delete") : false;
7374

74-
String targetFilePath = null;
75-
if (isMutating == false && isDelete == false) {
76-
if (name.equals("newByteChannel") == true || name.equals("open") == true) {
77-
if (args.length > 1 && args[1] instanceof OpenOption[] opts) {
78-
for (final OpenOption opt : opts) {
79-
if (opt != StandardOpenOption.READ) {
80-
isMutating = true;
81-
break;
82-
}
83-
}
84-
85-
}
86-
} else if (name.equals("copy") == true) {
87-
if (args.length > 1 && args[1] instanceof String pathStr) {
88-
targetFilePath = Paths.get(pathStr).toAbsolutePath().toString();
89-
} else if (args.length > 1 && args[1] instanceof Path path) {
90-
targetFilePath = path.toAbsolutePath().toString();
75+
// This is Windows implementation of UNIX Domain Sockets (close)
76+
if (isDelete == true
77+
&& walker.getCallerClass().getName().equalsIgnoreCase("sun.nio.ch.PipeImpl$Initializer$LoopbackConnector") == true) {
78+
final NetPermission permission = new NetPermission("accessUnixDomainSocket");
79+
for (ProtectionDomain domain : callers) {
80+
if (!policy.implies(domain, permission)) {
81+
throw new SecurityException("Denied access to: " + filePath + ", domain " + domain);
9182
}
9283
}
93-
}
84+
} else {
85+
String targetFilePath = null;
86+
if (isMutating == false && isDelete == false) {
87+
if (name.equals("newByteChannel") == true || name.equals("open") == true) {
88+
if (args.length > 1 && args[1] instanceof OpenOption[] opts) {
89+
for (final OpenOption opt : opts) {
90+
if (opt != StandardOpenOption.READ) {
91+
isMutating = true;
92+
break;
93+
}
94+
}
9495

95-
// Check each permission separately
96-
for (final ProtectionDomain domain : callers) {
97-
// Handle FileChannel.open() separately to check read/write permissions properly
98-
if (method.getName().equals("open")) {
99-
if (isMutating == true && !policy.implies(domain, new FilePermission(filePath, "read,write"))) {
100-
throw new SecurityException("Denied OPEN (read/write) access to file: " + filePath + ", domain: " + domain);
101-
} else if (!policy.implies(domain, new FilePermission(filePath, "read"))) {
102-
throw new SecurityException("Denied OPEN (read) access to file: " + filePath + ", domain: " + domain);
96+
}
97+
} else if (name.equals("copy") == true) {
98+
if (args.length > 1 && args[1] instanceof String pathStr) {
99+
targetFilePath = Paths.get(pathStr).toAbsolutePath().toString();
100+
} else if (args.length > 1 && args[1] instanceof Path path) {
101+
targetFilePath = path.toAbsolutePath().toString();
102+
}
103103
}
104104
}
105105

106-
// Handle Files.copy() separately to check read/write permissions properly
107-
if (method.getName().equals("copy")) {
108-
if (!policy.implies(domain, new FilePermission(filePath, "read"))) {
109-
throw new SecurityException("Denied COPY (read) access to file: " + filePath + ", domain: " + domain);
106+
// Check each permission separately
107+
for (final ProtectionDomain domain : callers) {
108+
// Handle FileChannel.open() separately to check read/write permissions properly
109+
if (method.getName().equals("open")) {
110+
if (isMutating == true && !policy.implies(domain, new FilePermission(filePath, "read,write"))) {
111+
throw new SecurityException("Denied OPEN (read/write) access to file: " + filePath + ", domain: " + domain);
112+
} else if (!policy.implies(domain, new FilePermission(filePath, "read"))) {
113+
throw new SecurityException("Denied OPEN (read) access to file: " + filePath + ", domain: " + domain);
114+
}
110115
}
111116

112-
if (targetFilePath != null) {
113-
if (!policy.implies(domain, new FilePermission(targetFilePath, "write"))) {
114-
throw new SecurityException("Denied COPY (write) access to file: " + targetFilePath + ", domain: " + domain);
117+
// Handle Files.copy() separately to check read/write permissions properly
118+
if (method.getName().equals("copy")) {
119+
if (!policy.implies(domain, new FilePermission(filePath, "read"))) {
120+
throw new SecurityException("Denied COPY (read) access to file: " + filePath + ", domain: " + domain);
121+
}
122+
123+
if (targetFilePath != null) {
124+
if (!policy.implies(domain, new FilePermission(targetFilePath, "write"))) {
125+
throw new SecurityException("Denied COPY (write) access to file: " + targetFilePath + ", domain: " + domain);
126+
}
115127
}
116128
}
117-
}
118129

119-
// File mutating operations
120-
if (isMutating && !policy.implies(domain, new FilePermission(filePath, "write"))) {
121-
throw new SecurityException("Denied WRITE access to file: " + filePath + ", domain: " + domain);
122-
}
130+
// File mutating operations
131+
if (isMutating && !policy.implies(domain, new FilePermission(filePath, "write"))) {
132+
throw new SecurityException("Denied WRITE access to file: " + filePath + ", domain: " + domain);
133+
}
123134

124-
// File deletion operations
125-
if (isDelete && !policy.implies(domain, new FilePermission(filePath, "delete"))) {
126-
throw new SecurityException("Denied DELETE access to file: " + filePath + ", domain: " + domain);
135+
// File deletion operations
136+
if (isDelete && !policy.implies(domain, new FilePermission(filePath, "delete"))) {
137+
throw new SecurityException("Denied DELETE access to file: " + filePath + ", domain: " + domain);
138+
}
127139
}
128140
}
129141
}

0 commit comments

Comments
 (0)