Create equivalents of JSM's AccessController in the java agent #18346

cwperks · 2025-05-20T20:34:25Z

Description

The classes in this PR were on a former iteration of #17894

This PR creates replacements for JSM's AccessController which is marked for removal from the JDK. While JSM was replaced with the java agent in 3.0.0, the logic to extract the ProtectionDomains from the call stack relies on the AccessController to limit the frames when examining the stack. The java agent needs to retain this code marker to know when to stop walking the stack and this PR creates OpenSearch equivalents to the AccessController which is a simple wrapper around a runnable block of code.

Related Issues

Resolves #18339

Check List

Functionality includes testing.
API changes companion pull request created, if applicable.
Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

…oller Signed-off-by: Craig Perkins <cwperx@amazon.com>

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks · 2025-05-20T20:35:35Z

libs/agent-sm/bootstrap/src/main/java/org/opensearch/javaagent/bootstrap/AccessController.java

+ * compatible open source license.
+ */
+
+package org.opensearch.javaagent.bootstrap;


I don't know the right module for this code. The server has a dependency on this lib, but its marked as compileOnly. How are the other classes in this module (like AgentPolicy) available at runtime?

I believe jars passed to the JVM via -javaagent are available on the classpath, so the compileOnly dependency is making the assumption this will be provided at runtime via a -javaagent.

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2025-05-20T21:51:23Z

✅ Gradle check result for 366406f: SUCCESS

codecov · 2025-05-20T21:52:06Z

Codecov Report

Attention: Patch coverage is 50.00000% with 14 lines in your changes missing coverage. Please review.

Project coverage is 72.62%. Comparing base (a8bd494) to head (e7270f7).
Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
...va/org/opensearch/ingest/geoip/GeoIpProcessor.java	44.44%	10 Missing ⚠️
...ent/StackCallerProtectionDomainChainExtractor.java	0.00%	4 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #18346      +/-   ##
============================================
- Coverage     72.81%   72.62%   -0.19%     
+ Complexity    68209    68113      -96     
============================================
  Files          5541     5542       +1     
  Lines        313390   313396       +6     
  Branches      45472    45472              
============================================
- Hits         228196   227608     -588     
- Misses        66671    67247     +576     
- Partials      18523    18541      +18

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

libs/agent-sm/bootstrap/src/main/java/org/opensearch/javaagent/bootstrap/AccessController.java

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2025-05-21T17:12:19Z

❕ Gradle check result for 53be672: UNSTABLE

Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

libs/agent-sm/bootstrap/src/main/java/org/opensearch/javaagent/bootstrap/AccessController.java

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2025-05-22T20:56:15Z

❌ Gradle check result for 00c22c7: null

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2025-05-23T20:05:49Z

❌ Gradle check result for d79bdc1: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Craig Perkins <cwperx@amazon.com>

modules/ingest-geoip/src/main/java/org/opensearch/ingest/geoip/GeoIpProcessor.java

github-actions · 2025-05-23T21:19:52Z

❌ Gradle check result for 9cfa314: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

cwperks · 2025-06-19T03:12:18Z

@andrross All comments have been addressed. Can you re-review this PR?

server/build.gradle

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2025-06-19T22:11:29Z

✅ Gradle check result for 9a3f3f2: SUCCESS

kumargu · 2025-06-20T04:43:36Z

This is going to need changing the imports across multiple plugins?

andrross · 2025-06-20T14:11:58Z

This is going to need changing the imports across multiple plugins?

@kumargu We'll continue to support both the JDK-based access controller and the new version as long as the JDK still contains those classes. Plugins should have a long time to make the update (likely the entire 3.x series at least).

kumargu · 2025-06-20T14:24:43Z

This is going to need changing the imports across multiple plugins?

@kumargu We'll continue to support both the JDK-based access controller and the new version as long as the JDK still contains those classes. Plugins should have a long time to make the update (likely the entire 3.x series at least).

Gotcha. makes sense.

.../agent/src/main/java/org/opensearch/javaagent/StackCallerProtectionDomainChainExtractor.java

libs/agent-sm/agent-policy/src/main/java/org/opensearch/security/AccessController.java

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2025-06-20T16:03:21Z

✅ Gradle check result for 8950858: SUCCESS

libs/agent-sm/agent-policy/src/main/java/org/opensearch/security/package-info.java

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2025-06-20T20:36:32Z

❌ Gradle check result for c6a61fc: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-06-20T22:02:31Z

❌ Gradle check result for 5c32ba2: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-06-21T00:30:45Z

❕ Gradle check result for 5c32ba2: UNSTABLE

Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions · 2025-06-21T14:33:01Z

✅ Gradle check result for e7270f7: SUCCESS

…earch-project#18346) * Create OpenSearch replacements for widely used methods in AccessController Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix javadoc Signed-off-by: Craig Perkins <cwperx@amazon.com> * Remove getException Signed-off-by: Craig Perkins <cwperx@amazon.com> * Remove other instance of apiNote Signed-off-by: Craig Perkins <cwperx@amazon.com> * Modify javadoc and restart stuck CI checks Signed-off-by: Craig Perkins <cwperx@amazon.com> * Remove mistakenly added line Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add to CHANGELOG Signed-off-by: Craig Perkins <cwperx@amazon.com> * Address code review feedback Signed-off-by: Craig Perkins <cwperx@amazon.com> * Use callable and runnable Signed-off-by: Craig Perkins <cwperx@amazon.com> * Use Callable Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add checked equivalents to interface Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add throws IllegalArgumentException Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix precommit Signed-off-by: Craig Perkins <cwperx@amazon.com> * Show example of replacement in a module Signed-off-by: Craig Perkins <cwperx@amazon.com> * Address code review comments Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix precommit Signed-off-by: Craig Perkins <cwperx@amazon.com> * Address code review comments Signed-off-by: Craig Perkins <cwperx@amazon.com> * Create separate agent-api lib and remove compileOnlyApi Signed-off-by: Craig Perkins <cwperx@amazon.com> * Re-use agent-policy lib Signed-off-by: Craig Perkins <cwperx@amazon.com> * Address review comments Signed-off-by: Craig Perkins <cwperx@amazon.com> * Move to secure_sm package Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix conflicts in CHANGELOG Signed-off-by: Craig Perkins <cwperx@amazon.com> --------- Signed-off-by: Craig Perkins <cwperx@amazon.com>Signed-off-by: TJ Neuenfeldt <tjneu@amazon.com>

…earch-project#18346) * Create OpenSearch replacements for widely used methods in AccessController Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix javadoc Signed-off-by: Craig Perkins <cwperx@amazon.com> * Remove getException Signed-off-by: Craig Perkins <cwperx@amazon.com> * Remove other instance of apiNote Signed-off-by: Craig Perkins <cwperx@amazon.com> * Modify javadoc and restart stuck CI checks Signed-off-by: Craig Perkins <cwperx@amazon.com> * Remove mistakenly added line Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add to CHANGELOG Signed-off-by: Craig Perkins <cwperx@amazon.com> * Address code review feedback Signed-off-by: Craig Perkins <cwperx@amazon.com> * Use callable and runnable Signed-off-by: Craig Perkins <cwperx@amazon.com> * Use Callable Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add checked equivalents to interface Signed-off-by: Craig Perkins <cwperx@amazon.com> * Add throws IllegalArgumentException Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix precommit Signed-off-by: Craig Perkins <cwperx@amazon.com> * Show example of replacement in a module Signed-off-by: Craig Perkins <cwperx@amazon.com> * Address code review comments Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix precommit Signed-off-by: Craig Perkins <cwperx@amazon.com> * Address code review comments Signed-off-by: Craig Perkins <cwperx@amazon.com> * Create separate agent-api lib and remove compileOnlyApi Signed-off-by: Craig Perkins <cwperx@amazon.com> * Re-use agent-policy lib Signed-off-by: Craig Perkins <cwperx@amazon.com> * Address review comments Signed-off-by: Craig Perkins <cwperx@amazon.com> * Move to secure_sm package Signed-off-by: Craig Perkins <cwperx@amazon.com> * Fix conflicts in CHANGELOG Signed-off-by: Craig Perkins <cwperx@amazon.com> --------- Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks added 6 commits May 20, 2025 16:26

Create OpenSearch replacements for widely used methods in AccessContr…

5beafae

…oller Signed-off-by: Craig Perkins <cwperx@amazon.com>

Fix javadoc

e8248de

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Remove getException

9afced3

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Remove other instance of apiNote

a0a0d9f

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Modify javadoc and restart stuck CI checks

cc5a240

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Remove mistakenly added line

a172f67

Signed-off-by: Craig Perkins <cwperx@amazon.com>

github-actions bot added enhancement Enhancement or improvement to existing feature or request Plugins labels May 20, 2025

cwperks changed the title ~~Create OpenSearch equivalents of JSM's AccessController~~ Create equivalents of JSM's AccessController in the java agent May 20, 2025

cwperks commented May 20, 2025

View reviewed changes

Add to CHANGELOG

366406f

Signed-off-by: Craig Perkins <cwperx@amazon.com>

andrross reviewed May 20, 2025

View reviewed changes

Address code review feedback

53be672

Signed-off-by: Craig Perkins <cwperx@amazon.com>

andrross reviewed May 21, 2025

View reviewed changes

libs/agent-sm/bootstrap/src/main/java/org/opensearch/javaagent/bootstrap/AccessController.java Outdated Show resolved Hide resolved

cwperks added 3 commits May 22, 2025 14:43

Use callable and runnable

18ccef4

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Use Callable

44eb148

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Merge branch 'main' into access-controller

00c22c7

opensearch-ci-bot mentioned this pull request May 23, 2025

[AUTOCUT] Gradle Check Flaky Test Report for RemoteRestoreSnapshotIT #14324

Open

cwperks added 3 commits May 23, 2025 15:49

Add checked equivalents to interface

3678956

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Add throws IllegalArgumentException

0d6e1b3

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Merge branch 'main' into access-controller

d79bdc1

cwperks added 2 commits May 23, 2025 16:20

Fix precommit

71ba997

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Show example of replacement in a module

9cfa314

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks commented May 23, 2025

View reviewed changes

modules/ingest-geoip/src/main/java/org/opensearch/ingest/geoip/GeoIpProcessor.java Outdated Show resolved Hide resolved

andrross reviewed Jun 19, 2025

View reviewed changes

server/build.gradle Outdated Show resolved Hide resolved

cwperks added 2 commits June 19, 2025 16:35

Create separate agent-api lib and remove compileOnlyApi

dc7eafd

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Re-use agent-policy lib

9a3f3f2

Signed-off-by: Craig Perkins <cwperx@amazon.com>

kumargu reviewed Jun 20, 2025

View reviewed changes

.../agent/src/main/java/org/opensearch/javaagent/StackCallerProtectionDomainChainExtractor.java Show resolved Hide resolved

libs/agent-sm/agent-policy/src/main/java/org/opensearch/security/AccessController.java Outdated Show resolved Hide resolved

Address review comments

8950858

Signed-off-by: Craig Perkins <cwperx@amazon.com>

kumargu approved these changes Jun 20, 2025

View reviewed changes

andrross reviewed Jun 20, 2025

View reviewed changes

libs/agent-sm/agent-policy/src/main/java/org/opensearch/security/package-info.java Outdated Show resolved Hide resolved

Move to secure_sm package

c6a61fc

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Merge branch 'main' into access-controller

5c32ba2

andrross approved these changes Jun 20, 2025

View reviewed changes

opensearch-ci-bot mentioned this pull request Jun 20, 2025

[AUTOCUT] Gradle Check Flaky Test Report for ReactorNetty4StreamingStressIT #15840

Closed

This was referenced Jun 21, 2025

[AUTOCUT] Gradle Check Flaky Test Report for RestoreShallowSnapshotV2IT #16658

Open

[AUTOCUT] Gradle Check Flaky Test Report for ShardIndexingPressureSettingsIT #14331

Open

kumargu approved these changes Jun 21, 2025

View reviewed changes

cwperks added 2 commits June 21, 2025 09:07

Merge branch 'main' into access-controller

235bd69

Fix conflicts in CHANGELOG

e7270f7

Signed-off-by: Craig Perkins <cwperx@amazon.com>

cwperks merged commit d015573 into opensearch-project:main Jun 23, 2025
30 of 31 checks passed

opensearch-ci-bot mentioned this pull request Jun 27, 2025

[AUTOCUT] Gradle Check Flaky Test Report for ClientYamlTestSuiteIT #14319

Open

Create equivalents of JSM's AccessController in the java agent #18346

Create equivalents of JSM's AccessController in the java agent #18346

Uh oh!

Conversation

cwperks commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Check List

Uh oh!

cwperks May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrross May 20, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented May 20, 2025

Uh oh!

codecov bot commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented May 21, 2025

Uh oh!

Uh oh!

github-actions bot commented May 22, 2025

Uh oh!

github-actions bot commented May 23, 2025

Uh oh!

Uh oh!

github-actions bot commented May 23, 2025

Uh oh!

cwperks commented Jun 19, 2025

Uh oh!

Uh oh!

github-actions bot commented Jun 19, 2025

Uh oh!

kumargu commented Jun 20, 2025

Uh oh!

andrross commented Jun 20, 2025

Uh oh!

kumargu commented Jun 20, 2025

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jun 20, 2025

Uh oh!

Uh oh!

github-actions bot commented Jun 20, 2025

Uh oh!

github-actions bot commented Jun 20, 2025

Uh oh!

github-actions bot commented Jun 21, 2025

Uh oh!

github-actions bot commented Jun 21, 2025

Uh oh!

Uh oh!

Uh oh!

cwperks commented May 20, 2025 •

edited

Loading

cwperks May 20, 2025 •

edited

Loading

codecov bot commented May 20, 2025 •

edited

Loading