Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove accept SocketPermissions from core #22622

Merged
merged 6 commits into from
Jan 20, 2017
Merged

Remove accept SocketPermissions from core #22622

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
5246408
Remove accept from core
Tim-Brooks Jan 13, 2017
0a3e473
Give reindex accept permission
Tim-Brooks Jan 13, 2017
c20759f
Add comments
Tim-Brooks Jan 13, 2017
c0126cd
Merge branch 'master' into remove_accept_from_core
Tim-Brooks Jan 19, 2017
634f804
Merge branch 'master' into remove_accept_from_core
Tim-Brooks Jan 19, 2017
1647a2b
Remove unneeded permissions and security file
Tim-Brooks Jan 19, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion core/src/main/resources/org/elasticsearch/bootstrap/security.policy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ grant {
permission org.elasticsearch.SpecialPermission;

// Allow connecting to the internet anywhere
permission java.net.SocketPermission "*", "accept,connect,resolve";
permission java.net.SocketPermission "*", "connect,resolve";

// Allow read access to all system properties
permission java.util.PropertyPermission "*", "read";
Expand Down
5 changes: 5 additions & 0 deletions core/src/main/resources/org/elasticsearch/bootstrap/test-framework.policy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,3 +62,8 @@ grant codeBase "${codebase.junit-4.11.jar}" {
// needed for TestClass creation
permission java.lang.RuntimePermission "accessDeclaredMembers";
};

grant codeBase "${codebase.mocksocket-1.1.jar}" {
// mocksocket accepts socket connections
permission java.net.SocketPermission "*", "accept";
};
5 changes: 5 additions & 0 deletions modules/transport-netty4/src/main/plugin-metadata/plugin-security.policy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@
* under the License.
*/

grant {
// netty accepts socket connections
permission java.net.SocketPermission "*", "accept";
};

grant codeBase "${codebase.netty-common-4.1.7.Final.jar}" {
// for reading the system-wide configuration for the backlog of established sockets
permission java.io.FilePermission "/proc/sys/net/core/somaxconn", "read";
Expand Down