Skip to content

Support phasing off SecurityManager usage in favor of Java Agent #3724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Support phasing off SecurityManager usage in favor of Java Agent #3724

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,16 @@ allprojects {
}

project.getExtensions().getExtraProperties().set("versions", VersionProperties.getVersions());
}

configurations {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just curious, if we are already doing this in the root gradle file, do we still need to do the same for all the modules?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yup. one way to not do it across other modules is to include these on sub-projects, but that hasn't given me much of a success.

As-of-now, it seems like duplicating it across modules works. However this change in temporary to keep us unblocked. We may just define it at one place after this PR opensearch-project/OpenSearch#17900 is being merged and tested once.

agent
}

dependencies {
agent "org.opensearch:opensearch-agent-bootstrap:${opensearch_version}"
agent "org.opensearch:opensearch-agent:${opensearch_version}"
agent "net.bytebuddy:byte-buddy:1.17.5"
}

subprojects {
Expand Down Expand Up @@ -115,3 +124,13 @@ task updateVersion {
ant.replaceregexp(file:'build.gradle', match: '"opensearch.version", "\\d.*"', replace: '"opensearch.version", "' + newVersion.tokenize('-')[0] + '-SNAPSHOT"', flags:'g', byline:true)
}
}

task prepareAgent(type: Copy) {
from(configurations.agent)
into "$buildDir/agent"
}

tasks.withType(Test) {
dependsOn prepareAgent
jvmArgs += ["-javaagent:" + project.layout.buildDirectory.file("agent/opensearch-agent-${opensearch_version}.jar").get()]
}
18 changes: 18 additions & 0 deletions common/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,10 @@ plugins {
id 'signing'
}

configurations {
agent
}

dependencies {
compileOnly group: 'org.opensearch', name: 'opensearch', version: "${opensearch_version}"
compileOnly group: 'org.reflections', name: 'reflections', version: '0.9.12'
Expand Down Expand Up @@ -44,6 +48,10 @@ dependencies {
compileOnly group: 'com.networknt' , name: 'json-schema-validator', version: '1.4.0'
// Multi-tenant SDK Client
compileOnly "org.opensearch:opensearch-remote-metadata-sdk:${opensearch_build}"

agent "org.opensearch:opensearch-agent-bootstrap:${opensearch_version}"
agent "org.opensearch:opensearch-agent:${opensearch_version}"
agent "net.bytebuddy:byte-buddy:1.17.5"
}

lombok {
Expand Down Expand Up @@ -157,3 +165,13 @@ publishing {
}
}
publishShadowPublicationToMavenLocal.mustRunAfter shadowJar

task prepareAgent(type: Copy) {
from(configurations.agent)
into "$buildDir/agent"
}

tasks.withType(Test) {
dependsOn prepareAgent
jvmArgs += ["-javaagent:" + project.layout.buildDirectory.file("agent/opensearch-agent-${opensearch_version}.jar").get()]
}
18 changes: 18 additions & 0 deletions memory/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@ plugins {
id 'com.diffplug.spotless' version '6.25.0'
}

configurations {
agent
}

dependencies {
implementation project(path: ":${rootProject.name}-common", configuration: 'shadow')
implementation group: 'org.opensearch', name: 'opensearch', version: "${opensearch_version}"
Expand All @@ -47,6 +51,10 @@ dependencies {
exclude group: 'net.minidev', module: 'json-smart'
}
testImplementation('net.minidev:json-smart:2.5.2')

agent "org.opensearch:opensearch-agent-bootstrap:${opensearch_version}"
agent "org.opensearch:opensearch-agent:${opensearch_version}"
agent "net.bytebuddy:byte-buddy:1.17.5"
}

test {
Expand Down Expand Up @@ -90,3 +98,13 @@ spotless {
eclipse().withP2Mirrors(Map.of("https://download.eclipse.org/", "https://mirror.umd.edu/eclipse/")).configFile rootProject.file('.eclipseformat.xml')
}
}

task prepareAgent(type: Copy) {
from(configurations.agent)
into "$buildDir/agent"
}

tasks.withType(Test) {
dependsOn prepareAgent
jvmArgs += ["-javaagent:" + project.layout.buildDirectory.file("agent/opensearch-agent-${opensearch_version}.jar").get()]
}
18 changes: 18 additions & 0 deletions ml-algorithms/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ repositories {
mavenCentral()
}

configurations {
agent
}

dependencies {
implementation project(path: ":${rootProject.name}-spi", configuration: 'shadow')
implementation project(path: ":${rootProject.name}-common", configuration: 'shadow')
Expand Down Expand Up @@ -88,6 +92,10 @@ dependencies {
testImplementation("com.fasterxml.jackson.core:jackson-annotations:${versions.jackson}")
testImplementation("com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}")
testImplementation group: 'com.networknt' , name: 'json-schema-validator', version: '1.4.0'

agent "org.opensearch:opensearch-agent-bootstrap:${opensearch_version}"
agent "org.opensearch:opensearch-agent:${opensearch_version}"
agent "net.bytebuddy:byte-buddy:1.17.5"
}

lombok {
Expand Down Expand Up @@ -144,3 +152,13 @@ spotless {
eclipse().withP2Mirrors(Map.of("https://download.eclipse.org/", "https://mirror.umd.edu/eclipse/")).configFile rootProject.file('.eclipseformat.xml')
}
}

task prepareAgent(type: Copy) {
from(configurations.agent)
into "$buildDir/agent"
}

tasks.withType(Test) {
dependsOn prepareAgent
jvmArgs += ["-javaagent:" + project.layout.buildDirectory.file("agent/opensearch-agent-${opensearch_version}.jar").get()]
}
15 changes: 15 additions & 0 deletions plugin/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ opensearchplugin {

configurations {
zipArchive
agent
}

dependencies {
Expand Down Expand Up @@ -94,6 +95,10 @@ dependencies {
exclude group: 'net.minidev', module: 'json-smart'
}
implementation('net.minidev:json-smart:2.5.2')

agent "org.opensearch:opensearch-agent-bootstrap:${opensearch_version}"
agent "org.opensearch:opensearch-agent:${opensearch_version}"
agent "net.bytebuddy:byte-buddy:1.17.5"
}

publishing {
Expand Down Expand Up @@ -651,3 +656,13 @@ forbiddenPatterns {
exclude '**/*.pdf'
exclude '**/*.jpg'
}

task prepareAgent(type: Copy) {
from(configurations.agent)
into "$buildDir/agent"
}

tasks.withType(Test) {
dependsOn prepareAgent
jvmArgs += ["-javaagent:" + project.layout.buildDirectory.file("agent/opensearch-agent-${opensearch_version}.jar").get()]
}
3 changes: 3 additions & 0 deletions plugin/src/main/plugin-metadata/plugin-security.policy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ grant {
// Register model
permission java.net.SocketPermission "*", "connect,resolve";

// for accessing Unix domain socket on windows
permission java.net.NetPermission "accessUnixDomainSocket";

// Deploy model
permission java.lang.RuntimePermission "createClassLoader";
permission java.lang.RuntimePermission "loadLibrary.*";
Expand Down
18 changes: 18 additions & 0 deletions search-processors/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,10 @@ repositories {
mavenLocal()
}

configurations {
agent
}

dependencies {
implementation project(path: ":${rootProject.name}-common", configuration: 'shadow')
compileOnly group: 'org.opensearch', name: 'opensearch', version: "${opensearch_version}"
Expand All @@ -42,6 +46,10 @@ dependencies {
implementation group: 'org.json', name: 'json', version: '20231013'
implementation group: 'org.apache.commons', name: 'commons-text', version: '1.10.0'
testImplementation "org.opensearch.test:framework:${opensearch_version}"

agent "org.opensearch:opensearch-agent-bootstrap:${opensearch_version}"
agent "org.opensearch:opensearch-agent:${opensearch_version}"
agent "net.bytebuddy:byte-buddy:1.17.5"
}

test {
Expand Down Expand Up @@ -83,3 +91,13 @@ spotless {
eclipse().withP2Mirrors(Map.of("https://download.eclipse.org/", "https://mirror.umd.edu/eclipse/")).configFile rootProject.file('.eclipseformat.xml')
}
}

task prepareAgent(type: Copy) {
from(configurations.agent)
into "$buildDir/agent"
}

tasks.withType(Test) {
dependsOn prepareAgent
jvmArgs += ["-javaagent:" + project.layout.buildDirectory.file("agent/opensearch-agent-${opensearch_version}.jar").get()]
}
Loading