Bootstrap entitlements for testing #129268

prdoyle · 2025-06-11T15:22:38Z

Add entitlement enforcement during ordinary unit tests.

This does not yet cover tests that run ES nodes; only ordinary unit tests.

See ES-11597.

…source. Using getResource makes this sensitive to unrelated classpath entries, such as the entitlement bridge library, that get prepended to the classpath.

Using the root logger makes this sensitive to unrelated logging, such as from the entitlement library.

…titlements. Taking the actual module name from the class doesn't work in tests, where those classes are loaded from the classpath and so their module info is misleading.

...ls-internal/src/main/java/org/elasticsearch/gradle/internal/ElasticsearchTestBasePlugin.java

build-tools/src/main/java/org/elasticsearch/gradle/test/TestBuildInfoPlugin.java

breskeby · 2025-06-24T17:56:17Z

libs/build.gradle

@@ -45,4 +45,16 @@ configure(childProjects.values()) {
     */
    apply plugin: 'elasticsearch.build'
  }
+
+  // This is for any code potentially included in the server at runtime.


Can we just add this to the plugin-scanner project for now. In general we want to move more configuration where it belongs. adding code that might be needed in the future in sometime just adds clutter for now.

It needs to apply to every lib except plugin-scanner.

(Really, plugin-scanner shouldn't be in libs in the first place.)

libs/build.gradle

breskeby

I added some remarks regarding the build changes that I think we need to address.

…eneratorTest. The template generator also strips these, so we need to do so to make this pass on Windows. Note that we use replace("\r", "") where the template generator uses replace("\\r", ""). The latter didn't work for me when I tried it on Windows, for reasons I'm not aware of.

…nts-for-testing

.../framework/src/main/java/org/elasticsearch/entitlement/runtime/policy/TestPolicyManager.java

...ls-internal/src/main/java/org/elasticsearch/gradle/internal/ElasticsearchTestBasePlugin.java

breskeby · 2025-06-25T13:37:36Z

...ernal/src/test/java/org/elasticsearch/gradle/internal/release/ReleaseNotesGeneratorTest.java

@@ -184,7 +184,7 @@ private ChangelogEntry makeHighlightsEntry(int pr, boolean notable) {
    }

    private String getResource(String name) throws Exception {
-        return Files.readString(Paths.get(Objects.requireNonNull(this.getClass().getResource(name)).toURI()), StandardCharsets.UTF_8);
+        return Files.readString(Paths.get(Objects.requireNonNull(this.getClass().getResource(name)).toURI()), StandardCharsets.UTF_8).replace("\r", "");


what is that for?

This test wasn't working on Windows. Tag @brianseeders

libs/build.gradle

mosche · 2025-06-26T07:21:59Z

@prdoyle I noticed that file entitlement checks likely don't work at all in tests as they are using org.apache.lucene.tests.mockfile.FilterFileSystem rather than the default file system. In policy checker we're allowing everything that's not using the default file system.
We should probably tackle file permissions separately to not increase the scope of this PR even further.

mosche · 2025-06-26T09:25:15Z

test/framework/src/main/java/org/elasticsearch/bootstrap/BootstrapForTesting.java

+
+        // Fire up entitlements
+        try {
+            TestEntitlementBootstrap.bootstrap(javaTmpDir, maybePath(System.getProperty("tests.config")));


I can only find a single reference of tests.config where this references elasticsearch.yml, though bootstrap expects a dir.

mvn -Dtests.gce=true -Dtests.config=/path/to/config/file/elasticsearch.yml clean test

Hmm I don't recall why I added that now. 🤔

mosche · 2025-06-26T09:53:46Z

test/framework/src/main/java/org/elasticsearch/entitlement/runtime/policy/TestPathLookup.java

 import java.util.stream.Stream;

 public class TestPathLookup implements PathLookup {
+    final Map<BaseDir, Collection<Path>> tempDirPaths;


nit: tempDirPaths should better be renamed to baseDirPaths or similar

This test works by altering the logging on the root logger. With entitlements enabled, that will cause additional log statements to appear, which interferes with the test.

…nts-for-testing

prdoyle self-assigned this Jun 11, 2025

prdoyle added >test Issues or PRs that are addressing/adding tests test-windows Trigger CI checks on Windows auto-backport Automatically create backport pull requests when merged v8.19.0 v9.1.0 :Core/Infra/Entitlements Entitlements infrastructure labels Jun 11, 2025

prdoyle force-pushed the bootstrap-entitlements-for-testing branch 4 times, most recently from e1166dc to d331569 Compare June 17, 2025 12:34

prdoyle added 4 commits June 17, 2025 09:15

Fix ExceptionSerializationTests to use getCodeSource instead of getRe…

2daa627

…source. Using getResource makes this sensitive to unrelated classpath entries, such as the entitlement bridge library, that get prepended to the classpath.

FIx logging tests to use org.elasticsearch.index instead of root logger.

87b58f6

Using the root logger makes this sensitive to unrelated logging, such as from the entitlement library.

Fix entitlement error message by stashing the module name in ModuleEn…

3248fd2

…titlements. Taking the actual module name from the class doesn't work in tests, where those classes are loaded from the classpath and so their module info is misleading.

Ignore server locations whose representative class isn't loaded

afaaf3d

prdoyle force-pushed the bootstrap-entitlements-for-testing branch 2 times, most recently from 7bcefba to ba15751 Compare June 17, 2025 14:37

prdoyle added 13 commits June 17, 2025 10:41

Partial initial implementation

c363a24

System properties: testOnlyClasspath and enableForTests

ee60773

Trivially allow some packages

ad955a5

DEBUG: use TreeMap in TestScopeResolver for readability

3dd3962

Special case bouncycastle for security plugin

caa6a70

Add CONFIG to TestPathLookup

08b16bb

Add the classpath to the source path list for every plugin

c3b6388

Add @WithoutEntitlements to tests that run ES nodes

687b904

Set es.entitlement.enableForTests for all libs

c8f1af6

Use @WithoutEntitlements on ingest plugin tests

38c3f9c

Substitute ALL-UNNAMED for module name in non-modular plugins

f5a7c86

Add missing entitlements found by unit tests

93878f9

Comment in TestScopeResolver

bda4331

breskeby reviewed Jun 24, 2025

View reviewed changes

...ls-internal/src/main/java/org/elasticsearch/gradle/internal/ElasticsearchTestBasePlugin.java Outdated Show resolved Hide resolved

breskeby reviewed Jun 24, 2025

View reviewed changes

...ls-internal/src/main/java/org/elasticsearch/gradle/internal/ElasticsearchTestBasePlugin.java Show resolved Hide resolved

breskeby reviewed Jun 24, 2025

View reviewed changes

build-tools/src/main/java/org/elasticsearch/gradle/test/TestBuildInfoPlugin.java Outdated Show resolved Hide resolved

breskeby reviewed Jun 24, 2025

View reviewed changes

libs/build.gradle Outdated Show resolved Hide resolved

breskeby requested changes Jun 24, 2025

View reviewed changes

prdoyle and others added 10 commits June 24, 2025 14:28

Merge branch 'main' into bootstrap-entitlements-for-testing

a5579b6

Merge branch 'main' into bootstrap-entitlements-for-testing

4338605

Move configureEntitlements to ElasticsearchTestBasePlugin as-is

bc6b6c8

Use matching instead of if

8c62d00

Remove requireNonNull

c7ff726

Remove default configuration

b5a1672

Set inputs instead of dependencies

4e1a3b6

Use test.systemProperty

82d61e4

Merge remote-tracking branch 'upstream/main' into bootstrap-entitleme…

b5d3088

…nts-for-testing

mosche reviewed Jun 25, 2025

View reviewed changes

.../framework/src/main/java/org/elasticsearch/entitlement/runtime/policy/TestPolicyManager.java Outdated Show resolved Hide resolved

mosche reviewed Jun 25, 2025

View reviewed changes

...ls-internal/src/main/java/org/elasticsearch/gradle/internal/ElasticsearchTestBasePlugin.java Outdated Show resolved Hide resolved

Merge branch 'main' into bootstrap-entitlements-for-testing

67ddd9c

breskeby reviewed Jun 25, 2025

View reviewed changes

libs/build.gradle Outdated Show resolved Hide resolved

breskeby reviewed Jun 25, 2025

View reviewed changes

libs/build.gradle Outdated Show resolved Hide resolved

mosche reviewed Jun 26, 2025

View reviewed changes

elasticsearchmachine added v9.2.0 and removed v9.1.0 labels Jun 26, 2025

prdoyle added 3 commits June 26, 2025 17:36

Respond to PR comments

f880bbc

Disable entitlement enforcement for ScopedSettingsTests.

015ad9f

This test works by altering the logging on the root logger. With entitlements enabled, that will cause additional log statements to appear, which interferes with the test.

Merge remote-tracking branch 'upstream/main' into bootstrap-entitleme…

4f0bc69

…nts-for-testing

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bootstrap entitlements for testing #129268

Bootstrap entitlements for testing #129268

prdoyle commented Jun 11, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

breskeby Jun 24, 2025

prdoyle Jun 24, 2025

prdoyle Jun 24, 2025

Uh oh!

breskeby left a comment

Uh oh!

Uh oh!

breskeby Jun 25, 2025

prdoyle Jun 26, 2025

Uh oh!

Uh oh!

mosche commented Jun 26, 2025 •

edited

Loading

mosche Jun 26, 2025

prdoyle Jun 26, 2025

mosche Jun 26, 2025

Bootstrap entitlements for testing #129268

Are you sure you want to change the base?

Bootstrap entitlements for testing #129268

Conversation

prdoyle commented Jun 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Uh oh!

breskeby left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mosche commented Jun 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

prdoyle commented Jun 11, 2025 •

edited

Loading

mosche commented Jun 26, 2025 •

edited

Loading