Skip to content

Fix log4j init with SecurityManager - #2568

Merged
SylvainJuge merged 6 commits into
elastic:mainfrom
SylvainJuge:fix-log4j-securitymanager
Apr 4, 2022
Merged

Fix log4j init with SecurityManager#2568
SylvainJuge merged 6 commits into
elastic:mainfrom
SylvainJuge:fix-log4j-securitymanager

Conversation

@SylvainJuge

@SylvainJuge SylvainJuge commented Apr 1, 2022

Copy link
Copy Markdown
Member

What does this PR do?

Relates to #2550

Simply wraps the logger init in a doPrivileged block to get the proper permissions when a Security Manager is present.

Moving the doPrivileged wrapping down to the getLogger or getContext methods in Log4jFactoryBridge does not work as expected and we get other permission errors with ES, so we keep it in the caller side.

Checklist

  • This is a bugfix
    • I have updated CHANGELOG.asciidoc
    • I have added tests that would fail without this fix
    • manually testing with ES

@ghost

ghost commented Apr 1, 2022

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-04-01T15:16:25.990+0000

  • Duration: 46 min 17 sec

Test stats 🧪

Test Results
Failed 0
Passed 2837
Skipped 20
Total 2857

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • run benchmark tests : Run the benchmark tests.

  • run jdk compatibility tests : Run the JDK Compatibility tests.

  • run integration tests : Run the Agent Integration tests.

  • run end-to-end tests : Run the APM-ITs.

  • run windows tests : Build & tests on windows.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@pugnascotia

Copy link
Copy Markdown

cc @ChrisHegarty

@ChrisHegarty ChrisHegarty left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Comment on lines -57 to +64
return anchor == null ? LogManager.getContext() : getContext(StackLocatorUtil.getCallerClass(anchor));
// the logger context is defined by the class that calls LoggerFactory
final Class<?> factoryCaller = StackLocatorUtil.getCallerClass(LOGGER_FACTORY);
if (factoryCaller == null) {
return LogManager.getContext();
}
return getContext(factoryCaller);

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@eyalkoren I do need your review on this as I'm not 100% sure it's the right way to fix it.
Without this, the added anonymous class makes loggingLevelChangeTest test fail.

@SylvainJuge
SylvainJuge requested a review from eyalkoren April 1, 2022 14:54
@SylvainJuge
SylvainJuge marked this pull request as ready for review April 1, 2022 15:16
@github-actions

github-actions Bot commented Apr 1, 2022

Copy link
Copy Markdown

/test

@SylvainJuge
SylvainJuge merged commit 4b69ebf into elastic:main Apr 4, 2022
@SylvainJuge
SylvainJuge deleted the fix-log4j-securitymanager branch April 4, 2022 07:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants