From 2680dc741be48c34da582d46ca6cfc80500554e4 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Wed, 16 Nov 2022 15:29:15 +0100 Subject: [PATCH 01/14] make agent work better with security manager --- .../java/lang/IndyBootstrapDispatcher.esclazz | Bin 2899 -> 2899 bytes .../elastic/apm/agent/bci/IndyBootstrap.java | 21 +++- .../ServerlessConfiguration.java | 4 +- .../apm/agent/configuration/ServiceInfo.java | 13 ++- .../impl/metadata/CloudMetadataProvider.java | 3 +- .../agent/impl/metadata/ServiceFactory.java | 5 +- .../apm/agent/util/PrivilegedActionUtils.java | 49 ++++++++ .../agent/configuration/ServiceInfoTest.java | 4 +- .../apm/agent/impl/ElasticApmTracerTest.java | 2 +- .../apm/agent/premain/ShadedClassLoader.java | 105 ++++++++++++++++-- 10 files changed, 178 insertions(+), 28 deletions(-) create mode 100644 apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java diff --git a/apm-agent-bootstrap/src/main/resources/bootstrap/java/lang/IndyBootstrapDispatcher.esclazz b/apm-agent-bootstrap/src/main/resources/bootstrap/java/lang/IndyBootstrapDispatcher.esclazz index 8bdc67e7fd90d23ef5268fe35618d51a7e47dc8f..2601b4c79b55ee9fffc2c0971090b3567e21935d 100644 GIT binary patch delta 107 zcmcaCc3Eu0MGi*I$(K0(+FCO(GuSY2GT1R_GPpA6FgP>lF}N@oGq^KYFn9n(y%^jW zyczr$d>FzQd>IlM{27WE0vYNUf*3j(LMHQYtz(Rsyqhap(2zlx!GuAK!H7W|s9S-- Jbh0|P4gkr?6mb9m delta 107 zcmcaCc3Eu0MGi*w$(K0(+FCL&GgvWjGT1O^GB`8nFgP;kF*q?8Gq^HXFt{<;F?aw; zPX<2*FNQD%Z-zt$Uxp$Ee}+1S0ESM6pvgR3>lni(@8*gY)MpT8Fk%p6Fkld8Fl10* KFrKW=tpfnSYZOBO diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java index 69dc2899e3..fb902f597a 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java @@ -43,6 +43,8 @@ import java.lang.invoke.MethodType; import java.lang.reflect.Method; import java.net.URISyntaxException; +import java.security.AccessController; +import java.security.PrivilegedAction; import java.util.ArrayList; import java.util.Collection; import java.util.Collections; @@ -354,10 +356,21 @@ static void setJavaBaseModule(Class targetClass) throws Throwable { * @return a {@link ConstantCallSite} that is the target of the invokedynamic */ @Nullable - public static ConstantCallSite bootstrap(MethodHandles.Lookup lookup, - String adviceMethodName, - MethodType adviceMethodType, - Object... args) { + public static ConstantCallSite bootstrap(final MethodHandles.Lookup lookup, + final String adviceMethodName, + final MethodType adviceMethodType, + final Object... args) { + + // callsite resolution needs privileged access to call Class#getClassLoader() and MethodHandles$Lookup#findStatic + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public ConstantCallSite run() { + return internalBootstrap(lookup, adviceMethodName, adviceMethodType, args); + } + }); + } + + private static ConstantCallSite internalBootstrap(MethodHandles.Lookup lookup, String adviceMethodName, MethodType adviceMethodType, Object[] args) { try { if (callDepth.isNestedCallAndIncrement()) { // avoid re-entrancy and stack overflow errors diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/ServerlessConfiguration.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/ServerlessConfiguration.java index 1a1b95341f..3b75cc93a6 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/ServerlessConfiguration.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/ServerlessConfiguration.java @@ -18,6 +18,7 @@ */ package co.elastic.apm.agent.configuration; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import org.stagemonitor.configuration.ConfigurationOption; import org.stagemonitor.configuration.ConfigurationOptionProvider; @@ -50,7 +51,8 @@ public long getDataFlushTimeout() { } public boolean runsOnAwsLambda() { - String lambdaName = System.getenv("AWS_LAMBDA_FUNCTION_NAME"); + String lambdaName = PrivilegedActionUtils.getEnv("AWS_LAMBDA_FUNCTION_NAME"); return null != lambdaName && !lambdaName.isEmpty(); } + } diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/ServiceInfo.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/ServiceInfo.java index 3f8d594e1d..7d6e36b769 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/ServiceInfo.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/ServiceInfo.java @@ -18,7 +18,10 @@ */ package co.elastic.apm.agent.configuration; +import co.elastic.apm.agent.util.PrivilegedActionUtils; + import javax.annotation.Nullable; +import java.util.Map; import java.util.Objects; import java.util.Properties; import java.util.jar.Attributes; @@ -30,7 +33,7 @@ public class ServiceInfo { private static final String JAR_VERSION_SUFFIX = "-(\\d+\\.)+(\\d+)(.*)?$"; private static final String DEFAULT_SERVICE_NAME = "unknown-java-service"; private static final ServiceInfo EMPTY = new ServiceInfo(null, null); - private static final ServiceInfo AUTO_DETECTED = autoDetect(System.getProperties()); + private static final ServiceInfo AUTO_DETECTED = autoDetect(System.getProperties(), PrivilegedActionUtils.getEnv()); private final String serviceName; @Nullable @@ -83,12 +86,12 @@ public static ServiceInfo autoDetected() { return AUTO_DETECTED; } - public static ServiceInfo autoDetect(Properties properties) { - String lambdaFunctionName = System.getenv("AWS_LAMBDA_FUNCTION_NAME"); + public static ServiceInfo autoDetect(Properties sysProperties, Map sysEnv) { + String lambdaFunctionName = sysEnv.get("AWS_LAMBDA_FUNCTION_NAME"); if (lambdaFunctionName != null) { - return new ServiceInfo(lambdaFunctionName, System.getenv("AWS_LAMBDA_FUNCTION_VERSION")); + return new ServiceInfo(lambdaFunctionName, sysEnv.get("AWS_LAMBDA_FUNCTION_VERSION")); } else { - ServiceInfo serviceInfo = createFromSunJavaCommand(properties.getProperty("sun.java.command")); + ServiceInfo serviceInfo = createFromSunJavaCommand(sysProperties.getProperty("sun.java.command")); if (serviceInfo != null) { return serviceInfo; } diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/metadata/CloudMetadataProvider.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/metadata/CloudMetadataProvider.java index 4d462cd935..73b56ef497 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/metadata/CloudMetadataProvider.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/metadata/CloudMetadataProvider.java @@ -21,6 +21,7 @@ import co.elastic.apm.agent.configuration.CoreConfiguration; import co.elastic.apm.agent.configuration.ServerlessConfiguration; import co.elastic.apm.agent.util.ExecutorUtils; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import co.elastic.apm.agent.util.UrlConnectionUtils; import com.dslplatform.json.DslJson; import com.dslplatform.json.JsonReader; @@ -68,7 +69,7 @@ static CloudProviderInfo getCloudInfoProvider(final CoreConfiguration.CloudProvi if (serverlessConfiguration.runsOnAwsLambda()) { CloudProviderInfo awsLambdaInfo = new CloudProviderInfo("aws"); - awsLambdaInfo.setRegion(System.getenv("AWS_REGION")); + awsLambdaInfo.setRegion(PrivilegedActionUtils.getEnv("AWS_REGION")); awsLambdaInfo.setService(new CloudProviderInfo.Service("lambda")); return awsLambdaInfo; } diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/metadata/ServiceFactory.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/metadata/ServiceFactory.java index 0523af9f26..97d68d9329 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/metadata/ServiceFactory.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/metadata/ServiceFactory.java @@ -20,6 +20,7 @@ import co.elastic.apm.agent.configuration.CoreConfiguration; import co.elastic.apm.agent.configuration.ServerlessConfiguration; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import co.elastic.apm.agent.util.VersionUtils; public class ServiceFactory { @@ -41,14 +42,14 @@ public Service createService(CoreConfiguration coreConfiguration, String ephemer } private void augmentServiceForAWSLambda(Service service) { - String runtimeName = System.getenv("AWS_EXECUTION_ENV"); + String runtimeName = PrivilegedActionUtils.getEnv("AWS_EXECUTION_ENV"); runtimeName = null != runtimeName ? runtimeName : "AWS_Lambda_java"; service.withRuntime(new RuntimeInfo(runtimeName, System.getProperty("java.version"))); Node node = service.getNode(); String nodeName = (node != null) ? node.getName() : null; if (nodeName == null || nodeName.isEmpty()) { - String serviceNodeName = System.getenv("AWS_LAMBDA_LOG_STREAM_NAME"); + String serviceNodeName = PrivilegedActionUtils.getEnv("AWS_LAMBDA_LOG_STREAM_NAME"); if (null != serviceNodeName) { service.withNode(new Node(serviceNodeName)); } diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java new file mode 100644 index 0000000000..da885247df --- /dev/null +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java @@ -0,0 +1,49 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package co.elastic.apm.agent.util; + +import javax.annotation.Nullable; +import java.security.AccessController; +import java.security.PrivilegedAction; +import java.util.Map; + +/** + * Delegates calls to {@link System} with wrapping in privileged actions which is required when security manager is active + */ +public class PrivilegedActionUtils { + + @Nullable + public static String getEnv(final String key) { + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public String run() { + return System.getenv(key); + } + }); + } + + public static Map getEnv() { + return AccessController.doPrivileged(new PrivilegedAction>() { + @Override + public Map run() { + return System.getenv(); + } + }); + } +} diff --git a/apm-agent-core/src/test/java/co/elastic/apm/agent/configuration/ServiceInfoTest.java b/apm-agent-core/src/test/java/co/elastic/apm/agent/configuration/ServiceInfoTest.java index c1e813895f..d7ae9b19e0 100644 --- a/apm-agent-core/src/test/java/co/elastic/apm/agent/configuration/ServiceInfoTest.java +++ b/apm-agent-core/src/test/java/co/elastic/apm/agent/configuration/ServiceInfoTest.java @@ -39,7 +39,7 @@ private static String getDefaultServiceName(@Nullable String sunJavaCommand) { properties.setProperty("sun.java.command", sunJavaCommand); } - return ServiceInfo.autoDetect(properties).getServiceName(); + return ServiceInfo.autoDetect(properties, Map.of()).getServiceName(); } @Test @@ -81,7 +81,7 @@ void testDefaultsWithLambda() throws Exception { final Map awsLambdaEnvVariables = new HashMap<>(); awsLambdaEnvVariables.put("AWS_LAMBDA_FUNCTION_NAME", "my-lambda-function"); awsLambdaEnvVariables.put("AWS_LAMBDA_FUNCTION_VERSION", "24"); - ServiceInfo serviceInfo = callWithCustomEnvVariables(awsLambdaEnvVariables, () -> ServiceInfo.autoDetect(new Properties())); + ServiceInfo serviceInfo = callWithCustomEnvVariables(awsLambdaEnvVariables, () -> ServiceInfo.autoDetect(new Properties(), Map.of())); assertSoftly(softly -> { softly.assertThat(serviceInfo.getServiceName()).isEqualTo("my-lambda-function"); softly.assertThat(serviceInfo.getServiceVersion()).isEqualTo("24"); diff --git a/apm-agent-core/src/test/java/co/elastic/apm/agent/impl/ElasticApmTracerTest.java b/apm-agent-core/src/test/java/co/elastic/apm/agent/impl/ElasticApmTracerTest.java index c17f3f2dec..c86a98b537 100644 --- a/apm-agent-core/src/test/java/co/elastic/apm/agent/impl/ElasticApmTracerTest.java +++ b/apm-agent-core/src/test/java/co/elastic/apm/agent/impl/ElasticApmTracerTest.java @@ -593,7 +593,7 @@ void testNotOverrideServiceNameWhenDefaultServiceNameConfigured() { CoreConfiguration coreConfig = localConfig.getConfig(CoreConfiguration.class); - assertThat(ServiceInfo.autoDetect(System.getProperties())) + assertThat(ServiceInfo.autoDetect(System.getProperties(), System.getenv())) .isEqualTo(ServiceInfo.of(coreConfig.getServiceName())); assertThat(reporter.getFirstTransaction().getTraceContext().getServiceName()).isNull(); diff --git a/elastic-apm-agent/src/main/java/co/elastic/apm/agent/premain/ShadedClassLoader.java b/elastic-apm-agent/src/main/java/co/elastic/apm/agent/premain/ShadedClassLoader.java index 2a6db7a2e3..67ca5687ed 100644 --- a/elastic-apm-agent/src/main/java/co/elastic/apm/agent/premain/ShadedClassLoader.java +++ b/elastic-apm-agent/src/main/java/co/elastic/apm/agent/premain/ShadedClassLoader.java @@ -25,8 +25,12 @@ import java.io.InputStream; import java.net.URL; import java.net.URLClassLoader; +import java.security.AccessController; +import java.security.PrivilegedAction; +import java.security.ProtectionDomain; import java.util.Enumeration; import java.util.HashSet; +import java.util.NoSuchElementException; import java.util.Set; import java.util.jar.JarFile; import java.util.jar.Manifest; @@ -136,9 +140,8 @@ protected Class findClass(String name) throws ClassNotFoundException { byte[] classBytes = getShadedClassBytes(name); if (classBytes != null) { return defineClass(name, classBytes); - } else { - throw new ClassNotFoundException(name); } + throw new ClassNotFoundException(name); } private Class defineClass(String name, byte[] classBytes) { @@ -157,7 +160,15 @@ private Class defineClass(String name, byte[] classBytes) { } } } - return defineClass(name, classBytes, 0, classBytes.length, ShadedClassLoader.class.getProtectionDomain()); + + ProtectionDomain protectionDomain = AccessController.doPrivileged(new PrivilegedAction() { + @Override + public ProtectionDomain run() { + return ShadedClassLoader.class.getProtectionDomain(); + } + }); + + return defineClass(name, classBytes, 0, classBytes.length, protectionDomain); } @SuppressWarnings("deprecation") @@ -180,7 +191,7 @@ public String getPackageName(String className) { } private byte[] getShadedClassBytes(String name) throws ClassNotFoundException { - try (InputStream is = getResourceAsStream(customPrefix + name.replace('.', '/') + SHADED_CLASS_EXTENSION)) { + try (InputStream is = getPrivilegedResourceAsStream(customPrefix + name.replace('.', '/') + SHADED_CLASS_EXTENSION)) { if (is != null) { ByteArrayOutputStream buffer = new ByteArrayOutputStream(); int n; @@ -196,6 +207,19 @@ private byte[] getShadedClassBytes(String name) throws ClassNotFoundException { return null; } + private InputStream getPrivilegedResourceAsStream(final String name) { + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public InputStream run() { + return getResourceAsStreamInternal(name); + } + }); + } + + private InputStream getResourceAsStreamInternal(String name) { + return super.getResourceAsStream(name); + } + /** * This class loader should only see classes and resources that start with the custom prefix. * It still allows for classes and resources of the parent to be resolved via the getResource methods @@ -204,11 +228,26 @@ private byte[] getShadedClassBytes(String name) throws ClassNotFoundException { * if the resource could not be found, or if the loader is closed. */ @Override - public URL findResource(String name) { - if (locallyNonAvailableResources.get().contains(name)) { - return null; + public URL findResource(final String name) { + URL result = null; + if (!locallyNonAvailableResources.get().contains(name)) { + + // while most of the body of default 'findResource' in JDK implementation is in a privileged action + // an extra URL check is performed just after it, hence we have to wrap the whole method call in a privileged + // action otherwise the security manager will complain about lack of proper read privileges on the agent jar + result = AccessController.doPrivileged(new PrivilegedAction() { + @Override + public URL run() { + return findResourceInternal(getShadedResourceName(name)); + } + }); } - return super.findResource(getShadedResourceName(name)); + + return result; + } + + private URL findResourceInternal(String name) { + return super.findResource(name); } /** @@ -219,11 +258,12 @@ public URL findResource(String name) { * if the resource could not be found, or if the loader is closed. */ @Override - public Enumeration findResources(String name) throws IOException { - if (locallyNonAvailableResources.get().contains(name)) { - return null; + public Enumeration findResources(final String name) throws IOException { + Enumeration result = null; + if (!locallyNonAvailableResources.get().contains(name)) { + result = super.findResources(getShadedResourceName(name)); } - return super.findResources(getShadedResourceName(name)); + return new PrivilegedEnumeration(result); } /** @@ -294,6 +334,47 @@ private String getShadedResourceName(String name) { } } + /** + * Wraps an {@link Enumeration} with privileged actions when executed with a security manager + * + * @param + */ + private static class PrivilegedEnumeration implements Enumeration { + + @Nullable + private final Enumeration delegate; + + private PrivilegedEnumeration(@Nullable Enumeration delegate){ + this.delegate = delegate; + } + + @Override + public boolean hasMoreElements() { + if (delegate == null) { + return false; + } + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Boolean run() { + return delegate.hasMoreElements(); + } + }); + } + + @Override + public E nextElement() { + if (delegate == null) { + throw new NoSuchElementException(); + } + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public E run() { + return delegate.nextElement(); + } + }); + } + } + @Override public String toString() { return "ShadedClassLoader{" + From ebc87c3f73a7c966faa8cf2d4606df145d650ceb Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Wed, 16 Nov 2022 15:43:46 +0100 Subject: [PATCH 02/14] update bootstrap compiled class --- .../java/lang/IndyBootstrapDispatcher.esclazz | Bin 2899 -> 2899 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/apm-agent-bootstrap/src/main/resources/bootstrap/java/lang/IndyBootstrapDispatcher.esclazz b/apm-agent-bootstrap/src/main/resources/bootstrap/java/lang/IndyBootstrapDispatcher.esclazz index 2601b4c79b55ee9fffc2c0971090b3567e21935d..8bdc67e7fd90d23ef5268fe35618d51a7e47dc8f 100644 GIT binary patch delta 107 zcmcaCc3Eu0MGi*w$(K0(+FCL&GgvWjGT1O^GB`8nFgP;kF*q?8Gq^HXFt{<;F?aw; zPX<2*FNQD%Z-zt$Uxp$Ee}+1S0ESM6pvgR3>lni(@8*gY)MpT8Fk%p6Fkld8Fl10* KFrKW=tpfnSYZOBO delta 107 zcmcaCc3Eu0MGi*I$(K0(+FCO(GuSY2GT1R_GPpA6FgP>lF}N@oGq^KYFn9n(y%^jW zyczr$d>FzQd>IlM{27WE0vYNUf*3j(LMHQYtz(Rsyqhap(2zlx!GuAK!H7W|s9S-- Jbh0|P4gkr?6mb9m From 9a6555bb3423c1f20e34f79bb2129c6e3e4a55af Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Wed, 16 Nov 2022 16:08:57 +0100 Subject: [PATCH 03/14] fix lambda test --- .../co/elastic/apm/agent/configuration/ServiceInfoTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apm-agent-core/src/test/java/co/elastic/apm/agent/configuration/ServiceInfoTest.java b/apm-agent-core/src/test/java/co/elastic/apm/agent/configuration/ServiceInfoTest.java index d7ae9b19e0..57aa889639 100644 --- a/apm-agent-core/src/test/java/co/elastic/apm/agent/configuration/ServiceInfoTest.java +++ b/apm-agent-core/src/test/java/co/elastic/apm/agent/configuration/ServiceInfoTest.java @@ -81,7 +81,7 @@ void testDefaultsWithLambda() throws Exception { final Map awsLambdaEnvVariables = new HashMap<>(); awsLambdaEnvVariables.put("AWS_LAMBDA_FUNCTION_NAME", "my-lambda-function"); awsLambdaEnvVariables.put("AWS_LAMBDA_FUNCTION_VERSION", "24"); - ServiceInfo serviceInfo = callWithCustomEnvVariables(awsLambdaEnvVariables, () -> ServiceInfo.autoDetect(new Properties(), Map.of())); + ServiceInfo serviceInfo = callWithCustomEnvVariables(awsLambdaEnvVariables, () -> ServiceInfo.autoDetect(System.getProperties(), System.getenv())); assertSoftly(softly -> { softly.assertThat(serviceInfo.getServiceName()).isEqualTo("my-lambda-function"); softly.assertThat(serviceInfo.getServiceVersion()).isEqualTo("24"); From 5dab2c6757e0eb9d6b1e007d795419cdc48e8171 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Thu, 17 Nov 2022 16:24:55 +0100 Subject: [PATCH 04/14] shortcutl security manager + privileged actions --- .../elastic/apm/agent/bci/IndyBootstrap.java | 4 + .../apm/agent/util/PrivilegedActionUtils.java | 8 ++ .../apm/agent/sdk/logging/LoggerFactory.java | 18 ++-- .../apm/agent/premain/ShadedClassLoader.java | 91 ++++++++++--------- 4 files changed, 73 insertions(+), 48 deletions(-) diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java index fb902f597a..1924591b1f 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java @@ -361,6 +361,10 @@ public static ConstantCallSite bootstrap(final MethodHandles.Lookup lookup, final MethodType adviceMethodType, final Object... args) { + if (System.getSecurityManager() == null) { + return internalBootstrap(lookup, adviceMethodName, adviceMethodType, args); + } + // callsite resolution needs privileged access to call Class#getClassLoader() and MethodHandles$Lookup#findStatic return AccessController.doPrivileged(new PrivilegedAction() { @Override diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java index da885247df..d866185604 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java @@ -30,6 +30,10 @@ public class PrivilegedActionUtils { @Nullable public static String getEnv(final String key) { + if (System.getSecurityManager() == null) { + return System.getenv(key); + } + return AccessController.doPrivileged(new PrivilegedAction() { @Override public String run() { @@ -39,6 +43,10 @@ public String run() { } public static Map getEnv() { + if (System.getSecurityManager() == null) { + return System.getenv(); + } + return AccessController.doPrivileged(new PrivilegedAction>() { @Override public Map run() { diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/logging/LoggerFactory.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/logging/LoggerFactory.java index d17dd498db..6e33601efe 100644 --- a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/logging/LoggerFactory.java +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/logging/LoggerFactory.java @@ -62,12 +62,18 @@ private static Logger getLoggerFromFactory(final String name) { return null; } - Logger logger = AccessController.doPrivileged(new PrivilegedAction() { - @Override - public Logger run() { - return iLoggerFactory.getLogger(name); - } - }); + Logger logger; + if (System.getSecurityManager() == null) { + logger = iLoggerFactory.getLogger(name); + } else { + logger = AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Logger run() { + return iLoggerFactory.getLogger(name); + } + }); + } + // in case the factory is unable to provide a logger, we return Noop impl to prevent further calls to the factory return logger != null ? logger : NoopLogger.INSTANCE; } diff --git a/elastic-apm-agent/src/main/java/co/elastic/apm/agent/premain/ShadedClassLoader.java b/elastic-apm-agent/src/main/java/co/elastic/apm/agent/premain/ShadedClassLoader.java index 67ca5687ed..d0b912b3e6 100644 --- a/elastic-apm-agent/src/main/java/co/elastic/apm/agent/premain/ShadedClassLoader.java +++ b/elastic-apm-agent/src/main/java/co/elastic/apm/agent/premain/ShadedClassLoader.java @@ -28,9 +28,9 @@ import java.security.AccessController; import java.security.PrivilegedAction; import java.security.ProtectionDomain; +import java.util.Collections; import java.util.Enumeration; import java.util.HashSet; -import java.util.NoSuchElementException; import java.util.Set; import java.util.jar.JarFile; import java.util.jar.Manifest; @@ -63,8 +63,21 @@ public class ShadedClassLoader extends URLClassLoader { public static final String SHADED_CLASS_EXTENSION = ".esclazz"; private static final String CLASS_EXTENSION = ".class"; + private static final ProtectionDomain PROTECTION_DOMAIN; + static { ClassLoader.registerAsParallelCapable(); + + if (System.getSecurityManager() == null) { + PROTECTION_DOMAIN = ShadedClassLoader.class.getProtectionDomain(); + } else { + PROTECTION_DOMAIN = AccessController.doPrivileged(new PrivilegedAction() { + @Override + public ProtectionDomain run() { + return ShadedClassLoader.class.getProtectionDomain(); + } + }); + } } private final String customPrefix; @@ -105,16 +118,10 @@ public ShadedClassLoader(File jar, ClassLoader parent, String customPrefix) thro * lookup, but we guard from that through a {@link ThreadLocal}.

* * - * @param name - * The binary name of the class - * - * @param resolve - * If {@code true} then resolve the class - * - * @return The resulting {@code Class} object - * - * @throws ClassNotFoundException - * If the class could not be found + * @param name The binary name of the class + * @param resolve If {@code true} then resolve the class + * @return The resulting {@code Class} object + * @throws ClassNotFoundException If the class could not be found */ @Override protected Class loadClass(String name, boolean resolve) throws ClassNotFoundException { @@ -161,14 +168,7 @@ private Class defineClass(String name, byte[] classBytes) { } } - ProtectionDomain protectionDomain = AccessController.doPrivileged(new PrivilegedAction() { - @Override - public ProtectionDomain run() { - return ShadedClassLoader.class.getProtectionDomain(); - } - }); - - return defineClass(name, classBytes, 0, classBytes.length, protectionDomain); + return defineClass(name, classBytes, 0, classBytes.length, PROTECTION_DOMAIN); } @SuppressWarnings("deprecation") @@ -208,6 +208,10 @@ private byte[] getShadedClassBytes(String name) throws ClassNotFoundException { } private InputStream getPrivilegedResourceAsStream(final String name) { + if (System.getSecurityManager() == null) { + return getResourceAsStreamInternal(name); + } + return AccessController.doPrivileged(new PrivilegedAction() { @Override public InputStream run() { @@ -223,27 +227,31 @@ private InputStream getResourceAsStreamInternal(String name) { /** * This class loader should only see classes and resources that start with the custom prefix. * It still allows for classes and resources of the parent to be resolved via the getResource methods + * * @param name the name of the resource * @return a {@code URL} for the resource, or {@code null} * if the resource could not be found, or if the loader is closed. */ @Override public URL findResource(final String name) { - URL result = null; - if (!locallyNonAvailableResources.get().contains(name)) { + if (locallyNonAvailableResources.get().contains(name)) { + return null; + } - // while most of the body of default 'findResource' in JDK implementation is in a privileged action - // an extra URL check is performed just after it, hence we have to wrap the whole method call in a privileged - // action otherwise the security manager will complain about lack of proper read privileges on the agent jar - result = AccessController.doPrivileged(new PrivilegedAction() { - @Override - public URL run() { - return findResourceInternal(getShadedResourceName(name)); - } - }); + if (System.getSecurityManager() == null) { + return findResourceInternal(getShadedResourceName(name)); } - return result; + // while most of the body of default 'findResource' in JDK implementation is in a privileged action + // an extra URL check is performed just after it, hence we have to wrap the whole method call in a privileged + // action otherwise the security manager will complain about lack of proper read privileges on the agent jar + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public URL run() { + return findResourceInternal(getShadedResourceName(name)); + } + }); + } private URL findResourceInternal(String name) { @@ -253,16 +261,22 @@ private URL findResourceInternal(String name) { /** * This class loader should only see classes and resources that start with the custom prefix. * It still allows for classes and resources of the parent to be resolved via the getResource methods + * * @param name the name of the resource * @return a {@code URL} for the resource, or {@code null} * if the resource could not be found, or if the loader is closed. */ @Override public Enumeration findResources(final String name) throws IOException { - Enumeration result = null; - if (!locallyNonAvailableResources.get().contains(name)) { - result = super.findResources(getShadedResourceName(name)); + if (locallyNonAvailableResources.get().contains(name)) { + return Collections.emptyEnumeration(); + } + + Enumeration result = super.findResources(getShadedResourceName(name)); + if (System.getSecurityManager() == null) { + return result; } + return new PrivilegedEnumeration(result); } @@ -341,18 +355,14 @@ private String getShadedResourceName(String name) { */ private static class PrivilegedEnumeration implements Enumeration { - @Nullable private final Enumeration delegate; - private PrivilegedEnumeration(@Nullable Enumeration delegate){ + private PrivilegedEnumeration(Enumeration delegate) { this.delegate = delegate; } @Override public boolean hasMoreElements() { - if (delegate == null) { - return false; - } return AccessController.doPrivileged(new PrivilegedAction() { @Override public Boolean run() { @@ -363,9 +373,6 @@ public Boolean run() { @Override public E nextElement() { - if (delegate == null) { - throw new NoSuchElementException(); - } return AccessController.doPrivileged(new PrivilegedAction() { @Override public E run() { From e7dda8d7a9e7104002a41a19cf60649c0458dfa8 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Fri, 18 Nov 2022 16:19:45 +0100 Subject: [PATCH 05/14] wrap most sensitive method calls --- .../agent/bbwarmup/WarmupInstrumentation.java | 3 +- .../apm/agent/bci/ElasticApmAgent.java | 17 +++--- .../elastic/apm/agent/bci/IndyBootstrap.java | 3 +- .../elastic/apm/agent/impl/GlobalTracer.java | 3 +- .../apm/agent/report/ApmServerReporter.java | 3 +- .../TraceMethodInstrumentation.java | 3 +- .../apm/agent/util/ClassLoaderUtils.java | 2 +- .../DependencyInjectingServiceLoader.java | 2 +- .../elastic/apm/agent/util/ExecutorUtils.java | 12 ++-- .../apm/agent/util/PrivilegedActionUtils.java | 57 +++++++++++++++++++ .../apm/agent/sdk/DynamicTransformer.java | 8 +-- .../apm/agent/sdk/internal/InternalUtil.java | 53 +++++++++++++++++ .../apm/agent/sdk/internal/package-info.java | 22 +++++++ .../apm/agent/sdk/logging/package-info.java | 22 +++++++ .../apm/agent/sdk/state/GlobalVariables.java | 4 +- .../sdk/weakconcurrent/WeakConcurrent.java | 7 +-- .../CaptureExceptionInstrumentation.java | 3 +- .../CaptureTransactionInstrumentation.java | 3 +- .../ElasticApmApiInstrumentation.java | 12 ++-- .../pluginapi/TracedInstrumentation.java | 3 +- .../AbstractSQSInstrumentationHelper.java | 3 +- .../APIGatewayProxyV1TransactionHelper.java | 3 +- .../APIGatewayProxyV2TransactionHelper.java | 3 +- ...AbstractMessageBasedTransactionHelper.java | 3 +- .../helper/PlainTransactionHelper.java | 3 +- .../awslambda/helper/S3TransactionHelper.java | 3 +- .../advice/AlibabaMonitorFilterAdvice.java | 3 +- .../advice/ApacheMonitorFilterAdvice.java | 3 +- .../ServerCallHandlerInstrumentation.java | 3 +- .../agent/jms/JmsInstrumentationHelper.java | 3 +- .../JmsMessageConsumerInstrumentation.java | 3 +- .../ConsumerRecordsIteratorWrapper.java | 3 +- ...ringKafkaBatchListenerInstrumentation.java | 3 +- .../loginstr/error/LoggerErrorHelper.java | 3 +- .../MicrometerMeterRegistrySerializer.java | 7 ++- .../opentelemetry/sdk/OTelSpanBuilder.java | 5 +- .../ApmSpanBuilderInstrumentation.java | 3 +- ...ractJobTransactionNameInstrumentation.java | 3 +- .../rabbitmq/ConsumerInstrumentation.java | 3 +- ...qpBatchMessageListenerInstrumentation.java | 3 +- .../rabbitmq/SpringAmqpTransactionHelper.java | 3 +- ...heduledTransactionNameInstrumentation.java | 3 +- .../scheduled/TimerTaskInstrumentation.java | 3 +- .../agent/springwebflux/WebfluxHelper.java | 3 +- .../agent/vertx/AbstractVertxWebHelper.java | 3 +- 45 files changed, 257 insertions(+), 66 deletions(-) create mode 100644 apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/InternalUtil.java create mode 100644 apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/package-info.java create mode 100644 apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/logging/package-info.java diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/bbwarmup/WarmupInstrumentation.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/bbwarmup/WarmupInstrumentation.java index c2b92094b7..39c76e0d49 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/bbwarmup/WarmupInstrumentation.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/bbwarmup/WarmupInstrumentation.java @@ -21,6 +21,7 @@ import co.elastic.apm.agent.bci.TracerAwareInstrumentation; import co.elastic.apm.agent.bci.bytebuddy.CustomElementMatchers; import co.elastic.apm.agent.bci.bytebuddy.SimpleMethodSignatureOffsetMappingFactory; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.method.MethodDescription; import net.bytebuddy.description.type.TypeDescription; @@ -45,7 +46,7 @@ public ElementMatcher.Junction getClassLoaderMatcher() { // (caused by java.lang.ClassFormatError) on OpenJDK 7. // By allowing instrumentation only when the test class is loaded by the same class loader that loads this // instrumentation class, we avoid this problem and still allow it to work both on production and unit tests - return CustomElementMatchers.isSameClassLoader(getClass().getClassLoader()); + return CustomElementMatchers.isSameClassLoader(PrivilegedActionUtils.getClassLoader(getClass())); } @Override diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/ElasticApmAgent.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/ElasticApmAgent.java index 5ffcfc4492..e00d07063d 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/ElasticApmAgent.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/ElasticApmAgent.java @@ -44,6 +44,7 @@ import co.elastic.apm.agent.tracemethods.TraceMethodInstrumentation; import co.elastic.apm.agent.util.DependencyInjectingServiceLoader; import co.elastic.apm.agent.util.ExecutorUtils; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.ByteBuddy; import net.bytebuddy.agent.builder.AgentBuilder; import net.bytebuddy.agent.builder.AgentBuilder.RedefinitionStrategy; @@ -169,7 +170,7 @@ private static void initInstrumentation(ElasticApmTracer tracer, Instrumentation @Nonnull private static Iterable loadInstrumentations(ElasticApmTracer tracer) { List pluginClassLoaders = new ArrayList<>(); - pluginClassLoaders.add(ElasticApmAgent.class.getClassLoader()); + pluginClassLoaders.add(PrivilegedActionUtils.getClassLoader(ElasticApmAgent.class)); pluginClassLoaders.addAll(createExternalPluginClassLoaders(tracer.getConfig(CoreConfiguration.class).getPluginsDir())); final List instrumentations = DependencyInjectingServiceLoader.load(ElasticApmInstrumentation.class, pluginClassLoaders, tracer); for (MethodMatcher traceMethod : tracer.getConfig(CoreConfiguration.class).getTraceMethods()) { @@ -203,7 +204,7 @@ public boolean accept(File dir, String name) { for (File pluginJar : pluginJars) { logger.info("Loading plugin {}", pluginJar.getName()); try { - result.add(new ExternalPluginClassLoader(pluginJar, ElasticApmAgent.class.getClassLoader())); + result.add(new ExternalPluginClassLoader(pluginJar, PrivilegedActionUtils.getClassLoader(ElasticApmAgent.class))); } catch (Exception e) { logger.error("Error loading external plugin", e); } @@ -255,7 +256,7 @@ private static synchronized void initInstrumentation(final ElasticApmTracer trac for (ElasticApmInstrumentation apmInstrumentation : instrumentations) { mapInstrumentationCL2adviceClassName( apmInstrumentation.getAdviceClassName(), - apmInstrumentation.getClass().getClassLoader()); + PrivilegedActionUtils.getClassLoader(apmInstrumentation.getClass())); } Runtime.getRuntime().addShutdownHook(new Thread(ThreadUtils.addElasticApmThreadPrefix("init-instrumentation-shutdown-hook")) { @Override @@ -485,7 +486,7 @@ public boolean matches(MethodDescription target) { }; return new AgentBuilder.Transformer.ForAdvice(withCustomMapping) .advice(instrumentationStats.shouldMeasureMatching() ? statsCollectingMatcher : matcher, instrumentation.getAdviceClassName()) - .include(ClassLoader.getSystemClassLoader(), instrumentation.getClass().getClassLoader()) + .include(ClassLoader.getSystemClassLoader(), PrivilegedActionUtils.getClassLoader(instrumentation.getClass())) .withExceptionHandler(PRINTING); } @@ -497,7 +498,7 @@ public static void validateAdvice(ElasticApmInstrumentation instrumentation) { if (instrumentation.getClass().getName().equals(adviceClassName)) { throw new IllegalStateException("The advice must be declared in a separate class: " + adviceClassName); } - ClassLoader adviceClassLoader = instrumentation.getClass().getClassLoader(); + ClassLoader adviceClassLoader = PrivilegedActionUtils.getClassLoader(instrumentation.getClass()); if (adviceClassLoader == null) { // the bootstrap class loader can't do resource lookup // if classes are added via java.lang.instrument.Instrumentation.appendToBootstrapClassLoaderSearch @@ -590,7 +591,7 @@ public static InstrumentationStats getInstrumentationStats() { // may help to debug classloading problems private static void logClassLoaderHierarchy(@Nullable ClassLoader classLoader, Logger logger, ElasticApmInstrumentation advice) { - logger.trace("Advice {} is loaded by {}", advice.getClass().getName(), advice.getClass().getClassLoader()); + logger.trace("Advice {} is loaded by {}", advice.getClass().getName(), PrivilegedActionUtils.getClassLoader(advice.getClass())); if (classLoader != null) { boolean canLoadAgent = false; try { @@ -782,7 +783,7 @@ public static void ensureInstrumented(Class classToInstrument, Collection typeMatcher = getTypeMatcher(classToInstrument, apmInstrumentation.getMethodMatcher(), none()); if (typeMatcher != null && isIncluded(apmInstrumentation, config)) { agentBuilder = applyAdvice(tracer, agentBuilder, apmInstrumentation, typeMatcher.and(apmInstrumentation.getTypeMatcher())); @@ -872,7 +873,7 @@ private static ElasticApmInstrumentation tryInstantiate(Class= 5 ? (MethodHandle) args[4] : null; ClassLoader instrumentationClassLoader = ElasticApmAgent.getInstrumentationClassLoader(adviceClassName); - ClassLoader targetClassLoader = lookup.lookupClass().getClassLoader(); + ClassLoader targetClassLoader = PrivilegedActionUtils.getClassLoader(lookup.lookupClass()); ClassFileLocator classFileLocator; List pluginClasses = new ArrayList<>(); if (instrumentationClassLoader instanceof ExternalPluginClassLoader) { diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/GlobalTracer.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/GlobalTracer.java index 927b9c2655..a9b27794a8 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/GlobalTracer.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/GlobalTracer.java @@ -26,6 +26,7 @@ import co.elastic.apm.agent.impl.transaction.Span; import co.elastic.apm.agent.impl.transaction.TextHeaderGetter; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import co.elastic.apm.agent.util.VersionUtils; import javax.annotation.Nullable; @@ -63,7 +64,7 @@ public static ElasticApmTracer requireTracerImpl() { } private static void checkClassloader() { - ClassLoader cl = GlobalTracer.class.getClassLoader(); + ClassLoader cl = PrivilegedActionUtils.getClassLoader(GlobalTracer.class); // agent currently loaded in the bootstrap CL, which is the current correct location if (cl == null) { diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/report/ApmServerReporter.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/report/ApmServerReporter.java index a80b8b3357..a7f3d7f3bc 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/report/ApmServerReporter.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/report/ApmServerReporter.java @@ -24,6 +24,7 @@ import co.elastic.apm.agent.report.disruptor.ExponentionallyIncreasingSleepingWaitStrategy; import co.elastic.apm.agent.util.MathUtils; import co.elastic.apm.agent.common.ThreadUtils; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import com.dslplatform.json.JsonWriter; import com.lmax.disruptor.EventFactory; import com.lmax.disruptor.EventTranslator; @@ -116,7 +117,7 @@ public ApmServerReporter(boolean dropTransactionIfQueueFull, ReporterConfigurati disruptor = new Disruptor<>(new TransactionEventFactory(), MathUtils.getNextPowerOf2(reporterConfiguration.getMaxQueueSize()), new ThreadFactory() { @Override public Thread newThread(Runnable r) { - Thread thread = new Thread(r); + Thread thread = PrivilegedActionUtils.newThread(r); thread.setDaemon(true); thread.setName(ThreadUtils.addElasticApmThreadPrefix("server-reporter")); return thread; diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/tracemethods/TraceMethodInstrumentation.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/tracemethods/TraceMethodInstrumentation.java index 5b018560a5..9067f47f6d 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/tracemethods/TraceMethodInstrumentation.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/tracemethods/TraceMethodInstrumentation.java @@ -27,6 +27,7 @@ import co.elastic.apm.agent.impl.transaction.Span; import co.elastic.apm.agent.matcher.MethodMatcher; import co.elastic.apm.agent.matcher.WildcardMatcher; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.method.MethodDescription; import net.bytebuddy.description.type.TypeDescription; @@ -139,7 +140,7 @@ public static Object onMethodEnter(@Advice.Origin Class clazz, AbstractSpan span = null; final AbstractSpan parent = tracer.getActive(); if (parent == null) { - span = tracer.startRootTransaction(clazz.getClassLoader()); + span = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(clazz)); if (span != null) { span.withName(signature).activate(); } diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/ClassLoaderUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/ClassLoaderUtils.java index b10c09d78a..37df1d8b8d 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/ClassLoaderUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/ClassLoaderUtils.java @@ -27,7 +27,7 @@ public class ClassLoaderUtils { public static boolean isAgentClassLoader(@Nullable ClassLoader classLoader) { return (classLoader != null && classLoader.getClass().getName().startsWith("co.elastic.apm")) || // This one also covers unit tests, where the app class loader loads the agent - ClassLoaderUtils.class.getClassLoader().equals(classLoader); + PrivilegedActionUtils.getClassLoader(ClassLoaderUtils.class).equals(classLoader); } public static boolean isBootstrapClassLoader(@Nullable ClassLoader classLoader) { diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/DependencyInjectingServiceLoader.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/DependencyInjectingServiceLoader.java index 1a4d38eec9..1362a79213 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/DependencyInjectingServiceLoader.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/DependencyInjectingServiceLoader.java @@ -50,7 +50,7 @@ public class DependencyInjectingServiceLoader { private final Set resourcePathCache; private DependencyInjectingServiceLoader(Class clazz, Object... constructorArguments) { - this(clazz, Collections.singletonList(clazz.getClassLoader()), constructorArguments); + this(clazz, Collections.singletonList(PrivilegedActionUtils.getClassLoader(clazz)), constructorArguments); } private DependencyInjectingServiceLoader(Class clazz, List classLoaders, Object... constructorArguments) { diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/ExecutorUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/ExecutorUtils.java index 93d93516a2..b92919ae6a 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/ExecutorUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/ExecutorUtils.java @@ -85,11 +85,11 @@ public SingleNamedThreadFactory(String threadName) { @Override public Thread newThread(Runnable r) { - Thread thread = new Thread(r); + Thread thread = PrivilegedActionUtils.newThread(r); thread.setDaemon(true); thread.setName(threadName); - ClassLoader originalContextCL = thread.getContextClassLoader(); - thread.setContextClassLoader(ExecutorUtils.class.getClassLoader()); + ClassLoader originalContextCL = PrivilegedActionUtils.getContextClassLoader(thread); + PrivilegedActionUtils.setContextClassLoader(thread, PrivilegedActionUtils.getClassLoader(ExecutorUtils.class)); logThreadCreation(originalContextCL, threadName); return thread; } @@ -116,12 +116,12 @@ public NamedThreadFactory(String threadPurpose) { @Override public Thread newThread(Runnable r) { - Thread thread = new Thread(r); + Thread thread = PrivilegedActionUtils.newThread(r); thread.setDaemon(true); String threadName = ThreadUtils.addElasticApmThreadPrefix(threadPurpose) + "-" + threadCounter.getAndIncrement(); thread.setName(threadName); - ClassLoader originalContextCL = thread.getContextClassLoader(); - thread.setContextClassLoader(ExecutorUtils.class.getClassLoader()); + ClassLoader originalContextCL = PrivilegedActionUtils.getContextClassLoader(thread); + PrivilegedActionUtils.setContextClassLoader(thread, PrivilegedActionUtils.getClassLoader(ExecutorUtils.class)); logThreadCreation(originalContextCL, threadName); return thread; } diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java index d866185604..5a6d0f77b8 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java @@ -54,4 +54,61 @@ public Map run() { } }); } + + @Nullable + public static ClassLoader getClassLoader(final Class type) { + if (System.getSecurityManager() == null) { + return type.getClassLoader(); + } + + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public ClassLoader run() { + return type.getClassLoader(); + } + }); + } + + public static ClassLoader getContextClassLoader(final Thread t){ + if (System.getSecurityManager() == null) { + return t.getContextClassLoader(); + } + + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public ClassLoader run() { + return t.getContextClassLoader(); + } + }); + } + + public static void setContextClassLoader(final Thread t, final @Nullable ClassLoader cl){ + if(System.getSecurityManager() == null){ + t.setContextClassLoader(cl); + } + + AccessController.doPrivileged(new PrivilegedAction() { + @Nullable + @Override + public Object run() { + t.setContextClassLoader(cl); + return null; + } + }); + + } + + public static Thread newThread(final @Nullable Runnable r){ + if(System.getSecurityManager() == null){ + return new Thread(r); + } + + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Thread run() { + return new Thread(r); + } + }); + } + } diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/DynamicTransformer.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/DynamicTransformer.java index 665c6bf530..a0dd7eadc9 100644 --- a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/DynamicTransformer.java +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/DynamicTransformer.java @@ -18,9 +18,12 @@ */ package co.elastic.apm.agent.sdk; +import co.elastic.apm.agent.sdk.internal.InternalUtil; import net.bytebuddy.description.type.TypeDescription; import net.bytebuddy.matcher.ElementMatcher; +import java.security.AccessController; +import java.security.PrivilegedAction; import java.util.Collection; import java.util.ServiceLoader; @@ -28,10 +31,7 @@ public class DynamicTransformer { private static final DynamicTransformerProvider transformer; static { - ClassLoader classLoader = DynamicTransformer.class.getClassLoader(); - if (classLoader == null) { - classLoader = ClassLoader.getSystemClassLoader(); - } + ClassLoader classLoader = InternalUtil.getClassLoader(DynamicTransformer.class, true); // loads the implementation provided by the core module without depending on the class or class name transformer = ServiceLoader.load(DynamicTransformerProvider.class, classLoader).iterator().next(); } diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/InternalUtil.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/InternalUtil.java new file mode 100644 index 0000000000..fa11330a59 --- /dev/null +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/InternalUtil.java @@ -0,0 +1,53 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package co.elastic.apm.agent.sdk.internal; + +import java.security.AccessController; +import java.security.PrivilegedAction; + +public class InternalUtil { + + /** + * Returns the classloader of a given class, optionally wrapping in a privileged action if security manager is enabled + * + * @param type class whose classloader needs to be retrieved + * @param systemFallback {@literal true} if fallback to system CL is required, {@literal false} otherwise + * @return class classloader or system classloader if it was loaded in system classloader + */ + public static ClassLoader getClassLoader(final Class type, final boolean systemFallback) { + if (System.getSecurityManager() == null) { + return doGetClassLoader(type, systemFallback); + } + + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public ClassLoader run() { + return doGetClassLoader(type, systemFallback); + } + }); + } + + private static ClassLoader doGetClassLoader(Class type, boolean systemFallback) { + ClassLoader classLoader = type.getClassLoader(); + if (classLoader == null) { + classLoader = ClassLoader.getSystemClassLoader(); + } + return classLoader; + } +} diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/package-info.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/package-info.java new file mode 100644 index 0000000000..b2d98dc914 --- /dev/null +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/package-info.java @@ -0,0 +1,22 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +@NonnullApi +package co.elastic.apm.agent.sdk.internal; + +import co.elastic.apm.agent.sdk.NonnullApi; diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/logging/package-info.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/logging/package-info.java new file mode 100644 index 0000000000..84ce5c4b9f --- /dev/null +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/logging/package-info.java @@ -0,0 +1,22 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +@NonnullApi +package co.elastic.apm.agent.sdk.logging; + +import co.elastic.apm.agent.sdk.NonnullApi; diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/state/GlobalVariables.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/state/GlobalVariables.java index cc890703ef..600f89f94b 100644 --- a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/state/GlobalVariables.java +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/state/GlobalVariables.java @@ -19,6 +19,8 @@ package co.elastic.apm.agent.sdk.state; +import co.elastic.apm.agent.sdk.internal.InternalUtil; + import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentMap; @@ -51,7 +53,7 @@ public class GlobalVariables { */ public static T get(Class adviceClass, String key, T defaultValue) { key = adviceClass.getName() + "." + key; - if (defaultValue.getClass().getClassLoader() != null && !defaultValue.getClass().getName().startsWith("co.elastic.apm.agent")) { + if (InternalUtil.getClassLoader(defaultValue.getClass(), false) == null && !defaultValue.getClass().getName().startsWith("co.elastic.apm.agent")) { throw new IllegalArgumentException("Registering types specific to an instrumentation plugin would lead to class loader leaks: " + defaultValue); } T value = (T) registry.get(key); diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/weakconcurrent/WeakConcurrent.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/weakconcurrent/WeakConcurrent.java index 0c1d03d828..afe764e599 100644 --- a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/weakconcurrent/WeakConcurrent.java +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/weakconcurrent/WeakConcurrent.java @@ -18,6 +18,8 @@ */ package co.elastic.apm.agent.sdk.weakconcurrent; +import co.elastic.apm.agent.sdk.internal.InternalUtil; + import javax.annotation.Nullable; import java.util.ServiceLoader; @@ -26,10 +28,7 @@ public final class WeakConcurrent { private static final WeakConcurrentProvider supplier; static { - ClassLoader classLoader = WeakConcurrentProvider.class.getClassLoader(); - if (classLoader == null) { - classLoader = ClassLoader.getSystemClassLoader(); - } + ClassLoader classLoader = InternalUtil.getClassLoader(WeakConcurrentProvider.class, true); // loads the implementation provided by the core module without depending on the class or class name supplier = ServiceLoader.load(WeakConcurrentProvider.class, classLoader).iterator().next(); } diff --git a/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/CaptureExceptionInstrumentation.java b/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/CaptureExceptionInstrumentation.java index 0c7eecce07..c80b786de2 100644 --- a/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/CaptureExceptionInstrumentation.java +++ b/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/CaptureExceptionInstrumentation.java @@ -18,6 +18,7 @@ */ package co.elastic.apm.agent.pluginapi; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.method.MethodDescription; import net.bytebuddy.description.type.TypeDescription; @@ -31,7 +32,7 @@ public class CaptureExceptionInstrumentation extends ApiInstrumentation { public static class AdviceClass { @Advice.OnMethodEnter(suppress = Throwable.class, inline = false) public static void captureException(@Advice.Origin Class clazz, @Advice.Argument(0) Throwable t) { - tracer.captureAndReportException(t, clazz.getClassLoader()); + tracer.captureAndReportException(t, PrivilegedActionUtils.getClassLoader(clazz)); } } diff --git a/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/CaptureTransactionInstrumentation.java b/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/CaptureTransactionInstrumentation.java index 8d41f8ad15..8f2e9cdeff 100644 --- a/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/CaptureTransactionInstrumentation.java +++ b/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/CaptureTransactionInstrumentation.java @@ -26,6 +26,7 @@ import co.elastic.apm.agent.impl.stacktrace.StacktraceConfiguration; import co.elastic.apm.agent.impl.transaction.Outcome; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.NamedElement; import net.bytebuddy.description.method.MethodDescription; @@ -73,7 +74,7 @@ public static Object onMethodEnter(@Advice.Origin Class clazz, @AnnotationValueExtractor(annotationClassName = "co.elastic.apm.api.CaptureTransaction", method = "type") String type) { final Object active = tracer.getActive(); if (active == null) { - Transaction transaction = tracer.startRootTransaction(clazz.getClassLoader()); + Transaction transaction = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(clazz)); if (transaction != null) { if (transactionName.isEmpty()) { transaction.withName(signature, PRIO_METHOD_SIGNATURE); diff --git a/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/ElasticApmApiInstrumentation.java b/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/ElasticApmApiInstrumentation.java index 1ee320425b..c7cb07f4be 100644 --- a/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/ElasticApmApiInstrumentation.java +++ b/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/ElasticApmApiInstrumentation.java @@ -20,6 +20,7 @@ import co.elastic.apm.agent.configuration.ServiceInfo; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.method.MethodDescription; import net.bytebuddy.description.type.TypeDescription; @@ -62,7 +63,7 @@ public static class AdviceClass { @Advice.AssignReturned.ToReturned @Advice.OnMethodExit(suppress = Throwable.class, inline = false) public static Object doStartTransaction(@Advice.Origin Class clazz) { - Transaction transaction = tracer.startRootTransaction(clazz.getClassLoader()); + Transaction transaction = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(clazz)); if (transaction != null) { transaction.setFrameworkName(Utils.FRAMEWORK_NAME); } @@ -88,14 +89,15 @@ public static Object doStartTransaction(@Advice.Origin Class clazz, @Advice.Argument(2) MethodHandle getAllHeaders, @Advice.Argument(3) @Nullable Object headersExtractor) { Transaction transaction = null; + ClassLoader classLoader = PrivilegedActionUtils.getClassLoader(clazz); if (headersExtractor != null) { HeadersExtractorBridge headersExtractorBridge = HeadersExtractorBridge.get(getFirstHeader, getAllHeaders); - transaction = tracer.startChildTransaction(HeadersExtractorBridge.Extractor.of(headerExtractor, headersExtractor), headersExtractorBridge, clazz.getClassLoader()); + transaction = tracer.startChildTransaction(HeadersExtractorBridge.Extractor.of(headerExtractor, headersExtractor), headersExtractorBridge, classLoader); } else if (headerExtractor != null) { HeaderExtractorBridge headersExtractorBridge = HeaderExtractorBridge.get(getFirstHeader); - transaction = tracer.startChildTransaction(headerExtractor, headersExtractorBridge, clazz.getClassLoader()); + transaction = tracer.startChildTransaction(headerExtractor, headersExtractorBridge, classLoader); } else { - transaction = tracer.startRootTransaction(clazz.getClassLoader()); + transaction = tracer.startRootTransaction(classLoader); } if (transaction != null) { transaction.setFrameworkName(Utils.FRAMEWORK_NAME); @@ -143,7 +145,7 @@ public CaptureExceptionInstrumentation() { public static class AdviceClass { @Advice.OnMethodEnter(suppress = Throwable.class, inline = false) public static void captureException(@Advice.Origin Class clazz, @Advice.Argument(0) @Nullable Throwable e) { - tracer.captureAndReportException(e, clazz.getClassLoader()); + tracer.captureAndReportException(e, PrivilegedActionUtils.getClassLoader(clazz)); } } } diff --git a/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/TracedInstrumentation.java b/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/TracedInstrumentation.java index 77f5ebdb1c..96b4a69fab 100644 --- a/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/TracedInstrumentation.java +++ b/apm-agent-plugins/apm-api-plugin/src/main/java/co/elastic/apm/agent/pluginapi/TracedInstrumentation.java @@ -28,6 +28,7 @@ import co.elastic.apm.agent.impl.transaction.Outcome; import co.elastic.apm.agent.impl.transaction.Span; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.NamedElement; import net.bytebuddy.description.method.MethodDescription; @@ -91,7 +92,7 @@ public static Object onMethodEnter( return span.activate(); } - Transaction transaction = tracer.startRootTransaction(clazz.getClassLoader()); + Transaction transaction = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(clazz)); if (transaction == null) { return null; } diff --git a/apm-agent-plugins/apm-aws-sdk/apm-aws-sdk-common/src/main/java/co/elastic/apm/agent/awssdk/common/AbstractSQSInstrumentationHelper.java b/apm-agent-plugins/apm-aws-sdk/apm-aws-sdk-common/src/main/java/co/elastic/apm/agent/awssdk/common/AbstractSQSInstrumentationHelper.java index f83ea6f5db..4533bbc66d 100644 --- a/apm-agent-plugins/apm-aws-sdk/apm-aws-sdk-common/src/main/java/co/elastic/apm/agent/awssdk/common/AbstractSQSInstrumentationHelper.java +++ b/apm-agent-plugins/apm-aws-sdk/apm-aws-sdk-common/src/main/java/co/elastic/apm/agent/awssdk/common/AbstractSQSInstrumentationHelper.java @@ -30,6 +30,7 @@ import co.elastic.apm.agent.matcher.WildcardMatcher; import co.elastic.apm.agent.sdk.logging.Logger; import co.elastic.apm.agent.sdk.logging.LoggerFactory; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import javax.annotation.Nullable; import java.net.URI; @@ -155,7 +156,7 @@ public Span startSpan(R request, URI httpURI, C context) { public void startTransactionOnMessage(MessageT sqsMessage, String queueName, TextHeaderGetter headerGetter) { try { if (!WildcardMatcher.isAnyMatch(messagingConfiguration.getIgnoreMessageQueues(), queueName)) { - Transaction transaction = tracer.startChildTransaction(sqsMessage, headerGetter, AbstractSQSInstrumentationHelper.class.getClassLoader()); + Transaction transaction = tracer.startChildTransaction(sqsMessage, headerGetter, PrivilegedActionUtils.getClassLoader(AbstractSQSInstrumentationHelper.class)); if (transaction != null) { transaction.withType(MESSAGING_TYPE).withName("SQS RECEIVE from " + queueName).activate(); transaction.setFrameworkName(FRAMEWORK_NAME); diff --git a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/APIGatewayProxyV1TransactionHelper.java b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/APIGatewayProxyV1TransactionHelper.java index 0a01c342c8..f9d7d8985c 100644 --- a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/APIGatewayProxyV1TransactionHelper.java +++ b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/APIGatewayProxyV1TransactionHelper.java @@ -22,6 +22,7 @@ import co.elastic.apm.agent.impl.ElasticApmTracer; import co.elastic.apm.agent.impl.GlobalTracer; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import com.amazonaws.services.lambda.runtime.Context; import com.amazonaws.services.lambda.runtime.events.APIGatewayProxyRequestEvent; import com.amazonaws.services.lambda.runtime.events.APIGatewayProxyResponseEvent; @@ -47,7 +48,7 @@ public static APIGatewayProxyV1TransactionHelper getInstance() { @Override protected Transaction doStartTransaction(APIGatewayProxyRequestEvent apiGatewayEvent, Context lambdaContext) { - Transaction transaction = tracer.startChildTransaction(apiGatewayEvent.getHeaders(), MapTextHeaderGetter.INSTANCE, apiGatewayEvent.getClass().getClassLoader()); + Transaction transaction = tracer.startChildTransaction(apiGatewayEvent.getHeaders(), MapTextHeaderGetter.INSTANCE, PrivilegedActionUtils.getClassLoader(apiGatewayEvent.getClass())); String host = getHost(apiGatewayEvent); if (null != transaction) { diff --git a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/APIGatewayProxyV2TransactionHelper.java b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/APIGatewayProxyV2TransactionHelper.java index b1658a8ae3..eab0ecab6f 100644 --- a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/APIGatewayProxyV2TransactionHelper.java +++ b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/APIGatewayProxyV2TransactionHelper.java @@ -22,6 +22,7 @@ import co.elastic.apm.agent.impl.ElasticApmTracer; import co.elastic.apm.agent.impl.GlobalTracer; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import com.amazonaws.services.lambda.runtime.Context; import com.amazonaws.services.lambda.runtime.events.APIGatewayV2HTTPEvent; import com.amazonaws.services.lambda.runtime.events.APIGatewayV2HTTPResponse; @@ -45,7 +46,7 @@ public static APIGatewayProxyV2TransactionHelper getInstance() { @Override protected Transaction doStartTransaction(APIGatewayV2HTTPEvent apiGatewayEvent, Context lambdaContext) { - Transaction transaction = tracer.startChildTransaction(apiGatewayEvent.getHeaders(), MapTextHeaderGetter.INSTANCE, apiGatewayEvent.getClass().getClassLoader()); + Transaction transaction = tracer.startChildTransaction(apiGatewayEvent.getHeaders(), MapTextHeaderGetter.INSTANCE, PrivilegedActionUtils.getClassLoader(apiGatewayEvent.getClass())); APIGatewayV2HTTPEvent.RequestContext requestContext = apiGatewayEvent.getRequestContext(); if (transaction != null) { diff --git a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/AbstractMessageBasedTransactionHelper.java b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/AbstractMessageBasedTransactionHelper.java index f96e1bcbf1..fac1e586ca 100644 --- a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/AbstractMessageBasedTransactionHelper.java +++ b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/AbstractMessageBasedTransactionHelper.java @@ -23,6 +23,7 @@ import co.elastic.apm.agent.impl.context.ServiceOrigin; import co.elastic.apm.agent.impl.transaction.AbstractSpan; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import com.amazonaws.services.lambda.runtime.Context; import javax.annotation.Nullable; @@ -50,7 +51,7 @@ protected AbstractMessageBasedTransactionHelper(ElasticApmTracer tracer) { @Nullable @Override protected Transaction doStartTransaction(I event, Context lambdaContext) { - Transaction transaction = tracer.startRootTransaction(lambdaContext.getClass().getClassLoader()); + Transaction transaction = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(lambdaContext.getClass())); if (null != transaction) { addSpanLinks(transaction, event); } diff --git a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/PlainTransactionHelper.java b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/PlainTransactionHelper.java index 8ba4b12760..3adda2f58d 100644 --- a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/PlainTransactionHelper.java +++ b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/PlainTransactionHelper.java @@ -21,6 +21,7 @@ import co.elastic.apm.agent.impl.ElasticApmTracer; import co.elastic.apm.agent.impl.GlobalTracer; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import com.amazonaws.services.lambda.runtime.Context; import javax.annotation.Nullable; @@ -45,7 +46,7 @@ public static PlainTransactionHelper getInstance() { @Override protected Transaction doStartTransaction(Object input, Context lambdaContext) { - return tracer.startRootTransaction(lambdaContext.getClass().getClassLoader()); + return tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(lambdaContext.getClass())); } @Override diff --git a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/S3TransactionHelper.java b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/S3TransactionHelper.java index 6218c46f9d..44b0119bc8 100644 --- a/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/S3TransactionHelper.java +++ b/apm-agent-plugins/apm-awslambda-plugin/src/main/java/co/elastic/apm/agent/awslambda/helper/S3TransactionHelper.java @@ -25,6 +25,7 @@ import co.elastic.apm.agent.impl.transaction.AbstractSpan; import co.elastic.apm.agent.impl.transaction.FaasTrigger; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import com.amazonaws.services.lambda.runtime.Context; import com.amazonaws.services.lambda.runtime.events.S3Event; import com.amazonaws.services.lambda.runtime.events.models.s3.S3EventNotification; @@ -52,7 +53,7 @@ public static S3TransactionHelper getInstance() { @Nullable @Override protected Transaction doStartTransaction(S3Event s3Event, Context lambdaContext) { - return tracer.startRootTransaction(lambdaContext.getClass().getClassLoader()); + return tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(lambdaContext.getClass())); } @Override diff --git a/apm-agent-plugins/apm-dubbo-plugin/src/main/java/co/elastic/apm/agent/dubbo/advice/AlibabaMonitorFilterAdvice.java b/apm-agent-plugins/apm-dubbo-plugin/src/main/java/co/elastic/apm/agent/dubbo/advice/AlibabaMonitorFilterAdvice.java index 84ef20ffb9..c715612d81 100644 --- a/apm-agent-plugins/apm-dubbo-plugin/src/main/java/co/elastic/apm/agent/dubbo/advice/AlibabaMonitorFilterAdvice.java +++ b/apm-agent-plugins/apm-dubbo-plugin/src/main/java/co/elastic/apm/agent/dubbo/advice/AlibabaMonitorFilterAdvice.java @@ -26,6 +26,7 @@ import co.elastic.apm.agent.impl.transaction.Outcome; import co.elastic.apm.agent.impl.transaction.Span; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import com.alibaba.dubbo.rpc.Invocation; import com.alibaba.dubbo.rpc.Result; import com.alibaba.dubbo.rpc.RpcContext; @@ -53,7 +54,7 @@ public static Object onEnterFilterInvoke(@Advice.Argument(1) Invocation invocati } } else if (context.isProviderSide() && active == null) { // for provider side - Transaction transaction = tracer.startChildTransaction(context, AlibabaDubboTextMapPropagator.INSTANCE, Invocation.class.getClassLoader()); + Transaction transaction = tracer.startChildTransaction(context, AlibabaDubboTextMapPropagator.INSTANCE, PrivilegedActionUtils.getClassLoader(Invocation.class)); if (transaction != null) { transaction.activate(); DubboTraceHelper.fillTransaction(transaction, invocation.getInvoker().getInterface(), invocation.getMethodName()); diff --git a/apm-agent-plugins/apm-dubbo-plugin/src/main/java/co/elastic/apm/agent/dubbo/advice/ApacheMonitorFilterAdvice.java b/apm-agent-plugins/apm-dubbo-plugin/src/main/java/co/elastic/apm/agent/dubbo/advice/ApacheMonitorFilterAdvice.java index a23b46b489..3990a03ecb 100644 --- a/apm-agent-plugins/apm-dubbo-plugin/src/main/java/co/elastic/apm/agent/dubbo/advice/ApacheMonitorFilterAdvice.java +++ b/apm-agent-plugins/apm-dubbo-plugin/src/main/java/co/elastic/apm/agent/dubbo/advice/ApacheMonitorFilterAdvice.java @@ -26,6 +26,7 @@ import co.elastic.apm.agent.impl.transaction.Outcome; import co.elastic.apm.agent.impl.transaction.Span; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import org.apache.dubbo.rpc.AsyncRpcResult; import org.apache.dubbo.rpc.Invocation; @@ -54,7 +55,7 @@ public static Object onEnterFilterInvoke(@Advice.Argument(1) Invocation invocati } } else if (context.isProviderSide() && active == null) { // for provider side - Transaction transaction = tracer.startChildTransaction(context, ApacheDubboTextMapPropagator.INSTANCE, Invocation.class.getClassLoader()); + Transaction transaction = tracer.startChildTransaction(context, ApacheDubboTextMapPropagator.INSTANCE, PrivilegedActionUtils.getClassLoader(Invocation.class)); if (transaction != null) { transaction.activate(); DubboTraceHelper.fillTransaction(transaction, invocation.getInvoker().getInterface(), invocation.getMethodName()); diff --git a/apm-agent-plugins/apm-grpc/apm-grpc-plugin/src/main/java/co/elastic/apm/agent/grpc/ServerCallHandlerInstrumentation.java b/apm-agent-plugins/apm-grpc/apm-grpc-plugin/src/main/java/co/elastic/apm/agent/grpc/ServerCallHandlerInstrumentation.java index 4db71b367b..b5a4d728a1 100644 --- a/apm-agent-plugins/apm-grpc/apm-grpc-plugin/src/main/java/co/elastic/apm/agent/grpc/ServerCallHandlerInstrumentation.java +++ b/apm-agent-plugins/apm-grpc/apm-grpc-plugin/src/main/java/co/elastic/apm/agent/grpc/ServerCallHandlerInstrumentation.java @@ -21,6 +21,7 @@ import co.elastic.apm.agent.impl.transaction.Transaction; import co.elastic.apm.agent.sdk.DynamicTransformer; import co.elastic.apm.agent.sdk.ElasticApmInstrumentation; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import io.grpc.Metadata; import io.grpc.ServerCall; import net.bytebuddy.asm.Advice; @@ -84,7 +85,7 @@ public static Object onEnter(@Advice.Origin Class clazz, @Advice.Argument(0) ServerCall serverCall, @Advice.Argument(1) Metadata headers) { - return GrpcHelper.getInstance().startTransaction(tracer, clazz.getClassLoader(), serverCall, headers); + return GrpcHelper.getInstance().startTransaction(tracer, PrivilegedActionUtils.getClassLoader(clazz), serverCall, headers); } @Advice.OnMethodExit(suppress = Throwable.class, onThrowable = Throwable.class, inline = false) diff --git a/apm-agent-plugins/apm-jms-plugin/apm-jms-plugin-base/src/main/java/co/elastic/apm/agent/jms/JmsInstrumentationHelper.java b/apm-agent-plugins/apm-jms-plugin/apm-jms-plugin-base/src/main/java/co/elastic/apm/agent/jms/JmsInstrumentationHelper.java index 14b50e38b3..0448b51e3c 100644 --- a/apm-agent-plugins/apm-jms-plugin/apm-jms-plugin-base/src/main/java/co/elastic/apm/agent/jms/JmsInstrumentationHelper.java +++ b/apm-agent-plugins/apm-jms-plugin/apm-jms-plugin-base/src/main/java/co/elastic/apm/agent/jms/JmsInstrumentationHelper.java @@ -28,6 +28,7 @@ import co.elastic.apm.agent.matcher.WildcardMatcher; import co.elastic.apm.agent.sdk.logging.Logger; import co.elastic.apm.agent.sdk.logging.LoggerFactory; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import javax.annotation.Nullable; import javax.jms.Destination; @@ -143,7 +144,7 @@ public Span startJmsSendSpan(Destination destination, Message message) { @Nullable public Transaction startJmsTransaction(Message parentMessage, Class instrumentedClass) { - Transaction transaction = tracer.startChildTransaction(parentMessage, JmsMessagePropertyAccessor.instance(), instrumentedClass.getClassLoader()); + Transaction transaction = tracer.startChildTransaction(parentMessage, JmsMessagePropertyAccessor.instance(), PrivilegedActionUtils.getClassLoader(instrumentedClass)); if (transaction != null) { transaction.setFrameworkName(FRAMEWORK_NAME); } diff --git a/apm-agent-plugins/apm-jms-plugin/apm-jms-plugin-base/src/main/java/co/elastic/apm/agent/jms/JmsMessageConsumerInstrumentation.java b/apm-agent-plugins/apm-jms-plugin/apm-jms-plugin-base/src/main/java/co/elastic/apm/agent/jms/JmsMessageConsumerInstrumentation.java index 9fc0d1dbea..c18fe4a168 100644 --- a/apm-agent-plugins/apm-jms-plugin/apm-jms-plugin-base/src/main/java/co/elastic/apm/agent/jms/JmsMessageConsumerInstrumentation.java +++ b/apm-agent-plugins/apm-jms-plugin/apm-jms-plugin-base/src/main/java/co/elastic/apm/agent/jms/JmsMessageConsumerInstrumentation.java @@ -23,6 +23,7 @@ import co.elastic.apm.agent.impl.transaction.Span; import co.elastic.apm.agent.impl.transaction.TraceContext; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.asm.Advice.AssignReturned.ToArguments.ToArgument; import net.bytebuddy.description.NamedElement; @@ -129,7 +130,7 @@ public static Object beforeReceive(@Advice.Origin Class clazz, .withSubtype("jms") .withAction("receive"); } else if (createPollingTransaction) { - createdSpan = tracer.startRootTransaction(clazz.getClassLoader()); + createdSpan = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(clazz)); if (createdSpan != null) { ((Transaction) createdSpan).withType(MESSAGE_POLLING); } diff --git a/apm-agent-plugins/apm-kafka-plugin/apm-kafka-headers-plugin/src/main/java/co/elastic/apm/agent/kafka/helper/ConsumerRecordsIteratorWrapper.java b/apm-agent-plugins/apm-kafka-plugin/apm-kafka-headers-plugin/src/main/java/co/elastic/apm/agent/kafka/helper/ConsumerRecordsIteratorWrapper.java index b336cd2589..b40e6ff83f 100644 --- a/apm-agent-plugins/apm-kafka-plugin/apm-kafka-headers-plugin/src/main/java/co/elastic/apm/agent/kafka/helper/ConsumerRecordsIteratorWrapper.java +++ b/apm-agent-plugins/apm-kafka-plugin/apm-kafka-headers-plugin/src/main/java/co/elastic/apm/agent/kafka/helper/ConsumerRecordsIteratorWrapper.java @@ -25,6 +25,7 @@ import co.elastic.apm.agent.impl.transaction.TraceContext; import co.elastic.apm.agent.impl.transaction.Transaction; import co.elastic.apm.agent.matcher.WildcardMatcher; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import org.apache.kafka.clients.consumer.ConsumerRecord; import org.apache.kafka.common.header.Header; import org.apache.kafka.common.record.TimestampType; @@ -74,7 +75,7 @@ public void endCurrentTransaction() { try { String topic = record.topic(); if (!WildcardMatcher.isAnyMatch(messagingConfiguration.getIgnoreMessageQueues(), topic)) { - Transaction transaction = tracer.startChildTransaction(record, KafkaRecordHeaderAccessor.instance(), ConsumerRecordsIteratorWrapper.class.getClassLoader()); + Transaction transaction = tracer.startChildTransaction(record, KafkaRecordHeaderAccessor.instance(), PrivilegedActionUtils.getClassLoader(ConsumerRecordsIteratorWrapper.class)); if (transaction != null) { transaction.withType("messaging").withName("Kafka record from " + topic).activate(); transaction.setFrameworkName(FRAMEWORK_NAME); diff --git a/apm-agent-plugins/apm-kafka-plugin/apm-kafka-spring-plugin/src/main/java/co/elastic/apm/agent/kafka/SpringKafkaBatchListenerInstrumentation.java b/apm-agent-plugins/apm-kafka-plugin/apm-kafka-spring-plugin/src/main/java/co/elastic/apm/agent/kafka/SpringKafkaBatchListenerInstrumentation.java index 6db9b8eea9..d3d6dced5a 100644 --- a/apm-agent-plugins/apm-kafka-plugin/apm-kafka-spring-plugin/src/main/java/co/elastic/apm/agent/kafka/SpringKafkaBatchListenerInstrumentation.java +++ b/apm-agent-plugins/apm-kafka-plugin/apm-kafka-spring-plugin/src/main/java/co/elastic/apm/agent/kafka/SpringKafkaBatchListenerInstrumentation.java @@ -22,6 +22,7 @@ import co.elastic.apm.agent.sdk.logging.Logger; import co.elastic.apm.agent.sdk.logging.LoggerFactory; import co.elastic.apm.agent.util.LoggerUtils; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.method.MethodDescription; import net.bytebuddy.description.type.TypeDescription; @@ -74,7 +75,7 @@ public static class SpringKafkaBatchListenerAdvice { @Nullable @Advice.OnMethodEnter(suppress = Throwable.class, inline = false) public static Object onEnter(@Advice.This Object thiz) { - Transaction transaction = tracer.startRootTransaction(thiz.getClass().getClassLoader()); + Transaction transaction = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(thiz.getClass())); if (transaction != null) { transaction .withType("messaging") diff --git a/apm-agent-plugins/apm-logging-plugin/apm-logging-plugin-common/src/main/java/co/elastic/apm/agent/loginstr/error/LoggerErrorHelper.java b/apm-agent-plugins/apm-logging-plugin/apm-logging-plugin-common/src/main/java/co/elastic/apm/agent/loginstr/error/LoggerErrorHelper.java index 75b3507358..88baa198dd 100644 --- a/apm-agent-plugins/apm-logging-plugin/apm-logging-plugin-common/src/main/java/co/elastic/apm/agent/loginstr/error/LoggerErrorHelper.java +++ b/apm-agent-plugins/apm-logging-plugin/apm-logging-plugin-common/src/main/java/co/elastic/apm/agent/loginstr/error/LoggerErrorHelper.java @@ -21,6 +21,7 @@ import co.elastic.apm.agent.impl.Tracer; import co.elastic.apm.agent.impl.error.ErrorCapture; import co.elastic.apm.agent.sdk.state.CallDepth; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import javax.annotation.Nullable; @@ -45,7 +46,7 @@ public LoggerErrorHelper(Class adviceClass, Tracer tracer) { public Object enter(@Nullable Throwable exception, Class originClass) { if (!callDepth.isNestedCallAndIncrement()) { if (exception != null) { - ErrorCapture error = tracer.captureException(exception, tracer.getActive(), originClass.getClassLoader()); + ErrorCapture error = tracer.captureException(exception, tracer.getActive(), PrivilegedActionUtils.getClassLoader(originClass)); if (error != null) { error.activate(); } diff --git a/apm-agent-plugins/apm-micrometer-plugin/src/main/java/co/elastic/apm/agent/micrometer/MicrometerMeterRegistrySerializer.java b/apm-agent-plugins/apm-micrometer-plugin/src/main/java/co/elastic/apm/agent/micrometer/MicrometerMeterRegistrySerializer.java index 67ddc46d0d..6b0ebc9e4d 100644 --- a/apm-agent-plugins/apm-micrometer-plugin/src/main/java/co/elastic/apm/agent/micrometer/MicrometerMeterRegistrySerializer.java +++ b/apm-agent-plugins/apm-micrometer-plugin/src/main/java/co/elastic/apm/agent/micrometer/MicrometerMeterRegistrySerializer.java @@ -22,6 +22,7 @@ import co.elastic.apm.agent.report.serialize.DslJsonSerializer; import co.elastic.apm.agent.sdk.weakconcurrent.WeakConcurrent; import co.elastic.apm.agent.sdk.weakconcurrent.WeakSet; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import com.dslplatform.json.DslJson; import com.dslplatform.json.JsonWriter; import com.dslplatform.json.NumberConverter; @@ -107,7 +108,7 @@ boolean serializeMetricSet(List tags, List meters, long epochMicros, DslJsonSerializer.writeFieldName("samples", jw); jw.writeByte(JsonWriter.OBJECT_START); - ClassLoader originalContextCL = Thread.currentThread().getContextClassLoader(); + ClassLoader originalContextCL = PrivilegedActionUtils.getContextClassLoader(Thread.currentThread()); try { for (int i = 0, size = meters.size(); i < size; i++) { Meter meter = meters.get(i); @@ -116,7 +117,7 @@ boolean serializeMetricSet(List tags, List meters, long epochMicros, } try { // Setting the Meter CL as the context class loader during the Meter query operations - Thread.currentThread().setContextClassLoader(meter.getClass().getClassLoader()); + PrivilegedActionUtils.setContextClassLoader(Thread.currentThread(), PrivilegedActionUtils.getClassLoader(meter.getClass())); if (meter instanceof Timer) { Timer timer = (Timer) meter; hasSamples = serializeTimer(jw, timer.getId(), timer.count(), timer.totalTime(TimeUnit.MICROSECONDS), hasSamples, replaceBuilder, dedotMetricName); @@ -149,7 +150,7 @@ boolean serializeMetricSet(List tags, List meters, long epochMicros, } } } finally { - Thread.currentThread().setContextClassLoader(originalContextCL); + PrivilegedActionUtils.setContextClassLoader(Thread.currentThread(), originalContextCL); } jw.writeByte(JsonWriter.OBJECT_END); } diff --git a/apm-agent-plugins/apm-opentelemetry/apm-opentelemetry-plugin/src/main/java/co/elastic/apm/agent/opentelemetry/sdk/OTelSpanBuilder.java b/apm-agent-plugins/apm-opentelemetry/apm-opentelemetry-plugin/src/main/java/co/elastic/apm/agent/opentelemetry/sdk/OTelSpanBuilder.java index 882b0e64c3..5ddc7d7538 100644 --- a/apm-agent-plugins/apm-opentelemetry/apm-opentelemetry-plugin/src/main/java/co/elastic/apm/agent/opentelemetry/sdk/OTelSpanBuilder.java +++ b/apm-agent-plugins/apm-opentelemetry/apm-opentelemetry-plugin/src/main/java/co/elastic/apm/agent/opentelemetry/sdk/OTelSpanBuilder.java @@ -29,6 +29,7 @@ import co.elastic.apm.agent.sdk.logging.LoggerFactory; import co.elastic.apm.agent.util.LoggerUtils; import co.elastic.apm.agent.util.PotentiallyMultiValuedMap; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import co.elastic.apm.agent.util.VersionUtils; import io.opentelemetry.api.OpenTelemetry; import io.opentelemetry.api.common.AttributeKey; @@ -158,9 +159,9 @@ public Span startSpan() { if (remoteContext != null) { PotentiallyMultiValuedMap headers = new PotentiallyMultiValuedMap(2); W3CTraceContextPropagator.getInstance().inject(remoteContext, headers, PotentiallyMultiValuedMap::add); - span = elasticApmTracer.startChildTransaction(headers, MultiValueMapAccessor.INSTANCE, getClass().getClassLoader(), epochMicros); + span = elasticApmTracer.startChildTransaction(headers, MultiValueMapAccessor.INSTANCE, PrivilegedActionUtils.getClassLoader(getClass()), epochMicros); } else if (parent == null) { - span = elasticApmTracer.startRootTransaction(getClass().getClassLoader(), epochMicros); + span = elasticApmTracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(getClass()), epochMicros); } else { span = elasticApmTracer.startSpan(parent, epochMicros); } diff --git a/apm-agent-plugins/apm-opentracing-plugin/src/main/java/co/elastic/apm/agent/opentracingimpl/ApmSpanBuilderInstrumentation.java b/apm-agent-plugins/apm-opentracing-plugin/src/main/java/co/elastic/apm/agent/opentracingimpl/ApmSpanBuilderInstrumentation.java index e493a65301..919ccfd330 100644 --- a/apm-agent-plugins/apm-opentracing-plugin/src/main/java/co/elastic/apm/agent/opentracingimpl/ApmSpanBuilderInstrumentation.java +++ b/apm-agent-plugins/apm-opentracing-plugin/src/main/java/co/elastic/apm/agent/opentracingimpl/ApmSpanBuilderInstrumentation.java @@ -25,6 +25,7 @@ import co.elastic.apm.agent.impl.transaction.AbstractSpan; import co.elastic.apm.agent.impl.transaction.TraceContext; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.method.MethodDescription; import net.bytebuddy.description.type.TypeDescription; @@ -80,7 +81,7 @@ public static Object createSpan(@Advice.Argument(value = 0, typing = Assigner.Ty if (parentContext instanceof AbstractSpan) { parent = (AbstractSpan) parentContext; } - return doCreateTransactionOrSpan(parent, tags, operationName, microseconds, baggage, spanBuilderClass.getClassLoader()); + return doCreateTransactionOrSpan(parent, tags, operationName, microseconds, baggage, PrivilegedActionUtils.getClassLoader(spanBuilderClass)); } @Nullable diff --git a/apm-agent-plugins/apm-quartz-job-plugin/quartz-common/src/main/java/co/elastic/apm/agent/quartzjob/AbstractJobTransactionNameInstrumentation.java b/apm-agent-plugins/apm-quartz-job-plugin/quartz-common/src/main/java/co/elastic/apm/agent/quartzjob/AbstractJobTransactionNameInstrumentation.java index b9f4a6011b..a2bbf4bcd4 100644 --- a/apm-agent-plugins/apm-quartz-job-plugin/quartz-common/src/main/java/co/elastic/apm/agent/quartzjob/AbstractJobTransactionNameInstrumentation.java +++ b/apm-agent-plugins/apm-quartz-job-plugin/quartz-common/src/main/java/co/elastic/apm/agent/quartzjob/AbstractJobTransactionNameInstrumentation.java @@ -25,6 +25,7 @@ import co.elastic.apm.agent.impl.transaction.AbstractSpan; import co.elastic.apm.agent.impl.transaction.Outcome; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import co.elastic.apm.agent.util.VersionUtils; import net.bytebuddy.description.NamedElement; import net.bytebuddy.description.type.TypeDescription; @@ -113,7 +114,7 @@ protected static void endTransaction(@Nullable T jobExecutionContext, @Nullable private static Transaction createAndActivateTransaction(Class originClass, String name) { - Transaction transaction = GlobalTracer.get().startRootTransaction(originClass.getClassLoader()); + Transaction transaction = GlobalTracer.get().startRootTransaction(PrivilegedActionUtils.getClassLoader(originClass)); if (transaction != null) { transaction.withName(name) .withType(AbstractJobTransactionNameInstrumentation.TRANSACTION_TYPE) diff --git a/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-plugin/src/main/java/co/elastic/apm/agent/rabbitmq/ConsumerInstrumentation.java b/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-plugin/src/main/java/co/elastic/apm/agent/rabbitmq/ConsumerInstrumentation.java index edc6d737e0..daf7649038 100644 --- a/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-plugin/src/main/java/co/elastic/apm/agent/rabbitmq/ConsumerInstrumentation.java +++ b/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-plugin/src/main/java/co/elastic/apm/agent/rabbitmq/ConsumerInstrumentation.java @@ -21,6 +21,7 @@ import co.elastic.apm.agent.impl.context.Message; import co.elastic.apm.agent.impl.transaction.Transaction; import co.elastic.apm.agent.rabbitmq.header.RabbitMQTextHeaderGetter; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import com.rabbitmq.client.AMQP; import com.rabbitmq.client.Consumer; import com.rabbitmq.client.Envelope; @@ -100,7 +101,7 @@ public static Object onHandleDelivery(@Advice.Origin Class originClazz, return null; } - transaction = tracer.startChildTransaction(properties, RabbitMQTextHeaderGetter.INSTANCE, originClazz.getClassLoader()); + transaction = tracer.startChildTransaction(properties, RabbitMQTextHeaderGetter.INSTANCE, PrivilegedActionUtils.getClassLoader(originClazz)); if (transaction == null) { return null; } diff --git a/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-spring/src/main/java/co/elastic/apm/agent/rabbitmq/SpringAmqpBatchMessageListenerInstrumentation.java b/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-spring/src/main/java/co/elastic/apm/agent/rabbitmq/SpringAmqpBatchMessageListenerInstrumentation.java index 2476a623c7..f1c70e981d 100644 --- a/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-spring/src/main/java/co/elastic/apm/agent/rabbitmq/SpringAmqpBatchMessageListenerInstrumentation.java +++ b/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-spring/src/main/java/co/elastic/apm/agent/rabbitmq/SpringAmqpBatchMessageListenerInstrumentation.java @@ -29,6 +29,7 @@ import co.elastic.apm.agent.sdk.logging.Logger; import co.elastic.apm.agent.sdk.logging.LoggerFactory; import co.elastic.apm.agent.util.LoggerUtils; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.asm.Advice.AssignReturned.ToArguments.ToArgument; import net.bytebuddy.description.method.MethodDescription; @@ -79,7 +80,7 @@ public static Object[] beforeOnBatch(@Advice.This Object thiz, if (tracer.isRunning() && messageBatch != null && !messageBatch.isEmpty()) { AbstractSpan active = tracer.getActive(); if (active == null && messagingConfiguration.getMessageBatchStrategy() == MessagingConfiguration.BatchStrategy.BATCH_HANDLING) { - batchTransaction = tracer.startRootTransaction(thiz.getClass().getClassLoader()); + batchTransaction = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(thiz.getClass())); if (batchTransaction == null) { oneTimeTransactionCreationWarningLogger.warn("Failed to start Spring AMQP transaction for batch processing"); } else { diff --git a/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-spring/src/main/java/co/elastic/apm/agent/rabbitmq/SpringAmqpTransactionHelper.java b/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-spring/src/main/java/co/elastic/apm/agent/rabbitmq/SpringAmqpTransactionHelper.java index e5862eecdc..078c77cfd9 100644 --- a/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-spring/src/main/java/co/elastic/apm/agent/rabbitmq/SpringAmqpTransactionHelper.java +++ b/apm-agent-plugins/apm-rabbitmq/apm-rabbitmq-spring/src/main/java/co/elastic/apm/agent/rabbitmq/SpringAmqpTransactionHelper.java @@ -21,6 +21,7 @@ import co.elastic.apm.agent.impl.ElasticApmTracer; import co.elastic.apm.agent.impl.transaction.Transaction; import co.elastic.apm.agent.rabbitmq.header.SpringRabbitMQTextHeaderGetter; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import org.springframework.amqp.core.Message; import org.springframework.amqp.core.MessageProperties; @@ -49,7 +50,7 @@ public Transaction createTransaction(Message message, String transactionNamePref if (transaction != null) { return null; } - transaction = tracer.startChildTransaction(messageProperties, SpringRabbitMQTextHeaderGetter.INSTANCE, message.getClass().getClassLoader()); + transaction = tracer.startChildTransaction(messageProperties, SpringRabbitMQTextHeaderGetter.INSTANCE, PrivilegedActionUtils.getClassLoader(message.getClass())); if (transaction == null) { return null; } diff --git a/apm-agent-plugins/apm-scheduled-annotation-plugin/src/main/java/co/elastic/apm/agent/scheduled/ScheduledTransactionNameInstrumentation.java b/apm-agent-plugins/apm-scheduled-annotation-plugin/src/main/java/co/elastic/apm/agent/scheduled/ScheduledTransactionNameInstrumentation.java index b79ea213ee..fbfe6c2bd8 100644 --- a/apm-agent-plugins/apm-scheduled-annotation-plugin/src/main/java/co/elastic/apm/agent/scheduled/ScheduledTransactionNameInstrumentation.java +++ b/apm-agent-plugins/apm-scheduled-annotation-plugin/src/main/java/co/elastic/apm/agent/scheduled/ScheduledTransactionNameInstrumentation.java @@ -25,6 +25,7 @@ import co.elastic.apm.agent.impl.transaction.AbstractSpan; import co.elastic.apm.agent.impl.transaction.Outcome; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.NamedElement; import net.bytebuddy.description.method.MethodDescription; @@ -62,7 +63,7 @@ public static Object setTransactionName(@SimpleMethodSignature String signature, @Advice.Origin Class clazz) { AbstractSpan active = tracer.getActive(); if (active == null) { - Transaction transaction = tracer.startRootTransaction(clazz.getClassLoader()); + Transaction transaction = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(clazz)); if (transaction != null) { transaction.withName(signature) .withType("scheduled") diff --git a/apm-agent-plugins/apm-scheduled-annotation-plugin/src/main/java/co/elastic/apm/agent/scheduled/TimerTaskInstrumentation.java b/apm-agent-plugins/apm-scheduled-annotation-plugin/src/main/java/co/elastic/apm/agent/scheduled/TimerTaskInstrumentation.java index 59984d223b..5435b521fa 100644 --- a/apm-agent-plugins/apm-scheduled-annotation-plugin/src/main/java/co/elastic/apm/agent/scheduled/TimerTaskInstrumentation.java +++ b/apm-agent-plugins/apm-scheduled-annotation-plugin/src/main/java/co/elastic/apm/agent/scheduled/TimerTaskInstrumentation.java @@ -24,6 +24,7 @@ import co.elastic.apm.agent.impl.stacktrace.StacktraceConfiguration; import co.elastic.apm.agent.impl.transaction.AbstractSpan; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.description.NamedElement; import net.bytebuddy.description.method.MethodDescription; @@ -61,7 +62,7 @@ public static Object setTransactionName(@SimpleMethodSignatureOffsetMappingFacto @Advice.Origin Class clazz) { AbstractSpan active = tracer.getActive(); if (active == null) { - Transaction transaction = tracer.startRootTransaction(clazz.getClassLoader()); + Transaction transaction = tracer.startRootTransaction(PrivilegedActionUtils.getClassLoader(clazz)); if (transaction != null) { transaction.withName(signature) .withType("scheduled") diff --git a/apm-agent-plugins/apm-spring-webflux/apm-spring-webflux-plugin/src/main/java/co/elastic/apm/agent/springwebflux/WebfluxHelper.java b/apm-agent-plugins/apm-spring-webflux/apm-spring-webflux-plugin/src/main/java/co/elastic/apm/agent/springwebflux/WebfluxHelper.java index 1d95f8f210..1c0e31f72b 100644 --- a/apm-agent-plugins/apm-spring-webflux/apm-spring-webflux-plugin/src/main/java/co/elastic/apm/agent/springwebflux/WebfluxHelper.java +++ b/apm-agent-plugins/apm-spring-webflux/apm-spring-webflux-plugin/src/main/java/co/elastic/apm/agent/springwebflux/WebfluxHelper.java @@ -32,6 +32,7 @@ import co.elastic.apm.agent.sdk.weakconcurrent.WeakConcurrent; import co.elastic.apm.agent.sdk.weakconcurrent.WeakMap; import co.elastic.apm.agent.util.PotentiallyMultiValuedMap; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import co.elastic.apm.agent.util.TransactionNameUtils; import org.reactivestreams.Publisher; import org.springframework.http.HttpCookie; @@ -95,7 +96,7 @@ public static Transaction getOrCreateTransaction(Tracer tracer, ServerWebExchang String path = exchange.getRequest().getPath().value(); String userAgent = exchange.getRequest().getHeaders().getFirst("User-Agent"); if (!fromServlet && !serverHelper.isRequestExcluded(path, userAgent)) { - transaction = tracer.startChildTransaction(exchange.getRequest().getHeaders(), HEADER_GETTER, ServerWebExchange.class.getClassLoader()); + transaction = tracer.startChildTransaction(exchange.getRequest().getHeaders(), HEADER_GETTER, PrivilegedActionUtils.getClassLoader(ServerWebExchange.class)); } if (transaction == null) { diff --git a/apm-agent-plugins/apm-vertx/apm-vertx-common/src/main/java/co/elastic/apm/agent/vertx/AbstractVertxWebHelper.java b/apm-agent-plugins/apm-vertx/apm-vertx-common/src/main/java/co/elastic/apm/agent/vertx/AbstractVertxWebHelper.java index ad762d8048..0fcebf7e06 100644 --- a/apm-agent-plugins/apm-vertx/apm-vertx-common/src/main/java/co/elastic/apm/agent/vertx/AbstractVertxWebHelper.java +++ b/apm-agent-plugins/apm-vertx/apm-vertx-common/src/main/java/co/elastic/apm/agent/vertx/AbstractVertxWebHelper.java @@ -24,6 +24,7 @@ import co.elastic.apm.agent.impl.context.web.ResultUtil; import co.elastic.apm.agent.impl.transaction.AbstractSpan; import co.elastic.apm.agent.impl.transaction.Transaction; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import co.elastic.apm.agent.util.VersionUtils; import io.netty.buffer.ByteBuf; import io.netty.handler.codec.http.cookie.Cookie; @@ -65,7 +66,7 @@ protected Transaction startOrGetTransaction(HttpServerRequest httpServerRequest) if (transaction != null) { return transaction; } else if (!serverHelper.isRequestExcluded(httpServerRequest.uri(), httpServerRequest.headers().get(USER_AGENT_HEADER))) { - transaction = tracer.startChildTransaction(httpServerRequest.headers(), headerGetter, httpServerRequest.getClass().getClassLoader()); + transaction = tracer.startChildTransaction(httpServerRequest.headers(), headerGetter, PrivilegedActionUtils.getClassLoader(httpServerRequest.getClass())); } return transaction; } From 454f6a20354c17f78d5f55ef77022b1fc14b8726 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Fri, 18 Nov 2022 17:10:02 +0100 Subject: [PATCH 06/14] wip cover more file read + protection domain --- .../configuration/source/ConfigSources.java | 4 +- .../elastic/apm/agent/impl/GlobalTracer.java | 2 +- .../apm/agent/report/ssl/SslUtils.java | 4 +- .../apm/agent/util/PrivilegedActionUtils.java | 50 ++++++++++++++++--- .../elastic/apm/agent/util/VersionUtils.java | 3 +- 5 files changed, 50 insertions(+), 13 deletions(-) diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/source/ConfigSources.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/source/ConfigSources.java index 8e127f6efc..5a70f18392 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/source/ConfigSources.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/configuration/source/ConfigSources.java @@ -18,9 +18,11 @@ */ package co.elastic.apm.agent.configuration.source; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import org.stagemonitor.configuration.source.SimpleSource; import javax.annotation.Nullable; +import java.io.File; import java.io.FileInputStream; import java.io.FileNotFoundException; import java.io.IOException; @@ -72,7 +74,7 @@ static Properties getPropertiesFromFilesystem(String location) { } Properties props = new Properties(); - try (InputStream input = new FileInputStream(location)) { + try (InputStream input = PrivilegedActionUtils.newFileInputStream(new File(location))) { props.load(input); return props; } catch (FileNotFoundException ex) { diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/GlobalTracer.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/GlobalTracer.java index a9b27794a8..017be270c8 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/GlobalTracer.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/impl/GlobalTracer.java @@ -75,7 +75,7 @@ private static void checkClassloader() { return; } - String agentLocation = GlobalTracer.class.getProtectionDomain().getCodeSource().getLocation().getFile(); + String agentLocation = PrivilegedActionUtils.getProtectionDomain(GlobalTracer.class).getCodeSource().getLocation().getFile(); if (!agentLocation.endsWith(".jar")) { // agent is not packaged, thus we assume running tests classloaderCheckOk = true; diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/report/ssl/SslUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/report/ssl/SslUtils.java index 26444282c5..f29131a83b 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/report/ssl/SslUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/report/ssl/SslUtils.java @@ -20,6 +20,7 @@ import co.elastic.apm.agent.sdk.logging.Logger; import co.elastic.apm.agent.sdk.logging.LoggerFactory; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import javax.annotation.Nullable; import javax.net.ssl.HostnameVerifier; @@ -30,6 +31,7 @@ import javax.net.ssl.SSLSocketFactory; import javax.net.ssl.TrustManager; import javax.net.ssl.X509TrustManager; +import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.security.GeneralSecurityException; @@ -164,7 +166,7 @@ public static KeyManager[] getKeyManagers() throws IOException, GeneralSecurityE char[] pwd = keyStorePassword != null ? keyStorePassword.toCharArray() : null; KeyStore ks = null; - try (FileInputStream input = new FileInputStream(keyStore)) { + try (FileInputStream input = PrivilegedActionUtils.newFileInputStream(new File(keyStore))) { if (keyStoreType != null) { ks = keyStoreProvider == null ? KeyStore.getInstance(keyStoreType) : diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java index 5a6d0f77b8..0ed8807d90 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java @@ -19,8 +19,12 @@ package co.elastic.apm.agent.util; import javax.annotation.Nullable; +import java.io.File; +import java.io.FileInputStream; +import java.io.FileNotFoundException; import java.security.AccessController; import java.security.PrivilegedAction; +import java.security.ProtectionDomain; import java.util.Map; /** @@ -69,7 +73,20 @@ public ClassLoader run() { }); } - public static ClassLoader getContextClassLoader(final Thread t){ + public static ProtectionDomain getProtectionDomain(final Class type) { + if (System.getSecurityManager() == null) { + return type.getProtectionDomain(); + } + + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public ProtectionDomain run() { + return type.getProtectionDomain(); + } + }); + } + + public static ClassLoader getContextClassLoader(final Thread t) { if (System.getSecurityManager() == null) { return t.getContextClassLoader(); } @@ -82,11 +99,10 @@ public ClassLoader run() { }); } - public static void setContextClassLoader(final Thread t, final @Nullable ClassLoader cl){ - if(System.getSecurityManager() == null){ + public static void setContextClassLoader(final Thread t, final @Nullable ClassLoader cl) { + if (System.getSecurityManager() == null) { t.setContextClassLoader(cl); } - AccessController.doPrivileged(new PrivilegedAction() { @Nullable @Override @@ -95,14 +111,12 @@ public Object run() { return null; } }); - } - public static Thread newThread(final @Nullable Runnable r){ - if(System.getSecurityManager() == null){ + public static Thread newThread(final @Nullable Runnable r) { + if (System.getSecurityManager() == null) { return new Thread(r); } - return AccessController.doPrivileged(new PrivilegedAction() { @Override public Thread run() { @@ -111,4 +125,24 @@ public Thread run() { }); } + public static FileInputStream newFileInputStream(final File file) throws FileNotFoundException { + if (System.getSecurityManager() == null) { + return new FileInputStream(file); + } + try { + return AccessController.doPrivileged(new PrivilegedAction() { + @Override + public FileInputStream run() { + try { + return new FileInputStream(file); + } catch (FileNotFoundException e) { + throw new RuntimeException(e); + } + } + }); + } catch (RuntimeException e) { + throw new RuntimeException(e.getCause()); + } + } + } diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/VersionUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/VersionUtils.java index 2175647831..73243cacf2 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/VersionUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/VersionUtils.java @@ -24,7 +24,6 @@ import javax.annotation.Nullable; import java.io.File; -import java.io.FileInputStream; import java.io.IOException; import java.io.InputStream; import java.util.Properties; @@ -107,7 +106,7 @@ public static String getManifestEntry(@Nullable File jarFile, String manifestAtt if (jarFile == null) { return null; } - try (JarInputStream jarInputStream = new JarInputStream(new FileInputStream(jarFile))) { + try (JarInputStream jarInputStream = new JarInputStream(PrivilegedActionUtils.newFileInputStream(jarFile))) { return jarInputStream.getManifest().getMainAttributes().getValue(manifestAttribute); } catch (IOException e) { return null; From 5305e4487b7715ac8b459f3844319256cce97dc0 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Mon, 21 Nov 2022 17:20:29 +0100 Subject: [PATCH 07/14] fix few occurences + inherit protection domain --- .../classloading/IndyPluginClassLoader.java | 10 +- .../logging/Log4j2ConfigurationFactory.java | 1 + .../apm/agent/logging/Log4j2LoggerBridge.java | 147 ++++++++++++++---- .../apm/agent/util/PackageScanner.java | 2 +- .../apm/agent/util/PrivilegedActionUtils.java | 50 ++++-- .../AbstractJulEcsReformattingHelper.java | 27 +++- .../JulEcsReformattingHelper.java | 6 +- .../TomcatReformattingHelper.java | 7 +- 8 files changed, 199 insertions(+), 51 deletions(-) diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/classloading/IndyPluginClassLoader.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/classloading/IndyPluginClassLoader.java index 19228486e1..463413e752 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/classloading/IndyPluginClassLoader.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/classloading/IndyPluginClassLoader.java @@ -18,7 +18,9 @@ */ package co.elastic.apm.agent.bci.classloading; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.dynamic.loading.ByteArrayClassLoader; +import net.bytebuddy.dynamic.loading.PackageDefinitionStrategy; import net.bytebuddy.matcher.ElementMatcher; import net.bytebuddy.matcher.ElementMatchers; @@ -41,9 +43,15 @@ public class IndyPluginClassLoader extends ByteArrayClassLoader.ChildFirst { public IndyPluginClassLoader(@Nullable ClassLoader targetClassLoader, ClassLoader agentClassLoader, Map typeDefinitions) { // See getResource on why we're using PersistenceHandler.LATENT over PersistenceHandler.MANIFEST - super(getParent(targetClassLoader, agentClassLoader), true, typeDefinitions, PersistenceHandler.LATENT); + super(getParent(targetClassLoader, agentClassLoader), + true, + typeDefinitions, + PrivilegedActionUtils.getProtectionDomain(agentClassLoader.getClass()), // inherit protection domain from agent CL + PersistenceHandler.LATENT, + PackageDefinitionStrategy.Trivial.INSTANCE); } + private static ClassLoader getParent(@Nullable ClassLoader targetClassLoader, ClassLoader agentClassLoader) { if (targetClassLoader == null) { // the MultipleParentClassLoader doesn't support null values diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java index 663baf1ae5..c673ee04bc 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java @@ -22,6 +22,7 @@ import co.elastic.apm.agent.configuration.CoreConfiguration; import co.elastic.apm.agent.configuration.ServiceInfo; import co.elastic.apm.agent.configuration.converter.ByteValue; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import org.apache.logging.log4j.Level; import org.apache.logging.log4j.core.LoggerContext; import org.apache.logging.log4j.core.appender.ConsoleAppender; diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2LoggerBridge.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2LoggerBridge.java index 7b5e5f8418..2090c13e69 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2LoggerBridge.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2LoggerBridge.java @@ -22,6 +22,9 @@ import org.apache.logging.log4j.Level; import org.apache.logging.log4j.spi.ExtendedLogger; +import java.security.AccessController; +import java.security.PrivilegedAction; + /** * Based on {@code org.apache.logging.slf4j.Log4jLogger} */ @@ -44,151 +47,235 @@ public String getName() { @Override public boolean isTraceEnabled() { - return log4jLogger.isEnabled(Level.TRACE, null, null); + return isEnabled(Level.TRACE); } @Override public void trace(final String format) { - log4jLogger.logIfEnabled(FQCN, Level.TRACE, null, format); + logIfEnabled(Level.TRACE, format); } @Override public void trace(final String format, final Object o) { - log4jLogger.logIfEnabled(FQCN, Level.TRACE, null, format, o); + logIfEnabled(Level.TRACE, format, o); } @Override public void trace(final String format, final Object arg1, final Object arg2) { - log4jLogger.logIfEnabled(FQCN, Level.TRACE, null, format, arg1, arg2); + logIfEnabled(Level.TRACE, format, arg1, arg2); } @Override public void trace(final String format, final Object... args) { - log4jLogger.logIfEnabled(FQCN, Level.TRACE, null, format, args); + logIfEnabled(Level.TRACE, format, args); } @Override public void trace(final String format, final Throwable t) { - log4jLogger.logIfEnabled(FQCN, Level.TRACE, null, format, t); + logIfEnabled(Level.TRACE, format, t); } @Override public boolean isDebugEnabled() { - return log4jLogger.isEnabled(Level.DEBUG, null, null); + return isEnabled(Level.DEBUG); } @Override public void debug(final String format) { - log4jLogger.logIfEnabled(FQCN, Level.DEBUG, null, format); + logIfEnabled(Level.DEBUG, format); } @Override public void debug(final String format, final Object o) { - log4jLogger.logIfEnabled(FQCN, Level.DEBUG, null, format, o); + logIfEnabled(Level.DEBUG, format, o); } @Override public void debug(final String format, final Object arg1, final Object arg2) { - log4jLogger.logIfEnabled(FQCN, Level.DEBUG, null, format, arg1, arg2); + logIfEnabled(Level.DEBUG, format, arg1, arg2); } @Override public void debug(final String format, final Object... args) { - log4jLogger.logIfEnabled(FQCN, Level.DEBUG, null, format, args); + logIfEnabled(Level.DEBUG, format, args); } @Override public void debug(final String format, final Throwable t) { - log4jLogger.logIfEnabled(FQCN, Level.DEBUG, null, format, t); + logIfEnabled(Level.DEBUG, format, t); } @Override public boolean isInfoEnabled() { - return log4jLogger.isEnabled(Level.INFO, null, null); + return isEnabled(Level.INFO); } @Override public void info(final String format) { - log4jLogger.logIfEnabled(FQCN, Level.INFO, null, format); + logIfEnabled(Level.INFO, format); } @Override public void info(final String format, final Object o) { - log4jLogger.logIfEnabled(FQCN, Level.INFO, null, format, o); + logIfEnabled(Level.INFO, format, o); } @Override public void info(final String format, final Object arg1, final Object arg2) { - log4jLogger.logIfEnabled(FQCN, Level.INFO, null, format, arg1, arg2); + logIfEnabled(Level.INFO, format, arg1, arg2); } @Override public void info(final String format, final Object... args) { - log4jLogger.logIfEnabled(FQCN, Level.INFO, null, format, args); + logIfEnabled(Level.INFO, format, args); } @Override public void info(final String format, final Throwable t) { - log4jLogger.logIfEnabled(FQCN, Level.INFO, null, format, t); + logIfEnabled(Level.INFO, format, t); } @Override public boolean isWarnEnabled() { - return log4jLogger.isEnabled(Level.WARN, null, null); + return isEnabled(Level.WARN); } @Override public void warn(final String format) { - log4jLogger.logIfEnabled(FQCN, Level.WARN, null, format); + logIfEnabled(Level.WARN, format); } @Override public void warn(final String format, final Object o) { - log4jLogger.logIfEnabled(FQCN, Level.WARN, null, format, o); + logIfEnabled(Level.WARN, format, o); } @Override public void warn(final String format, final Object arg1, final Object arg2) { - log4jLogger.logIfEnabled(FQCN, Level.WARN, null, format, arg1, arg2); + logIfEnabled(Level.WARN, format, arg1, arg2); } @Override public void warn(final String format, final Object... args) { - log4jLogger.logIfEnabled(FQCN, Level.WARN, null, format, args); + logIfEnabled(Level.WARN, format, args); } @Override public void warn(final String format, final Throwable t) { - log4jLogger.logIfEnabled(FQCN, Level.WARN, null, format, t); + logIfEnabled(Level.WARN, format, t); } @Override public boolean isErrorEnabled() { - return log4jLogger.isEnabled(Level.ERROR, null, null); + return isEnabled(Level.ERROR); } @Override public void error(final String format) { - log4jLogger.logIfEnabled(FQCN, Level.ERROR, null, format); + logIfEnabled(Level.ERROR, format); } @Override public void error(final String format, final Object o) { - log4jLogger.logIfEnabled(FQCN, Level.ERROR, null, format, o); + logIfEnabled(Level.ERROR, format, o); } @Override public void error(final String format, final Object arg1, final Object arg2) { - log4jLogger.logIfEnabled(FQCN, Level.ERROR, null, format, arg1, arg2); + logIfEnabled(Level.ERROR, format, arg1, arg2); } @Override public void error(final String format, final Object... args) { - log4jLogger.logIfEnabled(FQCN, Level.ERROR, null, format, args); + logIfEnabled(Level.ERROR, format, args); } @Override public void error(final String format, final Throwable t) { - log4jLogger.logIfEnabled(FQCN, Level.ERROR, null, format, t); + logIfEnabled(Level.ERROR, format, t); + } + + @SuppressWarnings("DuplicatedCode") + private void logIfEnabled(final Level level, final String format) { + if (System.getSecurityManager() == null) { + log4jLogger.logIfEnabled(FQCN, level, null, format); + return; + } + + AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Object run() { + log4jLogger.logIfEnabled(FQCN, level, null, format); + return null; + } + }); + } + + @SuppressWarnings("DuplicatedCode") + private void logIfEnabled(final Level level, final String format, final Throwable t) { + if (System.getSecurityManager() == null) { + log4jLogger.logIfEnabled(FQCN, level, null, format, t); + return; + } + + AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Object run() { + log4jLogger.logIfEnabled(FQCN, level, null, format, t); + return null; + } + }); + } + + @SuppressWarnings("DuplicatedCode") + private void logIfEnabled(final Level level, final String format, final Object... params) { + if (System.getSecurityManager() == null) { + log4jLogger.logIfEnabled(FQCN, level, null, format, params); + return; + } + + AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Object run() { + log4jLogger.logIfEnabled(FQCN, level, null, format, params); + return null; + } + }); + } + + @SuppressWarnings("DuplicatedCode") + private void logIfEnabled(final Level level, final String format, final Object arg) { + if (System.getSecurityManager() == null) { + log4jLogger.logIfEnabled(FQCN, level, null, format, arg); + return; + } + + AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Object run() { + log4jLogger.logIfEnabled(FQCN, level, null, format, arg); + return null; + } + }); + } + + @SuppressWarnings("DuplicatedCode") + private void logIfEnabled(final Level level, final String format, final Object arg1, final Object arg2) { + if (System.getSecurityManager() == null) { + log4jLogger.logIfEnabled(FQCN, level, null, format, arg1, arg2); + return; + } + + AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Object run() { + log4jLogger.logIfEnabled(FQCN, level, null, format, arg1, arg2); + return null; + } + }); + } + + private boolean isEnabled(Level level) { + return log4jLogger.isEnabled(level, null, null); } } diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PackageScanner.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PackageScanner.java index 35beeb8d2e..840208191f 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PackageScanner.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PackageScanner.java @@ -90,7 +90,7 @@ private static List doGetClassNames(String basePackage, ClassLoader clas synchronized (PackageScanner.class) { try (FileSystem fileSystem = FileSystems.newFileSystem(uri, Collections.emptyMap())) { Path basePath = fileSystem.getPath(baseFolderResource).toAbsolutePath(); - if (!Files.exists(basePath)) { + if (!Files.exists(basePath)) { // called in a privileged action, thus no need to deal with security manager basePath = fileSystem.getPath("agent/" + baseFolderResource).toAbsolutePath(); } result = listClassNames(basePackage, basePath); diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java index 0ed8807d90..034d614bd1 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java @@ -22,8 +22,13 @@ import java.io.File; import java.io.FileInputStream; import java.io.FileNotFoundException; +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; import java.security.AccessController; import java.security.PrivilegedAction; +import java.security.PrivilegedActionException; +import java.security.PrivilegedExceptionAction; import java.security.ProtectionDomain; import java.util.Map; @@ -129,19 +134,46 @@ public static FileInputStream newFileInputStream(final File file) throws FileNot if (System.getSecurityManager() == null) { return new FileInputStream(file); } + + try { + return AccessController.doPrivileged(new PrivilegedExceptionAction() { + @Override + public FileInputStream run() throws Exception { + return new FileInputStream(file); + } + }); + } catch (PrivilegedActionException e) { + throw (FileNotFoundException) e.getCause(); + } + } + + /** + * Creates directory and its parents when path does not exist + * + * @param path directory path to create + * @throws IOException + */ + public static void createDirectories(final Path path) throws IOException { + if (System.getSecurityManager() == null) { + doCreateDirectories(path); + } + try { - return AccessController.doPrivileged(new PrivilegedAction() { + AccessController.doPrivileged(new PrivilegedExceptionAction() { @Override - public FileInputStream run() { - try { - return new FileInputStream(file); - } catch (FileNotFoundException e) { - throw new RuntimeException(e); - } + public Object run() throws Exception { + doCreateDirectories(path); + return null; } }); - } catch (RuntimeException e) { - throw new RuntimeException(e.getCause()); + } catch (PrivilegedActionException e) { + throw (IOException) e.getCause(); + } + } + + private static void doCreateDirectories(Path path) throws IOException { + if (!Files.exists(path)) { + Files.createDirectories(path); } } diff --git a/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java b/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java index 1f5a86f8ad..0be3745b71 100644 --- a/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java +++ b/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java @@ -28,6 +28,9 @@ import javax.annotation.Nullable; import java.io.IOException; +import java.security.AccessController; +import java.security.PrivilegedActionException; +import java.security.PrivilegedExceptionAction; import java.util.ArrayList; import java.util.List; import java.util.Map; @@ -39,7 +42,7 @@ public abstract class AbstractJulEcsReformattingHelper extends AbstractEcsReformattingHelper { private static final Logger logger = LoggerFactory.getLogger(AbstractJulEcsReformattingHelper.class); - private static final Logger oneTimeLogFileLimitWarningLogger = LoggerUtils.logOnce(logger); + private static final Logger oneTimeLogFileLimitWarningLogger = LoggerUtils.logOnce(logger); @Nullable @Override @@ -103,7 +106,7 @@ protected Handler createAndStartEcsAppender(Handler originalHandler, String ecsA "use int to configure the file size limit. Consider reducing the log max size configuration to a value below " + "Integer#MAX_VALUE. Defaulting to {} bytes.", getMaxLogFileSize(), maxLogFileSize); } - shadeHandler = new FileHandler(pattern, maxLogFileSize, 2, true); + shadeHandler = createFileHandler(pattern, maxLogFileSize); shadeHandler.setFormatter(ecsFormatter); } catch (Exception e) { logger.error("Failed to create Log shading FileAppender. Auto ECS reformatting will not work.", e); @@ -112,6 +115,26 @@ protected Handler createAndStartEcsAppender(Handler originalHandler, String ecsA return shadeHandler; } + private static FileHandler createFileHandler(final String pattern, final int maxLogFileSize) throws IOException { + if (System.getSecurityManager() == null) { + return doCreateFileHandler(pattern, maxLogFileSize); + } + try { + return AccessController.doPrivileged(new PrivilegedExceptionAction() { + @Override + public FileHandler run() throws Exception { + return doCreateFileHandler(pattern, maxLogFileSize); + } + }); + } catch (PrivilegedActionException e) { + throw (IOException) e.getCause(); + } + } + + private static FileHandler doCreateFileHandler(String pattern, int maxLogFileSize) throws IOException { + return new FileHandler(pattern, maxLogFileSize, 2, true); + } + protected abstract boolean isFileHandler(Handler originalHandler); } diff --git a/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/JulEcsReformattingHelper.java b/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/JulEcsReformattingHelper.java index ba56c2ff62..0babaa573d 100644 --- a/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/JulEcsReformattingHelper.java +++ b/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/JulEcsReformattingHelper.java @@ -19,11 +19,11 @@ package co.elastic.apm.agent.jul.reformatting; import co.elastic.apm.agent.loginstr.reformatting.Utils; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import javax.annotation.Nullable; import java.io.File; import java.io.IOException; -import java.nio.file.Files; import java.nio.file.Path; import java.util.logging.ConsoleHandler; import java.util.logging.FileHandler; @@ -86,8 +86,8 @@ static String computeEcsFileHandlerPattern(String pattern, Path originalFilePath } Path logReformattingDir = Utils.computeLogReformattingDir(originalFilePath, configuredReformattingDir); if (logReformattingDir != null) { - if (createDirs && !Files.exists(logReformattingDir)) { - Files.createDirectories(logReformattingDir); + if (createDirs) { + PrivilegedActionUtils.createDirectories(logReformattingDir); } pattern = logReformattingDir.resolve(pattern).toString(); } diff --git a/apm-agent-plugins/apm-logging-plugin/apm-tomcat-logging-plugin/src/main/java/co/elastic/apm/agent/tomcatlogging/reformatting/TomcatReformattingHelper.java b/apm-agent-plugins/apm-logging-plugin/apm-tomcat-logging-plugin/src/main/java/co/elastic/apm/agent/tomcatlogging/reformatting/TomcatReformattingHelper.java index b31c2d0a67..6892443a6b 100644 --- a/apm-agent-plugins/apm-logging-plugin/apm-tomcat-logging-plugin/src/main/java/co/elastic/apm/agent/tomcatlogging/reformatting/TomcatReformattingHelper.java +++ b/apm-agent-plugins/apm-logging-plugin/apm-tomcat-logging-plugin/src/main/java/co/elastic/apm/agent/tomcatlogging/reformatting/TomcatReformattingHelper.java @@ -20,15 +20,14 @@ import co.elastic.apm.agent.jul.reformatting.AbstractJulEcsReformattingHelper; import co.elastic.apm.agent.loginstr.reformatting.Utils; +import co.elastic.apm.agent.util.PrivilegedActionUtils; import org.apache.juli.FileHandler; import javax.annotation.Nullable; import java.io.File; import java.io.IOException; -import java.nio.file.Files; import java.nio.file.Path; import java.nio.file.Paths; -import java.text.DateFormat; import java.text.SimpleDateFormat; import java.util.Date; import java.util.logging.Handler; @@ -82,9 +81,7 @@ protected String getShadeFilePatternAndCreateDir() throws IOException { Path destinationDir = Utils.computeLogReformattingDir(destinationPattern, getConfiguredReformattingDir()); if (destinationDir != null) { - if (!Files.exists(destinationDir)) { - Files.createDirectories(destinationDir); - } + PrivilegedActionUtils.createDirectories(destinationDir); pattern = destinationDir.resolve(destinationPattern.getFileName()).toString(); } From 6fbaf6edd6422e3726002c37f5b4619eb82774c2 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Mon, 21 Nov 2022 17:31:21 +0100 Subject: [PATCH 08/14] review agent log file creation --- .../apm/agent/logging/Log4j2ConfigurationFactory.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java index c673ee04bc..eb179fe9f8 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java @@ -22,7 +22,6 @@ import co.elastic.apm.agent.configuration.CoreConfiguration; import co.elastic.apm.agent.configuration.ServiceInfo; import co.elastic.apm.agent.configuration.converter.ByteValue; -import co.elastic.apm.agent.util.PrivilegedActionUtils; import org.apache.logging.log4j.Level; import org.apache.logging.log4j.core.LoggerContext; import org.apache.logging.log4j.core.appender.ConsoleAppender; @@ -96,6 +95,8 @@ static String getActualLogFile(@Nullable String agentHome, String logFile) { try { logFile = new File(logFile).getAbsolutePath(); final File logDir = new File(logFile).getParentFile(); + + // already privileged, thus will work as expected when security manager is enabled and agent permission set if (!logDir.exists()) { logDir.mkdirs(); } @@ -104,7 +105,7 @@ static String getActualLogFile(@Nullable String agentHome, String logFile) { canWrite = false; } - if(!canWrite){ + if (!canWrite) { System.err.println("[elastic-apm-agent] WARN Log file " + logFile + " is not writable. Falling back to System.out."); return SYSTEM_OUT; } @@ -175,8 +176,8 @@ private AppenderComponentBuilder createConsoleAppender(ConfigurationBuilder builder, LogFormat logFormat) { if (logFormat == LogFormat.PLAIN_TEXT) { return builder - .newLayout("PatternLayout") - .addAttribute("pattern", "%d [%thread] %-5level %logger{36} - %msg{nolookups}%n"); + .newLayout("PatternLayout") + .addAttribute("pattern", "%d [%thread] %-5level %logger{36} - %msg{nolookups}%n"); } else { String serviceName = getValue(CoreConfiguration.SERVICE_NAME, sources, ServiceInfo.autoDetected().getServiceName()); return builder.newLayout("EcsLayout") From a6c027cd79aad7bd11973c3c45ca99b9ac44f7b7 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Tue, 22 Nov 2022 09:47:26 +0100 Subject: [PATCH 09/14] avoid privileged action utils when we can --- .../src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java index 39de857d1b..1924591b1f 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/bci/IndyBootstrap.java @@ -27,7 +27,6 @@ import co.elastic.apm.agent.sdk.state.CallDepth; import co.elastic.apm.agent.sdk.state.GlobalState; import co.elastic.apm.agent.util.PackageScanner; -import co.elastic.apm.agent.util.PrivilegedActionUtils; import net.bytebuddy.asm.Advice; import net.bytebuddy.dynamic.ClassFileLocator; import net.bytebuddy.dynamic.loading.ClassInjector; @@ -392,7 +391,7 @@ private static ConstantCallSite internalBootstrap(MethodHandles.Lookup lookup, S MethodHandle instrumentedMethod = args.length >= 5 ? (MethodHandle) args[4] : null; ClassLoader instrumentationClassLoader = ElasticApmAgent.getInstrumentationClassLoader(adviceClassName); - ClassLoader targetClassLoader = PrivilegedActionUtils.getClassLoader(lookup.lookupClass()); + ClassLoader targetClassLoader = lookup.lookupClass().getClassLoader(); ClassFileLocator classFileLocator; List pluginClasses = new ArrayList<>(); if (instrumentationClassLoader instanceof ExternalPluginClassLoader) { From 382b0acfab99e6487d8e3cc6a5807d904dfcd6c2 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Wed, 23 Nov 2022 10:38:56 +0100 Subject: [PATCH 10/14] update changelog --- CHANGELOG.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index b7ea39ee7a..a24131aee3 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -50,6 +50,7 @@ option - {pull}2866[#2866] * Prevent random `NullPointerException` when span compression is not possible - {pull}2859[#2859] * Fix security manager issues on OpenJDK 17, with errors like: `java.lang.UnsupportedOperationException: Could not access Unsafe class` - {pull}2874[#2874] +* Fix security manager compatibility with Tomcat - {pull}2871[#2871] [[release-notes-1.x]] === Java Agent version 1.x From 412fc9c1f17106de20b4e739cac5bee6e5dfee6b Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Wed, 23 Nov 2022 14:35:01 +0100 Subject: [PATCH 11/14] post-review changes --- .../apm/agent/util/PrivilegedActionUtils.java | 2 +- .../apm/agent/sdk/DynamicTransformer.java | 7 +-- .../apm/agent/sdk/internal/InternalUtil.java | 33 ++++++------- .../apm/agent/sdk/state/GlobalVariables.java | 2 +- .../sdk/weakconcurrent/WeakConcurrent.java | 5 +- .../agent/sdk/state/GlobalVariablesTest.java | 47 +++++++++++++++++++ .../test/java/test/other/pkg/OtherClass.java | 22 +++++++++ 7 files changed, 96 insertions(+), 22 deletions(-) create mode 100644 apm-agent-plugin-sdk/src/test/java/co/elastic/apm/agent/sdk/state/GlobalVariablesTest.java create mode 100644 apm-agent-plugin-sdk/src/test/java/test/other/pkg/OtherClass.java diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java index 034d614bd1..3b715910ca 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java @@ -33,7 +33,7 @@ import java.util.Map; /** - * Delegates calls to {@link System} with wrapping in privileged actions which is required when security manager is active + * Delegates calls with wrapping in privileged actions which is required when security manager is active */ public class PrivilegedActionUtils { diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/DynamicTransformer.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/DynamicTransformer.java index a0dd7eadc9..04cf43a304 100644 --- a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/DynamicTransformer.java +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/DynamicTransformer.java @@ -22,8 +22,6 @@ import net.bytebuddy.description.type.TypeDescription; import net.bytebuddy.matcher.ElementMatcher; -import java.security.AccessController; -import java.security.PrivilegedAction; import java.util.Collection; import java.util.ServiceLoader; @@ -31,7 +29,10 @@ public class DynamicTransformer { private static final DynamicTransformerProvider transformer; static { - ClassLoader classLoader = InternalUtil.getClassLoader(DynamicTransformer.class, true); + ClassLoader classLoader = InternalUtil.getClassLoader(DynamicTransformer.class); + if (classLoader == null) { + classLoader = InternalUtil.getSystemClassLoader(); + } // loads the implementation provided by the core module without depending on the class or class name transformer = ServiceLoader.load(DynamicTransformerProvider.class, classLoader).iterator().next(); } diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/InternalUtil.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/InternalUtil.java index fa11330a59..e1476cace5 100644 --- a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/InternalUtil.java +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/internal/InternalUtil.java @@ -18,36 +18,37 @@ */ package co.elastic.apm.agent.sdk.internal; +import javax.annotation.Nullable; import java.security.AccessController; import java.security.PrivilegedAction; public class InternalUtil { - /** - * Returns the classloader of a given class, optionally wrapping in a privileged action if security manager is enabled - * - * @param type class whose classloader needs to be retrieved - * @param systemFallback {@literal true} if fallback to system CL is required, {@literal false} otherwise - * @return class classloader or system classloader if it was loaded in system classloader - */ - public static ClassLoader getClassLoader(final Class type, final boolean systemFallback) { + @Nullable + public static ClassLoader getClassLoader(final Class type) { if (System.getSecurityManager() == null) { - return doGetClassLoader(type, systemFallback); + return type.getClassLoader(); } - return AccessController.doPrivileged(new PrivilegedAction() { + @Nullable @Override public ClassLoader run() { - return doGetClassLoader(type, systemFallback); + return type.getClassLoader(); } }); } - private static ClassLoader doGetClassLoader(Class type, boolean systemFallback) { - ClassLoader classLoader = type.getClassLoader(); - if (classLoader == null) { - classLoader = ClassLoader.getSystemClassLoader(); + public static ClassLoader getSystemClassLoader() { + if (System.getSecurityManager() == null) { + return ClassLoader.getSystemClassLoader(); } - return classLoader; + return AccessController.doPrivileged(new PrivilegedAction() { + @Nullable + @Override + public ClassLoader run() { + return ClassLoader.getSystemClassLoader(); + } + }); } + } diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/state/GlobalVariables.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/state/GlobalVariables.java index 600f89f94b..75c6ce6a3e 100644 --- a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/state/GlobalVariables.java +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/state/GlobalVariables.java @@ -53,7 +53,7 @@ public class GlobalVariables { */ public static T get(Class adviceClass, String key, T defaultValue) { key = adviceClass.getName() + "." + key; - if (InternalUtil.getClassLoader(defaultValue.getClass(), false) == null && !defaultValue.getClass().getName().startsWith("co.elastic.apm.agent")) { + if (InternalUtil.getClassLoader(defaultValue.getClass()) != null && !defaultValue.getClass().getName().startsWith("co.elastic.apm.agent")) { throw new IllegalArgumentException("Registering types specific to an instrumentation plugin would lead to class loader leaks: " + defaultValue); } T value = (T) registry.get(key); diff --git a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/weakconcurrent/WeakConcurrent.java b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/weakconcurrent/WeakConcurrent.java index afe764e599..b319c1c85e 100644 --- a/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/weakconcurrent/WeakConcurrent.java +++ b/apm-agent-plugin-sdk/src/main/java/co/elastic/apm/agent/sdk/weakconcurrent/WeakConcurrent.java @@ -28,7 +28,10 @@ public final class WeakConcurrent { private static final WeakConcurrentProvider supplier; static { - ClassLoader classLoader = InternalUtil.getClassLoader(WeakConcurrentProvider.class, true); + ClassLoader classLoader = InternalUtil.getClassLoader(WeakConcurrentProvider.class); + if (classLoader == null) { + classLoader = InternalUtil.getSystemClassLoader(); + } // loads the implementation provided by the core module without depending on the class or class name supplier = ServiceLoader.load(WeakConcurrentProvider.class, classLoader).iterator().next(); } diff --git a/apm-agent-plugin-sdk/src/test/java/co/elastic/apm/agent/sdk/state/GlobalVariablesTest.java b/apm-agent-plugin-sdk/src/test/java/co/elastic/apm/agent/sdk/state/GlobalVariablesTest.java new file mode 100644 index 0000000000..5de4529981 --- /dev/null +++ b/apm-agent-plugin-sdk/src/test/java/co/elastic/apm/agent/sdk/state/GlobalVariablesTest.java @@ -0,0 +1,47 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package co.elastic.apm.agent.sdk.state; + +import org.junit.jupiter.api.Test; +import test.other.pkg.OtherClass; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + +class GlobalVariablesTest { + + @Test + void simple() { + String s = GlobalVariables.get(GlobalVariablesTest.class, "hello", "world"); + assertThat(s).isEqualTo("world"); // should get and store default + assertThat(GlobalVariables.get(GlobalVariablesTest.class, "hello", "other")).isEqualTo("world"); + } + + @Test + void tryInvalidClass() { + // using a default value whose CL is not the bootstrap CL and is not part of the instrumentation plugin + // should be avoided as it might introduce classloader leak, for example when an instrumented library class + // is used. + assertThatThrownBy(() -> { + GlobalVariables.get(OtherClass.class, "hello", new OtherClass()); + }).isInstanceOf(IllegalArgumentException.class); + + } + +} diff --git a/apm-agent-plugin-sdk/src/test/java/test/other/pkg/OtherClass.java b/apm-agent-plugin-sdk/src/test/java/test/other/pkg/OtherClass.java new file mode 100644 index 0000000000..6a8258074b --- /dev/null +++ b/apm-agent-plugin-sdk/src/test/java/test/other/pkg/OtherClass.java @@ -0,0 +1,22 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package test.other.pkg; + +public class OtherClass { +} From ef62a722021c12229156bcd67decc8fe1d441458 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Wed, 23 Nov 2022 14:45:26 +0100 Subject: [PATCH 12/14] post-review changes (exceptions) --- .../apm/agent/util/PrivilegedActionUtils.java | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java index 3b715910ca..c3349b1764 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java @@ -143,7 +143,13 @@ public FileInputStream run() throws Exception { } }); } catch (PrivilegedActionException e) { - throw (FileNotFoundException) e.getCause(); + Throwable cause = e.getCause(); + if (cause instanceof FileNotFoundException) { + throw (FileNotFoundException) cause; + } else if (cause instanceof RuntimeException) { + throw (RuntimeException) cause; + } + throw new RuntimeException(cause); } } @@ -151,7 +157,7 @@ public FileInputStream run() throws Exception { * Creates directory and its parents when path does not exist * * @param path directory path to create - * @throws IOException + * @throws IOException when there is an IO error */ public static void createDirectories(final Path path) throws IOException { if (System.getSecurityManager() == null) { @@ -160,6 +166,7 @@ public static void createDirectories(final Path path) throws IOException { try { AccessController.doPrivileged(new PrivilegedExceptionAction() { + @Nullable @Override public Object run() throws Exception { doCreateDirectories(path); @@ -167,7 +174,13 @@ public Object run() throws Exception { } }); } catch (PrivilegedActionException e) { - throw (IOException) e.getCause(); + Throwable cause = e.getCause(); + if (cause instanceof IOException) { + throw (IOException) cause; + } else if (cause instanceof RuntimeException) { + throw (RuntimeException) cause; + } + throw new RuntimeException(cause); } } From 15cb61ac68deae3b624b10a2d8d3a52c61b4b0f0 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Wed, 23 Nov 2022 15:54:19 +0100 Subject: [PATCH 13/14] fix another class cast error --- .../reformatting/AbstractJulEcsReformattingHelper.java | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java b/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java index 0be3745b71..74e9b818fa 100644 --- a/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java +++ b/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java @@ -127,7 +127,13 @@ public FileHandler run() throws Exception { } }); } catch (PrivilegedActionException e) { - throw (IOException) e.getCause(); + Throwable cause = e.getCause(); + if (cause instanceof IOException) { + throw (IOException) cause; + } else if (cause instanceof RuntimeException) { + throw (RuntimeException) cause; + } + throw new RuntimeException(cause); } } From 0797b50d7951a3337f4801a004058e9fc7efd557 Mon Sep 17 00:00:00 2001 From: Sylvain Juge Date: Wed, 23 Nov 2022 17:48:18 +0100 Subject: [PATCH 14/14] testing privileged actions utils --- .../apm/agent/util/PrivilegedActionUtils.java | 12 +- .../agent/util/PrivilegedActionUtilsTest.java | 213 ++++++++++++++++++ .../AbstractJulEcsReformattingHelper.java | 2 - 3 files changed, 214 insertions(+), 13 deletions(-) create mode 100644 apm-agent-core/src/test/java/co/elastic/apm/agent/util/PrivilegedActionUtilsTest.java diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java index c3349b1764..36be259259 100644 --- a/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java +++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/util/PrivilegedActionUtils.java @@ -42,7 +42,6 @@ public static String getEnv(final String key) { if (System.getSecurityManager() == null) { return System.getenv(key); } - return AccessController.doPrivileged(new PrivilegedAction() { @Override public String run() { @@ -55,7 +54,6 @@ public static Map getEnv() { if (System.getSecurityManager() == null) { return System.getenv(); } - return AccessController.doPrivileged(new PrivilegedAction>() { @Override public Map run() { @@ -69,7 +67,6 @@ public static ClassLoader getClassLoader(final Class type) { if (System.getSecurityManager() == null) { return type.getClassLoader(); } - return AccessController.doPrivileged(new PrivilegedAction() { @Override public ClassLoader run() { @@ -82,7 +79,6 @@ public static ProtectionDomain getProtectionDomain(final Class type) { if (System.getSecurityManager() == null) { return type.getProtectionDomain(); } - return AccessController.doPrivileged(new PrivilegedAction() { @Override public ProtectionDomain run() { @@ -91,11 +87,11 @@ public ProtectionDomain run() { }); } + @Nullable public static ClassLoader getContextClassLoader(final Thread t) { if (System.getSecurityManager() == null) { return t.getContextClassLoader(); } - return AccessController.doPrivileged(new PrivilegedAction() { @Override public ClassLoader run() { @@ -134,7 +130,6 @@ public static FileInputStream newFileInputStream(final File file) throws FileNot if (System.getSecurityManager() == null) { return new FileInputStream(file); } - try { return AccessController.doPrivileged(new PrivilegedExceptionAction() { @Override @@ -146,8 +141,6 @@ public FileInputStream run() throws Exception { Throwable cause = e.getCause(); if (cause instanceof FileNotFoundException) { throw (FileNotFoundException) cause; - } else if (cause instanceof RuntimeException) { - throw (RuntimeException) cause; } throw new RuntimeException(cause); } @@ -163,7 +156,6 @@ public static void createDirectories(final Path path) throws IOException { if (System.getSecurityManager() == null) { doCreateDirectories(path); } - try { AccessController.doPrivileged(new PrivilegedExceptionAction() { @Nullable @@ -177,8 +169,6 @@ public Object run() throws Exception { Throwable cause = e.getCause(); if (cause instanceof IOException) { throw (IOException) cause; - } else if (cause instanceof RuntimeException) { - throw (RuntimeException) cause; } throw new RuntimeException(cause); } diff --git a/apm-agent-core/src/test/java/co/elastic/apm/agent/util/PrivilegedActionUtilsTest.java b/apm-agent-core/src/test/java/co/elastic/apm/agent/util/PrivilegedActionUtilsTest.java new file mode 100644 index 0000000000..256e8cf7ef --- /dev/null +++ b/apm-agent-core/src/test/java/co/elastic/apm/agent/util/PrivilegedActionUtilsTest.java @@ -0,0 +1,213 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package co.elastic.apm.agent.util; + +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.io.TempDir; + +import java.io.FileInputStream; +import java.io.FileNotFoundException; +import java.io.IOException; +import java.nio.file.FileAlreadyExistsException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.security.AccessController; +import java.security.Permission; +import java.security.PrivilegedAction; +import java.security.ProtectionDomain; +import java.util.Map; +import java.util.concurrent.atomic.AtomicBoolean; + +import static co.elastic.apm.agent.testutils.assertions.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + +class PrivilegedActionUtilsTest { + + private static final AtomicBoolean enabled = new AtomicBoolean(false); + + private static void enableSecurityManager() { + enabled.set(false); + System.setSecurityManager(new TestSecurityManager(enabled)); + enabled.set(true); + } + + private static void disableSecurityManager() { + enabled.set(false); + System.setSecurityManager(null); + } + + @Test + void getEnv() { + Map envMap = System.getenv(); + String envKey = envMap.keySet().stream().findFirst().get(); + String envValue = envMap.get(envKey); + + testWithAndWithoutSecurityManager(()->{ + assertThat(PrivilegedActionUtils.getEnv(envKey)).isEqualTo(envValue); + assertThat(PrivilegedActionUtils.getEnv()).containsAllEntriesOf(envMap); + }); + + } + + @Test + void getClassLoader() { + ClassLoader cl = PrivilegedActionUtilsTest.class.getClassLoader(); + testWithAndWithoutSecurityManager(()-> assertThat(PrivilegedActionUtils.getClassLoader(PrivilegedActionUtilsTest.class)).isSameAs(cl)); + } + + @Test + void getProtectionDomain() { + ProtectionDomain pd = PrivilegedActionUtilsTest.class.getProtectionDomain(); + testWithAndWithoutSecurityManager(()-> assertThat(PrivilegedActionUtils.getProtectionDomain(PrivilegedActionUtilsTest.class)).isSameAs(pd)); + } + + @Test + void getAndSetContextClassLoader() { + ClassLoader originalCL = Thread.currentThread().getContextClassLoader(); + assertThat(originalCL).isNotNull(); + + try { + testWithAndWithoutSecurityManager(() -> { + // when enabling the security manager, the current context CL might be overriden + // thus we test our ability to change it by setting it to null + PrivilegedActionUtils.setContextClassLoader(Thread.currentThread(), null); + assertThat(PrivilegedActionUtils.getContextClassLoader(Thread.currentThread())).isNull(); + + PrivilegedActionUtils.setContextClassLoader(Thread.currentThread(), originalCL); + assertThat(PrivilegedActionUtils.getContextClassLoader(Thread.currentThread())).isSameAs(originalCL); + }); + } finally { + Thread.currentThread().setContextClassLoader(originalCL); + } + } + + @Test + void newThread() { + testWithAndWithoutSecurityManager(() -> PrivilegedActionUtils.newThread(() -> { + })); + } + + @Test + void newFileInputStream(@TempDir Path tempDir) throws IOException { + Path existingFile = tempDir.resolve("empty.test"); + Files.createFile(existingFile); + + Path missingFile = tempDir.resolve("missing.test"); + + testWithAndWithoutSecurityManager(()->{ + try { + assertThat(PrivilegedActionUtils.newFileInputStream(existingFile.toFile())).isNotNull(); + + // file not found and other runtime errors should be perserved + assertThatThrownBy(() -> PrivilegedActionUtils.newFileInputStream(missingFile.toFile())).isInstanceOf(FileNotFoundException.class); + assertThatThrownBy(() -> PrivilegedActionUtils.newFileInputStream(null)).isInstanceOf(NullPointerException.class); + } catch (IOException e) { + throw new RuntimeException(e); + } + }); + } + + @Test + void createDirectories(@TempDir Path tempDir) throws IOException { + Path existingDir = tempDir.resolve("existing"); + Files.createDirectories(existingDir); + Path toCreate = tempDir.resolve(Path.of("to-create", "child")); + + testWithAndWithoutSecurityManager(() -> { + testPrivileged(() -> { + assertThat(existingDir).isDirectory(); + assertThat(toCreate).doesNotExist(); + }); + + try { + PrivilegedActionUtils.createDirectories(existingDir); + PrivilegedActionUtils.createDirectories(toCreate); + } catch (IOException e) { + throw new RuntimeException(e); + } + + testPrivileged(() -> { + assertThat(existingDir).isDirectory(); + assertThat(toCreate).isDirectory(); + try { + Files.delete(toCreate); + Files.delete(toCreate.getParent()); + } catch (IOException e) { + throw new RuntimeException(e); + } + }); + }); + } + + private static void testPrivileged(Runnable task){ + AccessController.doPrivileged(new PrivilegedAction() { + @Override + public Object run() { + task.run(); + return null; + } + }); + } + + void testWithAndWithoutSecurityManager(Runnable assertions){ + assertions.run(); + try { + enableSecurityManager(); + assertions.run(); + } finally { + disableSecurityManager(); + } + assertions.run(); + } + + private static class TestSecurityManager extends SecurityManager { + + private final AtomicBoolean enabled; + + public TestSecurityManager(AtomicBoolean enabled) { + this.enabled = enabled; + } + + @Override + public void checkPermission(Permission perm) { + if (!enabled.get()) { + return; + } + checkPrivileged(); + } + + @Override + public void checkPermission(Permission perm, Object context) { + if (!enabled.get()) { + return; + } + checkPrivileged(); + } + + private static void checkPrivileged() { + StackTraceElement[] stackTrace = new RuntimeException().getStackTrace(); + for (StackTraceElement e : stackTrace) { + if(e.getClassName().equals("java.security.AccessController") && e.getMethodName().equals("doPrivileged")){ + return; + } + } + throw new SecurityException("missing privileged action"); + } + } +} diff --git a/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java b/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java index 74e9b818fa..170016f20c 100644 --- a/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java +++ b/apm-agent-plugins/apm-logging-plugin/apm-jul-plugin/src/main/java/co/elastic/apm/agent/jul/reformatting/AbstractJulEcsReformattingHelper.java @@ -130,8 +130,6 @@ public FileHandler run() throws Exception { Throwable cause = e.getCause(); if (cause instanceof IOException) { throw (IOException) cause; - } else if (cause instanceof RuntimeException) { - throw (RuntimeException) cause; } throw new RuntimeException(cause); }