Permanently switch from SecurityManager to Entitlements by ldematte · Pull Request #124865 · elastic/elasticsearch

ldematte · 2025-03-14T10:47:07Z

The JDK team has completely disabled the Java SecurityManager from Java 24. Elasticsearch has always used the Java SecurityManager as an additional protection mechanism; in order to retain this second line of defense, the Elasticsearch Core/Infra team has been working on the Entitlements project.

Similar to SecurityManager, Entitlements only allow calling specific methods in the JDK when the caller has a matching policy attached. In other words, if some code (in the main Elasticsearch codebase, in a plugin/module, or in a script) attempts to perform a "privileged" operation and it is not entitled to do so, a NotEntitledException will be thrown.

This PR includes the minimal set of changes to always use Entitlements, regardless of system properties or Java version.

Relates to ES-10921

elasticsearchmachine · 2025-03-14T10:47:31Z

Pinging @elastic/es-core-infra (Team:Core/Infra)

ldematte · 2025-03-14T10:47:48Z

Should this be >breaking or >feature or >enhancement, and be the entitlements issue that has a changelog attached?

rjernst · 2025-03-14T16:33:28Z

the entitlements issue that has a changelog attached

This one. It's not breaking b/c this isn't user API related, but we should have a changelog entry.

ldematte · 2025-03-14T17:52:23Z

👍
what about >enhancement?

mark-vieira · 2025-03-14T22:34:31Z

👍 what about >enhancement?

Perhaps "upgrade" since this is all centered around the move to Java 24? None of the release notes sections are a great fit for non-functional stuff like this. Perhaps we need an new label/section for these kinds of things. We have a >refactoring label but those aren't included in release notes.

rjernst

LGTM. >upgrade is fine. We just want to make sure this is noted in the release notes.

…enabled-minimal

mosche · 2025-03-17T10:57:22Z

docs/changelog/124865.yaml

+  With JDK24, the Java SecurityManager has been completely disabled. In order to retain an additional protection
+  mechanism, Elasticsearch is replacing SecurityManager with our own protection mechanism, Entitlements."


optional nit

Suggested change

With JDK24, the Java SecurityManager has been completely disabled. In order to retain an additional protection

mechanism, Elasticsearch is replacing SecurityManager with our own protection mechanism, Entitlements."

With JDK24, the Java SecurityManager has been completely disabled. In order to retain a similar protection

mechanism, Elasticsearch is replacing SecurityManager with its own protection mechanism, Entitlements."

Wondering, this makes it sound a bit like entitlements are just a JDK 24 thing. Should we explicitly mention that this is the case for all versions of ES supporting JDK 24 regardless of which JDK version used at runtime?

Maybe like this?

Suggested change

With JDK24, the Java SecurityManager has been completely disabled. In order to retain an additional protection

mechanism, Elasticsearch is replacing SecurityManager with our own protection mechanism, Entitlements."

With JDK24, the Java SecurityManager has been completely disabled. In order to retain a similar protection

mechanism, Elasticsearch is replacing SecurityManager with its own protection mechanism, Entitlements.

This is the case for all versions of Elasticsearch supporting JDK24 regardless of the JDK version used at runtime."

I rephrased it so the focus in not on JDK 24 anymore, and stating we are making the switch permanently. But let me know if you think I should still add "This is the case for all versions of Elasticsearch supporting JDK24 regardless of the JDK version used at runtime."

that's great 👍

mosche

lgtm

elasticsearchmachine · 2025-03-18T08:12:54Z

💔 Backport failed

Status	Branch	Result
❌	8.18	Commit could not be cherrypicked due to conflicts
❌	8.x	Commit could not be cherrypicked due to conflicts

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 124865

The JDK team has completely disabled the Java SecurityManager from Java 24. Elasticsearch has always used the Java SecurityManager as an additional protection mechanism; in order to retain this second line of defense, the Elasticsearch Core/Infra team has been working on the Entitlements project. Similar to SecurityManager, Entitlements only allow calling specific methods in the JDK when the caller has a matching policy attached. In other words, if some code (in the main Elasticsearch codebase, in a plugin/module, or in a script) attempts to perform a "privileged" operation and it is not entitled to do so, a NotEntitledException will be thrown. This PR includes the minimal set of changes to always use Entitlements, regardless of system properties or Java version. Relates to ES-10921

…) (#125073) * Permanently switch from SecurityManager to Entitlements (#124865) The JDK team has completely disabled the Java SecurityManager from Java 24. Elasticsearch has always used the Java SecurityManager as an additional protection mechanism; in order to retain this second line of defense, the Elasticsearch Core/Infra team has been working on the Entitlements project. Similar to SecurityManager, Entitlements only allow calling specific methods in the JDK when the caller has a matching policy attached. In other words, if some code (in the main Elasticsearch codebase, in a plugin/module, or in a script) attempts to perform a "privileged" operation and it is not entitled to do so, a NotEntitledException will be thrown. This PR includes the minimal set of changes to always use Entitlements, regardless of system properties or Java version. Relates to ES-10921 * Update changelog

… (#125076) * Permanently switch from SecurityManager to Entitlements (#124865) The JDK team has completely disabled the Java SecurityManager from Java 24. Elasticsearch has always used the Java SecurityManager as an additional protection mechanism; in order to retain this second line of defense, the Elasticsearch Core/Infra team has been working on the Entitlements project. Similar to SecurityManager, Entitlements only allow calling specific methods in the JDK when the caller has a matching policy attached. In other words, if some code (in the main Elasticsearch codebase, in a plugin/module, or in a script) attempts to perform a "privileged" operation and it is not entitled to do so, a NotEntitledException will be thrown. This PR includes the minimal set of changes to always use Entitlements, regardless of system properties or Java version. Relates to ES-10921 * Update changelog

The JDK team has completely disabled the Java SecurityManager from Java 24. Elasticsearch has always used the Java SecurityManager as an additional protection mechanism; in order to retain this second line of defense, the Elasticsearch Core/Infra team has been working on the Entitlements project. Similar to SecurityManager, Entitlements only allow calling specific methods in the JDK when the caller has a matching policy attached. In other words, if some code (in the main Elasticsearch codebase, in a plugin/module, or in a script) attempts to perform a "privileged" operation and it is not entitled to do so, a NotEntitledException will be thrown. This PR includes the minimal set of changes to always use Entitlements, regardless of system properties or Java version. Relates to ES-10921

…25117) The JDK team has completely disabled the Java SecurityManager from Java 24. Elasticsearch has always used the Java SecurityManager as an additional protection mechanism; in order to retain this second line of defense, the Elasticsearch Core/Infra team has been working on the Entitlements project. Similar to SecurityManager, Entitlements only allow calling specific methods in the JDK when the caller has a matching policy attached. In other words, if some code (in the main Elasticsearch codebase, in a plugin/module, or in a script) attempts to perform a "privileged" operation and it is not entitled to do so, a NotEntitledException will be thrown. This PR includes the minimal set of changes to always use Entitlements, regardless of system properties or Java version. Relates to ES-10921

…) (elastic#125117) The JDK team has completely disabled the Java SecurityManager from Java 24. Elasticsearch has always used the Java SecurityManager as an additional protection mechanism; in order to retain this second line of defense, the Elasticsearch Core/Infra team has been working on the Entitlements project. Similar to SecurityManager, Entitlements only allow calling specific methods in the JDK when the caller has a matching policy attached. In other words, if some code (in the main Elasticsearch codebase, in a plugin/module, or in a script) attempts to perform a "privileged" operation and it is not entitled to do so, a NotEntitledException will be thrown. This PR includes the minimal set of changes to always use Entitlements, regardless of system properties or Java version. Relates to ES-10921

minimal changes to always use entitlements

30d8a34

ldematte added auto-backport Automatically create backport pull requests when merged v8.18.1 v8.19.0 v9.0.1 :Core/Infra/Entitlements Entitlements infrastructure labels Mar 14, 2025

ldematte requested review from a team as code owners March 14, 2025 10:47

elasticsearchmachine added the Team:Core/Infra Meta label for core/infra team label Mar 14, 2025

rjernst approved these changes Mar 16, 2025

View reviewed changes

ldematte added the >upgrade label Mar 17, 2025

ldematte added 2 commits March 17, 2025 08:50

Merge remote-tracking branch 'upstream/9.0' into entitlements/always-…

c8f1444

…enabled-minimal

Changelog

59dc3e8

mosche reviewed Mar 17, 2025

View reviewed changes

Changed wording

8c99cca

mosche approved these changes Mar 17, 2025

View reviewed changes

ldematte merged commit dfbf7f0 into elastic:9.0 Mar 18, 2025
16 checks passed

ldematte deleted the entitlements/always-enabled-minimal branch March 18, 2025 08:11

elasticsearchmachine added the backport pending label Mar 18, 2025

ldematte mentioned this pull request Mar 18, 2025

[8.18] Permanently switch from SecurityManager to Entitlements (#124865) #125073

Merged

ldematte mentioned this pull request Mar 18, 2025

[8.x] Permanently switch from SecurityManager to Entitlements (#124865) #125076

Merged

ldematte removed the backport pending label Mar 18, 2025

ldematte mentioned this pull request Mar 18, 2025

Permanently switch from SecurityManager to Entitlements (#124865) #125117

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Permanently switch from SecurityManager to Entitlements#124865

Permanently switch from SecurityManager to Entitlements#124865
ldematte merged 4 commits intoelastic:9.0from
ldematte:entitlements/always-enabled-minimal

ldematte commented Mar 14, 2025 •

edited

Loading

elasticsearchmachine commented Mar 14, 2025

ldematte commented Mar 14, 2025

rjernst commented Mar 14, 2025 •

edited

Loading

ldematte commented Mar 14, 2025

mark-vieira commented Mar 14, 2025

rjernst left a comment

mosche Mar 17, 2025

mosche Mar 17, 2025

mosche Mar 17, 2025

ldematte Mar 17, 2025

mosche Mar 17, 2025

mosche left a comment

Uh oh!

elasticsearchmachine commented Mar 18, 2025

Labels

5 participants

		With JDK24, the Java SecurityManager has been completely disabled. In order to retain an additional protection
		mechanism, Elasticsearch is replacing SecurityManager with our own protection mechanism, Entitlements."

-  With JDK24, the Java SecurityManager has been completely disabled. In order to retain an additional protection
-  mechanism, Elasticsearch is replacing SecurityManager with our own protection mechanism, Entitlements."
+  With JDK24, the Java SecurityManager has been completely disabled. In order to retain a similar protection
+  mechanism, Elasticsearch is replacing SecurityManager with its own protection mechanism, Entitlements.
+  This is the case for all versions of Elasticsearch supporting JDK24 regardless of the JDK version used at runtime."

Conversation

ldematte commented Mar 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

elasticsearchmachine commented Mar 14, 2025

ldematte commented Mar 14, 2025

rjernst commented Mar 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ldematte commented Mar 14, 2025

mark-vieira commented Mar 14, 2025

rjernst left a comment

Choose a reason for hiding this comment

mosche Mar 17, 2025

Choose a reason for hiding this comment

mosche Mar 17, 2025

Choose a reason for hiding this comment

mosche Mar 17, 2025

Choose a reason for hiding this comment

ldematte Mar 17, 2025

Choose a reason for hiding this comment

mosche Mar 17, 2025

Choose a reason for hiding this comment

mosche left a comment

Choose a reason for hiding this comment

Uh oh!

elasticsearchmachine commented Mar 18, 2025

💔 Backport failed

Labels

5 participants

ldematte commented Mar 14, 2025 •

edited

Loading

rjernst commented Mar 14, 2025 •

edited

Loading