Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Security permission issue #738

Open
xinyual opened this issue Feb 25, 2025 · 0 comments
Open

[FEATURE] Security permission issue #738

xinyual opened this issue Feb 25, 2025 · 0 comments
Labels
enhancement New feature or request untriaged

Comments

@xinyual
Copy link

xinyual commented Feb 25, 2025

Is your feature request related to a problem?
Now SQL plugin is the extension of job scheduler plugin. And SQL plugin is now trying to implement the calcite engine. During the implementation, even though the sql plugin already add the security policy , and the code is also wrapped by the access controller, e.g. here, we still get security error.

One local temporal solution is to add security policy to job scheduler like #736 and publish it to maven local. Then we could pass the IT.

** The way to reproduce **
Clone the sql plugin repo from https://github.com/LantaoJin/search-plugins-sql/tree/pr/issues/3330, switch to branch pr/issues/3330.
Go to class StatsCommandIT and add this two line to init()

enableCalcite();
disallowCalciteFallback();

This enable the calcite.
Then run ./gradlew integTest :integ-test:integTest --tests "org.opensearch.sql.ppl.StatsCommandIT.testStatsAvg"
You can see the log like

java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "getClassLoader")
»       at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:488) ~[?:?]
»       at java.base/java.security.AccessController.checkPermission(AccessController.java:1071) ~[?:?]
»       at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:411) ~[?:?]
»       at java.base/java.lang.ClassLoader.checkClassLoaderPermission(ClassLoader.java:2084) ~[?:?]
»       at java.base/java.lang.Thread.getContextClassLoader(Thread.java:2346) ~[?:?]
»       at org.codehaus.janino.SimpleCompiler.<init>(SimpleCompiler.java:72) ~[janino-3.1.11.jar:?]
»       at org.codehaus.janino.CompilerFactory.newSimpleCompiler(CompilerFactory.java:65) ~[janino-3.1.11.jar:?]

By adding security policy to job scheduler can skip this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request untriaged
Projects
Status: 🆕 New
Development

No branches or pull requests

1 participant