/*
 * Copyright (c) 2016, 2018, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *
 * This code is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * version 2 for more details (a copy is included in the LICENSE file that
 * accompanied this code).
 *
 * You should have received a copy of the GNU General Public License version
 * 2 along with this work; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
 *
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
 * or visit www.oracle.com if you need additional information or have any
 * questions.
 */

package jdk.jfr.internal;

import java.io.File;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.io.RandomAccessFile;
import java.io.Reader;
import java.lang.invoke.MethodHandles;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.ReflectPermission;
import java.nio.channels.FileChannel;
import java.nio.channels.ReadableByteChannel;
import java.nio.file.FileVisitResult;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.nio.file.SimpleFileVisitor;
import java.nio.file.StandardOpenOption;
import java.nio.file.attribute.BasicFileAttributes;
import java.security.AccessControlContext;
import java.security.AccessController;
import java.security.Permission;
import java.security.PrivilegedAction;
import java.security.PrivilegedActionException;
import java.security.PrivilegedExceptionAction;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
import java.util.Objects;
import java.util.PropertyPermission;
import java.util.concurrent.Callable;

import jdk.internal.misc.Unsafe;
import jdk.internal.module.Modules;
import jdk.jfr.Event;
import jdk.jfr.FlightRecorder;
import jdk.jfr.FlightRecorderListener;
import jdk.jfr.FlightRecorderPermission;
import jdk.jfr.Recording;

/**
 * Contains JFR code that does
 * {@link AccessController#doPrivileged(PrivilegedAction)}
 */
public final class SecuritySupport {
    private final static Unsafe unsafe = Unsafe.getUnsafe();
    private final static MethodHandles.Lookup LOOKUP = MethodHandles.lookup();
    private final static Module JFR_MODULE = Event.class.getModule();
    public  final static SafePath JFC_DIRECTORY = getPathInProperty("java.home", "lib/jfr");

    static final SafePath USER_HOME = getPathInProperty("user.home", null);
    static final SafePath JAVA_IO_TMPDIR = getPathInProperty("java.io.tmpdir", null);

    static {
        // ensure module java.base can read module jdk.jfr as early as possible
        addReadEdge(Object.class);
        addHandlerExport(Object.class);
        addEventsExport(Object.class);
        addInstrumentExport(Object.class);
    }

    final static class SecureRecorderListener implements FlightRecorderListener {

        private final AccessControlContext context;
        private final FlightRecorderListener changeListener;

        SecureRecorderListener(AccessControlContext context, FlightRecorderListener changeListener) {
            this.context = Objects.requireNonNull(context);
            this.changeListener = Objects.requireNonNull(changeListener);
        }

        @Override
        public void recordingStateChanged(Recording recording) {
            AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
                try {
                    changeListener.recordingStateChanged(recording);
                } catch (Throwable t) {
                    // Prevent malicious user to propagate exception callback in the wrong context
                    Logger.log(LogTag.JFR, LogLevel.WARN, "Unexpected exception in listener " + changeListener.getClass()+ " at recording state change");
                }
                return null;
            }, context);
        }

        @Override
        public void recorderInitialized(FlightRecorder recorder) {
            AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
                try  {
                    changeListener.recorderInitialized(recorder);
                } catch (Throwable t) {
                    // Prevent malicious user to propagate exception callback in the wrong context
                    Logger.log(LogTag.JFR, LogLevel.WARN, "Unexpected exception in listener " + changeListener.getClass()+ " when initializing FlightRecorder");
                }
                return null;
            }, context);
        }

        public FlightRecorderListener getChangeListener() {
            return changeListener;
        }
    }

    private static final class DirectoryCleaner extends SimpleFileVisitor<Path> {
        @Override
        public FileVisitResult visitFile(Path path, BasicFileAttributes attrs) throws IOException {
            Files.delete(path);
            return FileVisitResult.CONTINUE;
        }

        @Override
        public FileVisitResult postVisitDirectory(Path dir, IOException exc) throws IOException {
            if (exc != null) {
                throw exc;
            }
            Files.delete(dir);
            return FileVisitResult.CONTINUE;
        }
    }

    
Path created by the default file provider,and not a malicious provider.
/** * Path created by the default file provider,and not * a malicious provider. * */
public static final class SafePath { private final Path path; private final String text; public SafePath(Path p) { // sanitize text = p.toString(); path = Paths.get(text); } public SafePath(String path) { this(Paths.get(path)); } public Path toPath() { return path; } public String toString() { return text; } } private interface RunnableWithCheckedException { public void run() throws Exception; } private interface CallableWithoutCheckException<T> { public T call(); } private static <U> U doPrivilegedIOWithReturn(Callable<U> function) throws IOException { try { return AccessController.doPrivileged(new PrivilegedExceptionAction<U>() { @Override public U run() throws Exception { return function.call(); } }, null); } catch (PrivilegedActionException e) { Throwable t = e.getCause(); if (t instanceof IOException) { throw (IOException) t; } throw new IOException("Unexpected error during I/O operation. " + t.getMessage(), t); } } private static void doPriviligedIO(RunnableWithCheckedException function) throws IOException { doPrivilegedIOWithReturn(() -> { function.run(); return null; }); } private static void doPrivileged(Runnable function, Permission... perms) { AccessController.doPrivileged(new PrivilegedAction<Void>() { @Override public Void run() { function.run(); return null; } }, null, perms); } private static void doPrivileged(Runnable function) { AccessController.doPrivileged(new PrivilegedAction<Void>() { @Override public Void run() { function.run(); return null; } }); } private static <T> T doPrivilegedWithReturn(CallableWithoutCheckException<T> function, Permission... perms) { return AccessController.doPrivileged(new PrivilegedAction<T>() { @Override public T run() { return function.call(); } }, null, perms); } public static List<SafePath> getPredefinedJFCFiles() { List<SafePath> list = new ArrayList<>(); try { Iterator<Path> pathIterator = doPrivilegedIOWithReturn(() -> { return Files.newDirectoryStream(JFC_DIRECTORY.toPath(), "*").iterator(); }); while (pathIterator.hasNext()) { Path path = pathIterator.next(); if (path.toString().endsWith(".jfc")) { list.add(new SafePath(path)); } } } catch (IOException ioe) { Logger.log(LogTag.JFR, LogLevel.WARN, "Could not access .jfc-files in " + JFC_DIRECTORY + ", " + ioe.getMessage()); } return list; } static void makeVisibleToJFR(Class<?> clazz) { Module classModule = clazz.getModule(); Modules.addReads(JFR_MODULE, classModule); if (clazz.getPackage() != null) { String packageName = clazz.getPackage().getName(); Modules.addExports(classModule, packageName, JFR_MODULE); Modules.addOpens(classModule, packageName, JFR_MODULE); } }
Adds a qualified export of the internal.jdk.jfr.internal.handlers package (for EventHandler)
/** * Adds a qualified export of the internal.jdk.jfr.internal.handlers package * (for EventHandler) */
static void addHandlerExport(Class<?> clazz) { Modules.addExports(JFR_MODULE, Utils.HANDLERS_PACKAGE_NAME, clazz.getModule()); } static void addEventsExport(Class<?> clazz) { Modules.addExports(JFR_MODULE, Utils.EVENTS_PACKAGE_NAME, clazz.getModule()); } static void addInstrumentExport(Class<?> clazz) { Modules.addExports(JFR_MODULE, Utils.INSTRUMENT_PACKAGE_NAME, clazz.getModule()); } static void addReadEdge(Class<?> clazz) { Modules.addReads(clazz.getModule(), JFR_MODULE); } public static void registerEvent(Class<? extends jdk.internal.event.Event> eventClass) { doPrivileged(() -> MetadataRepository.getInstance().register(eventClass), new FlightRecorderPermission(Utils.REGISTER_EVENT)); } public static void registerMirror(Class<? extends Event> eventClass) { doPrivileged(() -> MetadataRepository.getInstance().registerMirror(eventClass), new FlightRecorderPermission(Utils.REGISTER_EVENT)); } static boolean getBooleanProperty(String propertyName) { return doPrivilegedWithReturn(() -> Boolean.getBoolean(propertyName), new PropertyPermission(propertyName, "read")); } private static SafePath getPathInProperty(String prop, String subPath) { return doPrivilegedWithReturn(() -> { String path = System.getProperty(prop); if (path == null) { return null; } File file = subPath == null ? new File(path) : new File(path, subPath); return new SafePath(file.getAbsolutePath()); }, new PropertyPermission("*", "read")); } // Called by JVM during initialization of JFR static Thread createRecorderThread(ThreadGroup systemThreadGroup, ClassLoader contextClassLoader) { // The thread should have permission = new Permission[0], and not "modifyThreadGroup" and "modifyThread" on the stack, // but it's hard circumvent if we are going to pass in system thread group in the constructor Thread thread = doPrivilegedWithReturn(() -> new Thread(systemThreadGroup, "JFR Recorder Thread"), new RuntimePermission("modifyThreadGroup"), new RuntimePermission("modifyThread")); doPrivileged(() -> thread.setContextClassLoader(contextClassLoader), new RuntimePermission("setContextClassLoader"), new RuntimePermission("modifyThread")); return thread; } static void registerShutdownHook(Thread shutdownHook) { doPrivileged(() -> Runtime.getRuntime().addShutdownHook(shutdownHook), new RuntimePermission("shutdownHooks")); } static void setUncaughtExceptionHandler(Thread thread, Thread.UncaughtExceptionHandler eh) { doPrivileged(() -> thread.setUncaughtExceptionHandler(eh), new RuntimePermission("modifyThread")); } static void moveReplace(SafePath from, SafePath to) throws IOException { doPrivilegedIOWithReturn(() -> Files.move(from.toPath(), to.toPath())); } static void clearDirectory(SafePath safePath) throws IOException { doPriviligedIO(() -> Files.walkFileTree(safePath.toPath(), new DirectoryCleaner())); } static SafePath toRealPath(SafePath safePath) throws Exception { return new SafePath(doPrivilegedIOWithReturn(() -> safePath.toPath().toRealPath())); } static boolean existDirectory(SafePath directory) throws IOException { return doPrivilegedIOWithReturn(() -> Files.exists(directory.toPath())); } static RandomAccessFile createRandomAccessFile(SafePath path) throws Exception { return doPrivilegedIOWithReturn(() -> new RandomAccessFile(path.toPath().toFile(), "rw")); } public static InputStream newFileInputStream(SafePath safePath) throws IOException { return doPrivilegedIOWithReturn(() -> Files.newInputStream(safePath.toPath())); } public static long getFileSize(SafePath safePath) throws IOException { return doPrivilegedIOWithReturn(() -> Files.size(safePath.toPath())); } static SafePath createDirectories(SafePath safePath) throws IOException { Path p = doPrivilegedIOWithReturn(() -> Files.createDirectories(safePath.toPath())); return new SafePath(p); } public static boolean exists(SafePath safePath) throws IOException { return doPrivilegedIOWithReturn(() -> Files.exists(safePath.toPath())); } public static boolean isDirectory(SafePath safePath) throws IOException { return doPrivilegedIOWithReturn(() -> Files.isDirectory(safePath.toPath())); } static void delete(SafePath localPath) throws IOException { doPriviligedIO(() -> Files.delete(localPath.toPath())); } static boolean isWritable(SafePath safePath) throws IOException { return doPrivilegedIOWithReturn(() -> Files.isWritable(safePath.toPath())); } static void deleteOnExit(SafePath safePath) { doPrivileged(() -> safePath.toPath().toFile().deleteOnExit()); } static ReadableByteChannel newFileChannelToRead(SafePath safePath) throws IOException { return doPrivilegedIOWithReturn(() -> FileChannel.open(safePath.toPath(), StandardOpenOption.READ)); } public static InputStream getResourceAsStream(String name) throws IOException { return doPrivilegedIOWithReturn(() -> SecuritySupport.class.getResourceAsStream(name)); } public static Reader newFileReader(SafePath safePath) throws FileNotFoundException, IOException { return doPrivilegedIOWithReturn(() -> Files.newBufferedReader(safePath.toPath())); } static void touch(SafePath path) throws IOException { doPriviligedIO(() -> new RandomAccessFile(path.toPath().toFile(), "rw").close()); } static void setAccessible(Method method) { doPrivileged(() -> method.setAccessible(true), new ReflectPermission("suppressAccessChecks")); } static void setAccessible(Field field) { doPrivileged(() -> field.setAccessible(true), new ReflectPermission("suppressAccessChecks")); } static void setAccessible(Constructor<?> constructor) { doPrivileged(() -> constructor.setAccessible(true), new ReflectPermission("suppressAccessChecks")); } static void ensureClassIsInitialized(Class<?> clazz) { unsafe.ensureClassInitialized(clazz); } static Class<?> defineClass(Class<?> lookupClass, byte[] bytes) { return AccessController.doPrivileged(new PrivilegedAction<>() { @Override public Class<?> run() { try { return MethodHandles.privateLookupIn(lookupClass, LOOKUP).defineClass(bytes); } catch (IllegalAccessException e) { throw new InternalError(e); } } }); } static Thread createThreadWitNoPermissions(String threadName, Runnable runnable) { return doPrivilegedWithReturn(() -> new Thread(runnable, threadName), new Permission[0]); } static void setDaemonThread(Thread t, boolean daeomn) { doPrivileged(()-> t.setDaemon(daeomn), new RuntimePermission("modifyThread")); } public static SafePath getAbsolutePath(SafePath path) throws IOException { return new SafePath(doPrivilegedIOWithReturn((()-> path.toPath().toAbsolutePath()))); } }