Support phasing off SecurityManager usage in favor of Java Agent

Signed-off-by: Gulshan <[email protected]>

Author: kumargu

build.gradle

@@ -152,6 +152,7 @@ ext {
     }
 }
 
+
 allprojects {
     group = opensearch_group
     version = "${opensearch_build}"
@@ -181,6 +182,7 @@ allprojects {
 configurations {
     zipArchive
     secureIntegTestPluginArchive
+    agent
 }
 
 tasks.register("preparePluginPathDirs") {
@@ -286,6 +288,10 @@ dependencies {
     testFixturesImplementation fileTree(dir: knnJarDirectory, include: ["opensearch-knn-${opensearch_build}.jar", "remote-index-build-client-${opensearch_build}.jar"])
     testImplementation fileTree(dir: knnJarDirectory, include: ["opensearch-knn-${opensearch_build}.jar", "remote-index-build-client-${opensearch_build}.jar"])
     testImplementation "org.opensearch.plugin:parent-join-client:${opensearch_version}"
+
+    agent "org.opensearch:opensearch-agent-bootstrap:${opensearch_version}"
+    agent "org.opensearch:opensearch-agent:${opensearch_version}"
+    agent "net.bytebuddy:byte-buddy:${versions.bytebuddy}"
 }
 
 // In order to add the jar to the classpath, we need to unzip the
@@ -460,3 +466,13 @@ task updateVersion {
         ant.replaceregexp(file:'build.gradle', match: '"opensearch.version", "\\d.*"', replace: '"opensearch.version", "' + newVersion.tokenize('-')[0] + '-SNAPSHOT"', flags:'g', byline:true)
     }
 }
+
+task prepareAgent(type: Copy) {
+    from(configurations.agent)
+    into "$buildDir/agent"
+}
+
+tasks.withType(Test) {
+    dependsOn prepareAgent
+    jvmArgs += ["-javaagent:" + project.layout.buildDirectory.file("agent/opensearch-agent-${opensearch_version}.jar").get()]
+}

qa/build.gradle

@@ -28,6 +28,7 @@ java {
 
 configurations {
     zipArchive
+    agent
 }
 
 def knnJarDirectory = "$rootDir/build/dependencies/opensearch-knn"
@@ -53,6 +54,10 @@ dependencies {
     api "junit:junit:${versions.junit}"
     testImplementation "org.opensearch.test:framework:${opensearch_version}"
     testImplementation(testFixtures(rootProject))
+
+    agent "org.opensearch:opensearch-agent-bootstrap:${opensearch_version}"
+    agent "org.opensearch:opensearch-agent:${opensearch_version}"
+    agent "net.bytebuddy:byte-buddy:${versions.bytebuddy}"
 }
 
 ext {
@@ -246,3 +251,13 @@ task bwcTestSuite {
     dependsOn ":qa:restart-upgrade:testAgainstNewCluster"
     dependsOn ":qa:rolling-upgrade:testRollingUpgrade"
 }
+
+task prepareAgent(type: Copy) {
+    from(configurations.agent)
+    into "$buildDir/agent"
+}
+
+tasks.withType(Test) {
+    dependsOn prepareAgent
+    jvmArgs += ["-javaagent:" + project.layout.buildDirectory.file("agent/opensearch-agent-${opensearch_version}.jar").get()]
+}

src/main/plugin-metadata/plugin-security.policy

@@ -1,7 +1,16 @@
+
+grant codeBase "${codebase.opensearch}" {
+    permission java.net.SocketPermission "*", "connect,resolve";
+};
+
 grant {
     //ml-commons client
     permission java.lang.RuntimePermission "getClassLoader";
     permission java.lang.RuntimePermission "accessDeclaredMembers";
     permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
     permission java.lang.RuntimePermission "setContextClassLoader";
+
+    // temporary for testing
+    permission java.net.SocketPermission "*", "connect,resolve";
+
 };