Restrict createClassLoader to modules (#67127)

Creating classloaders is not something plugins really need to do. It is
only necessary for cases of loading dynamic code, which we do within
painless. This commit restricts allowing this permission to modules.

distribution/tools/plugin-cli/src/test/java/org/elasticsearch/plugins/InstallPluginCommandTests.java

@@ -1466,7 +1466,7 @@ public class InstallPluginCommandTests extends ESTestCase {
     public void testPolicyConfirmation() throws Exception {
         Tuple<Path, Environment> env = createEnv(fs, temp);
         Path pluginDir = createPluginDir(temp);
-        writePluginSecurityPolicy(pluginDir, "createClassLoader", "setFactory");
+        writePluginSecurityPolicy(pluginDir, "getClassLoader", "setFactory");
         String pluginZip = createPluginUrl("fake", pluginDir);
 
         assertPolicyConfirmation(env, pluginZip, "plugin requires additional permissions");

qa/evil-tests/src/test/java/org/elasticsearch/bootstrap/PolicyUtilTests.java

@@ -214,7 +214,6 @@ public class PolicyUtilTests extends ESTestCase {
         "java.io.FilePermission /foo/bar read",
 
         "java.lang.reflect.ReflectPermission suppressAccessChecks",
-        "java.lang.RuntimePermission createClassLoader",
         "java.lang.RuntimePermission getClassLoader",
         "java.lang.RuntimePermission setContextClassLoader",
         "java.lang.RuntimePermission setFactory",
@@ -274,6 +273,7 @@ public class PolicyUtilTests extends ESTestCase {
 
     static final List<String> MODULE_TEST_PERMISSIONS = List.of(
         "java.io.FilePermission /foo/bar write",
+        "java.lang.RuntimePermission createClassLoader",
         "java.lang.RuntimePermission getFileStoreAttributes",
         "java.lang.RuntimePermission accessUserInformation"
     );

qa/evil-tests/src/test/java/org/elasticsearch/plugins/PluginSecurityTests.java

@@ -54,7 +54,7 @@ public class PluginSecurityTests extends ESTestCase {
         Set<String> actual = PluginSecurity.getPermissionDescriptions(info, scratch);
         assertThat(actual, containsInAnyOrder(
             PluginSecurity.formatPermission(new RuntimePermission("getClassLoader")),
-            PluginSecurity.formatPermission(new RuntimePermission("createClassLoader"))));
+            PluginSecurity.formatPermission(new RuntimePermission("setFactory"))));
     }
 
     /** Test that we can format some simple permissions properly */

qa/evil-tests/src/test/resources/org/elasticsearch/plugins/security/complex-plugin-security.policy

@@ -9,5 +9,5 @@
 grant {
   // needed to cause problems
   permission java.lang.RuntimePermission "getClassLoader";
-  permission java.lang.RuntimePermission "createClassLoader";
+  permission java.lang.RuntimePermission "setFactory";
 };

server/src/main/java/org/elasticsearch/bootstrap/PolicyUtil.java

@@ -95,7 +95,6 @@ public class PolicyUtil {
             createFilePermission("<<ALL FILES>>", "read"),
 
             new ReflectPermission("suppressAccessChecks"),
-            new RuntimePermission("createClassLoader"),
             new RuntimePermission("getClassLoader"),
             new RuntimePermission("setContextClassLoader"),
             new RuntimePermission("setFactory"),
@@ -163,6 +162,7 @@ public class PolicyUtil {
         // but that we do not think plugins in general should need.
         List<Permission> modulePermissions = List.of(
             createFilePermission("<<ALL FILES>>", "read,write"),
+            new RuntimePermission("createClassLoader"),
             new RuntimePermission("getFileStoreAttributes"),
             new RuntimePermission("accessUserInformation"),
             new AuthPermission("modifyPrivateCredentials")

x-pack/qa/security-example-spi-extension/src/main/java/org/elasticsearch/example/ExampleSecurityExtension.java

@@ -37,7 +37,7 @@ public class ExampleSecurityExtension implements SecurityExtension {
     static {
         // check that the extension's policy works.
         AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
-            System.getSecurityManager().checkCreateClassLoader();
+            System.getSecurityManager().checkPropertyAccess("myproperty");
             return null;
         });
     }

x-pack/qa/security-example-spi-extension/src/main/plugin-metadata/plugin-security.policy

@@ -1,4 +1,4 @@
 grant {
   // example security manager permission
-  permission java.lang.RuntimePermission "createClassLoader";
+  permission java.util.PropertyPermission "foobar", "read";
 };