Module org.elasticsearch.nativeaccess

Package org.elasticsearch.nativeaccess

Class MacNativeAccess

java.lang.Object

org.elasticsearch.nativeaccess.PosixNativeAccess

org.elasticsearch.nativeaccess.MacNativeAccess

All Implemented Interfaces:

NativeAccess

public class MacNativeAccess
extends PosixNativeAccess

Nested Class Summary

Nested classes/interfaces inherited from interface org.elasticsearch.nativeaccess.NativeAccess

NativeAccess.ExecSandboxState

Field Summary

Fields

Modifier and Type	Field	Description
protected NativeAccess.ExecSandboxState	execSandboxState
protected boolean	isMemoryLocked
protected static final Logger	logger

Fields inherited from class org.elasticsearch.nativeaccess.PosixNativeAccess

constants, libc, processLimits, vectorDistance

Method Summary

Modifier and Type	Method	Description
NativeAccess.ExecSandboxState	getExecSandboxState()	Return whether installing the exec system call filters was successful, and to what degree.
protected long	getMaxThreads()	Return the maximum number of threads this process may start, or ProcessLimits.UNKNOWN.
Zstd	getZstd()	Returns an accessor to zstd compression functions.
boolean	isMemoryLocked()	Return whether locking memory was successful, or false otherwise.
protected void	logMemoryLimitInstructions()
protected boolean	nativePreallocate(int fd, long currentSize, long newSize)
CloseableByteBuffer	newConfinedBuffer(int len)	Creates a new CloseableByteBuffer using a confined arena.
CloseableByteBuffer	newSharedBuffer(int len)	Creates a new CloseableByteBuffer using a shared arena.
Systemd	systemd()
void	tryInstallExecSandbox()	Installs exec system call filtering on MacOS.

Methods inherited from class org.elasticsearch.nativeaccess.PosixNativeAccess

allocatedSizeInBytes, definitelyRunningAsRoot, getProcessLimits, getRLimit, getVectorSimilarityFunctions, tryLockMemory, tryPreallocate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

logger

protected static final Logger logger

isMemoryLocked

protected boolean isMemoryLocked

execSandboxState

protected NativeAccess.ExecSandboxState execSandboxState

Method Details

getMaxThreads

protected long getMaxThreads()

Description copied from class: PosixNativeAccess

Return the maximum number of threads this process may start, or ProcessLimits.UNKNOWN.

Specified by:

getMaxThreads in class PosixNativeAccess

logMemoryLimitInstructions

protected void logMemoryLimitInstructions()

Specified by:

logMemoryLimitInstructions in class PosixNativeAccess

nativePreallocate

protected boolean nativePreallocate(int fd,
 long currentSize,
 long newSize)

Specified by:

nativePreallocate in class PosixNativeAccess

tryInstallExecSandbox

public void tryInstallExecSandbox()

Installs exec system call filtering on MacOS.

Two different methods of filtering are used. Since MacOS is BSD based, process creation is first restricted with setrlimit(RLIMIT_NPROC).

Additionally, on Mac OS X Leopard or above, a custom sandbox(7) ("Seatbelt") profile is installed that denies the following rules:

• process-fork
• process-exec

See Also:

• * https://reverse.put.as/wp-content/uploads/2011/06/The-Apple-Sandbox-BHDC2011-Paper.pdf

systemd

public Systemd systemd()

Specified by:

systemd in interface NativeAccess

getZstd

public Zstd getZstd()

Description copied from interface: NativeAccess

Returns an accessor to zstd compression functions.

Specified by:

getZstd in interface NativeAccess

Returns:

an object used to compress and decompress bytes using zstd

newSharedBuffer

public CloseableByteBuffer newSharedBuffer(int len)

Description copied from interface: NativeAccess

Creates a new CloseableByteBuffer using a shared arena. The buffer can be used across multiple threads.

Specified by:

newSharedBuffer in interface NativeAccess

Parameters:

len - the number of bytes the buffer should allocate

Returns:

the buffer

newConfinedBuffer

public CloseableByteBuffer newConfinedBuffer(int len)

Description copied from interface: NativeAccess

Creates a new CloseableByteBuffer using a confined arena. The buffer must be used within the same thread that it is created.

Specified by:

newConfinedBuffer in interface NativeAccess

Parameters:

len - the number of bytes the buffer should allocate

Returns:

the buffer

isMemoryLocked

public boolean isMemoryLocked()

Description copied from interface: NativeAccess

Return whether locking memory was successful, or false otherwise.

Specified by:

isMemoryLocked in interface NativeAccess

getExecSandboxState

public NativeAccess.ExecSandboxState getExecSandboxState()

Description copied from interface: NativeAccess

Return whether installing the exec system call filters was successful, and to what degree.

Specified by:

getExecSandboxState in interface NativeAccess