/*
 * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
 * or more contributor license agreements. Licensed under the "Elastic License
 * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
 * Public License v 1"; you may not use this file except in compliance with, at
 * your election, the "Elastic License 2.0", the "GNU Affero General Public
 * License v3.0 only", or the "Server Side Public License, v 1".
 */

grant {
  // Hadoop UserGroupInformation, HdfsConstants, PipelineAck clinit
  permission java.lang.RuntimePermission "getClassLoader";

  // UserGroupInformation (UGI) Metrics clinit
  permission java.lang.RuntimePermission "accessDeclaredMembers";
  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";

  // Needed so that Hadoop can load the correct classes for SPI and JAAS
  // org.apache.hadoop.security.SecurityUtil clinit
  // org.apache.hadoop.security.UserGroupInformation.newLoginContext()
  permission java.lang.RuntimePermission "setContextClassLoader";

  // org.apache.hadoop.util.StringUtils clinit
  permission java.util.PropertyPermission "*", "read,write";

  // JAAS is used by Hadoop for authentication purposes
  // The Hadoop Login JAAS module modifies a Subject's private credentials and principals
  // The Hadoop RPC Layer must be able to read these credentials, and initiate Kerberos connections

  // org.apache.hadoop.security.UserGroupInformation.getCurrentUser()
  permission javax.security.auth.AuthPermission "getSubject";

  // org.apache.hadoop.security.UserGroupInformation.doAs()
  permission javax.security.auth.AuthPermission "doAs";

  // org.apache.hadoop.security.UserGroupInformation.getCredentialsInternal()
  permission javax.security.auth.PrivateCredentialPermission "org.apache.hadoop.security.Credentials * \"*\"", "read";

  // Hadoop depends on the Kerberos login module for kerberos authentication
  // com.sun.security.auth.module.Krb5LoginModule.login()
  permission java.lang.RuntimePermission "accessClassInPackage.sun.security.krb5";

  // com.sun.security.auth.module.Krb5LoginModule.commit()
  permission javax.security.auth.AuthPermission "modifyPrivateCredentials";
  permission javax.security.auth.AuthPermission "modifyPrincipals";
  permission javax.security.auth.PrivateCredentialPermission "javax.security.auth.kerberos.KeyTab * \"*\"", "read";
  permission javax.security.auth.PrivateCredentialPermission "javax.security.auth.kerberos.KerberosTicket * \"*\"", "read";

  // Hadoop depends on OS level user information for simple authentication
  // Unix: UnixLoginModule: com.sun.security.auth.module.UnixSystem.UnixSystem init
  permission java.lang.RuntimePermission "loadLibrary.jaas";
  permission java.lang.RuntimePermission "loadLibrary.jaas_unix";
  // Windows: NTLoginModule: com.sun.security.auth.module.NTSystem.loadNative
  permission java.lang.RuntimePermission "loadLibrary.jaas_nt";
  permission javax.security.auth.AuthPermission "modifyPublicCredentials";

  // org.apache.hadoop.security.SaslRpcServer.init()
  permission java.security.SecurityPermission "putProviderProperty.SaslPlainServer";

  // org.apache.hadoop.security.SaslPlainServer.SecurityProvider.SecurityProvider init
  permission java.security.SecurityPermission "insertProvider";

  // org.apache.hadoop.security.SaslRpcClient.getServerPrincipal -> KerberosPrincipal init
  permission javax.security.auth.kerberos.ServicePermission "*", "initiate";

  // hdfs client opens socket connections for to access repository
  permission java.net.SocketPermission "*", "connect";

  // client binds to the address returned from the host name of any principal set up as a service principal
  // org.apache.hadoop.ipc.Client.Connection.setupConnection
  permission java.net.SocketPermission "localhost:0", "listen,resolve";
};
