Securing a search engine while maintaining usability
summary
Elasticsearch runs a custom Java sandbox and ships with security manager enabled by default so startups enable safety after initial bootstrap. Production mode enforces bootstrap checks like file descriptors and mlock to avoid OOM and corruption. Kernel filters such as seccomp block execve to prevent forks. A new sandboxed language called painless scripting language is built to avoid groovy holes and it works. Unsafe endpoints like delete by query get removed until reliable background task infrastructure exists.
AI-written summary · about
chapters (11)
- 0:00Start
- 3:27Security as a non-functional requirement
- 5:33Security or resiliency?
- 8:55Introduction
- 10:28Drawbacks
- 13:50Mode check
- 15:00Bootstrap checks
- 18:20Reducing impact
- 20:06Seccomp - prevent process forks
- 22:22Security Manager in Elasticsearch
- 26:56Plugins in 60 seconds
related talks
35mSecuring software while maintaining usability
26mFinding Alternatives to Security Manager
11mPlaying in the Sandbox: A Study on the Usability of Seccomp
13mSecuring the Data Frontier: Real-World Strategies With OpenSearch
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
47mSecure Sandboxing in a Post-Spectre World
35mEnter Sandbox
38mSandboxing in Linux with zero lines of code