feat(aop): standard-allow low-risk entropy-device reads and default temp-file creation in the secure baseline

Author: LukaPetrovicTUM

src/main/java/de/tum/cit/ase/ares/api/aop/java/instrumentation/advice/JavaInstrumentationAdviceAbstractToolbox.java

@@ -368,7 +368,7 @@ static boolean isClassLoadingInProgress() {
 	 * {@link java.security.Provider}, whose {@code engineGenerateSeed} genuinely
 	 * runs beneath a real {@code java.security.SecureRandom.generateSeed(...)}
 	 * frame) — which is exactly why the trusted name sets below are restricted to
-	 * internal implementation packages stable code cannot reach, reference, or
+	 * internal implementation packages student code cannot reach, reference, or
 	 * subclass, rather than public dispatch/callback-accepting classes. The
 	 * class-loader check is defence in depth against a class-loader impersonating
 	 * one of those package names.

src/test/java/de/tum/cit/ase/ares/api/aop/java/AspectJBaselineLowRiskExemptionUnitTest.java

@@ -2,15 +2,14 @@
 
 import static org.junit.jupiter.api.Assertions.assertFalse;
 
-import java.security.Provider;
-import java.security.SecureRandom;
-import java.security.SecureRandomSpi;
 import java.time.LocalDate;
 import java.time.temporal.TemporalQuery;
 import java.util.concurrent.atomic.AtomicBoolean;
 
 import org.junit.jupiter.api.Test;
 
+import de.tum.cit.ase.ares.testutilities.FakeSecureRandomSeedingFixture;
+
 import example.student.AspectJSecurityProbe;
 
 /**
@@ -40,7 +39,7 @@ void isSecureRandomSeedingInProgressIsNotForgedByACustomSecureRandomSpi() throws
 		// sun.security.provider.* internal implementation frames are - so this must
 		// stay false.
 		AtomicBoolean seedingDetected = new AtomicBoolean();
-		triggerFakeSecureRandomSeeding(
+		FakeSecureRandomSeedingFixture.triggerFakeSecureRandomSeeding(
 				() -> seedingDetected.set(AspectJSecurityProbe.isSecureRandomSeedingInProgress()));
 
 		assertFalse(seedingDetected.get());
@@ -57,7 +56,7 @@ void isEntropySourceReadReturnsFalseWithoutSecureRandomFrame() throws Exception
 	@Test
 	void isEntropySourceReadIsNotForgedByACustomSecureRandomSpi() throws Exception {
 		AtomicBoolean entropyReadExempt = new AtomicBoolean();
-		triggerFakeSecureRandomSeeding(
+		FakeSecureRandomSeedingFixture.triggerFakeSecureRandomSeeding(
 				() -> entropyReadExempt.set(AspectJSecurityProbe.isEntropySourceRead("read", "/dev/urandom")));
 
 		assertFalse(entropyReadExempt.get(),
@@ -106,57 +105,4 @@ void isSystemTimezoneReadIsNotForgedByATemporalQueryCallback() throws Exception
 		assertFalse(timezoneReadExempt.get(),
 				"a java.time.temporal.Temporal callback must not be able to forge the system-timezone read exemption");
 	}
-
-	/**
-	 * Registers a synthetic, student-authored-style {@link SecureRandomSpi} whose
-	 * {@code engineGenerateSeed} runs the given probe, then calls
-	 * {@link SecureRandom#generateSeed(int)} on it. This makes
-	 * {@code java.security.SecureRandom.generateSeed(...)} a genuine caller frame
-	 * on the real stack while the probe runs — the exact spoof the narrowed
-	 * {@code sun.security.provider.*}-only trust set is designed to reject, since
-	 * no genuine JDK seeding is actually taking place.
-	 */
-	private static void triggerFakeSecureRandomSeeding(SeedingProbe probe) throws Exception {
-		ProbingSecureRandomSpi.PROBE = probe;
-		try {
-			Provider provider = new Provider("ares-hotfix-test-secure-random-provider", "1.0",
-					"Ares test fixture provider for exercising the SecureRandom-seeding stack detector") {
-				private static final long serialVersionUID = 1L;
-			};
-			provider.put("SecureRandom.AresProbe", ProbingSecureRandomSpi.class.getName());
-			SecureRandom.getInstance("AresProbe", provider).generateSeed(1);
-		} finally {
-			ProbingSecureRandomSpi.PROBE = null;
-		}
-	}
-
-	@FunctionalInterface
-	private interface SeedingProbe {
-		void run() throws Exception;
-	}
-
-	public static final class ProbingSecureRandomSpi extends SecureRandomSpi {
-
-		private static volatile SeedingProbe PROBE;
-
-		@Override
-		protected byte[] engineGenerateSeed(int numBytes) {
-			try {
-				PROBE.run();
-			} catch (Exception e) {
-				throw new IllegalStateException(e);
-			}
-			return new byte[numBytes];
-		}
-
-		@Override
-		protected void engineSetSeed(byte[] seed) {
-			// Not exercised by these tests.
-		}
-
-		@Override
-		protected void engineNextBytes(byte[] bytes) {
-			// Not exercised by these tests.
-		}
-	}
 }

src/test/java/de/tum/cit/ase/ares/api/aop/java/instrumentation/advice/JavaInstrumentationAdviceFileSystemToolboxTest.java

@@ -13,9 +13,8 @@
 import java.nio.file.Path;
 import java.nio.file.StandardOpenOption;
 import java.nio.file.attribute.FileAttribute;
-import java.security.Provider;
+import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
-import java.security.SecureRandomSpi;
 import java.time.LocalDate;
 import java.time.temporal.TemporalQuery;
 import java.util.List;
@@ -29,6 +28,7 @@
 import de.tum.cit.ase.ares.api.aop.java.JavaAOPTestCase;
 import de.tum.cit.ase.ares.api.aop.java.JavaAOPTestCaseSettings;
 import de.tum.cit.ase.ares.api.aop.java.instrumentation.pointcut.JavaInstrumentationPointcutDefinitions;
+import de.tum.cit.ase.ares.testutilities.FakeSecureRandomSeedingFixture;
 
 import example.student.InstrumentationSecurityProbe;
 
@@ -484,7 +484,7 @@ void customSecureRandomSpiCannotForgeTheEntropyDeviceReadExemption() throws Exce
 			// dispatch frame is not itself trusted - only genuine
 			// sun.security.provider.* internal implementation frames are - so a
 			// simulated entropy-device read from within it must still be denied.
-			assertThrows(SecurityException.class, () -> triggerFakeSecureRandomSeeding(
+			assertThrows(SecurityException.class, () -> FakeSecureRandomSeedingFixture.triggerFakeSecureRandomSeeding(
 					() -> InstrumentationSecurityProbe.checkEntropyDeviceReadDirectly("/dev/urandom")));
 		} finally {
 			resetSettings();
@@ -493,20 +493,37 @@ void customSecureRandomSpiCannotForgeTheEntropyDeviceReadExemption() throws Exce
 
 	@Test
 	void genuineSecureRandomEntropySeedingIsPermittedByAnActivePolicy() throws Exception {
-		Assumptions.assumeTrue(Files.exists(Path.of("/dev/urandom")) || Files.exists(Path.of("/dev/random")),
-				"requires an OS entropy device (Linux/BSD)");
+		// A plain new SecureRandom().generateSeed(...) is not reliable here: the
+		// JDK's own SeedGenerator/NativePRNG singletons open their entropy device at
+		// most once per JVM and cache the stream for the rest of the process's
+		// lifetime, so an unforced call could return a cached seed without ever
+		// re-entering the woven FileInputStream constructor - meaning
+		// assertDoesNotThrow could pass without exercising
+		// isSecureRandomSeedingInProgress() at all. "NativePRNGBlocking" is a
+		// distinct SecureRandomSpi (its own RandomIO instance, its own /dev/random
+		// device) that nothing else in this codebase requests by name, which makes
+		// it far less likely to already be warm from an earlier test in this fork -
+		// the closest a black-box unit test can get to a genuinely reachable
+		// JDK-internal seeding call.
+		SecureRandom nativeBlockingSecureRandom;
+		try {
+			nativeBlockingSecureRandom = SecureRandom.getInstance("NativePRNGBlocking");
+		} catch (NoSuchAlgorithmException e) {
+			Assumptions.abort("NativePRNGBlocking unavailable on this platform (" + e.getMessage() + ")");
+			return;
+		}
 		try {
 			resetSettings();
 			configureInstrumentationMode();
 			JavaAOPTestCase.setJavaAdviceSettingValue("pathsAllowedToBeRead", new String[0], "ARCH", "INSTRUMENTATION");
 
-			// An unforced, genuinely fresh SecureRandom.generateSeed(...) call on the
-			// JDK's own default provider must still be permitted even though the active
-			// policy allows no read paths at all - proving the narrowed
-			// sun.security.provider.*-only trust still recognises real JDK seeding, not
-			// just the (now-denied) forged case above. Runs against the real
-			// java-agent-instrumented FileInputStream constructor, not a simulated call.
-			assertDoesNotThrow(() -> new SecureRandom().generateSeed(8));
+			// Must still be permitted even though the active policy allows no read
+			// paths at all - proving the narrowed sun.security.provider.*-only trust
+			// still recognises real JDK seeding, not just the (now-denied) forged case
+			// above. Runs against the real java-agent-instrumented FileInputStream
+			// constructor, not a simulated call.
+			SecureRandom finalNativeBlockingSecureRandom = nativeBlockingSecureRandom;
+			assertDoesNotThrow(() -> finalNativeBlockingSecureRandom.generateSeed(8));
 		} finally {
 			resetSettings();
 		}
@@ -775,54 +792,5 @@ private static File createNonTempDirOutsideDefaultTempDir(String name) throws IO
 		return dir.toFile();
 	}
 
-	/**
-	 * Registers a synthetic, student-authored-style {@link SecureRandomSpi} whose
-	 * {@code engineGenerateSeed} runs the given probe, then calls
-	 * {@link SecureRandom#generateSeed(int)} on it. This makes
-	 * {@code java.security.SecureRandom.generateSeed(...)} a genuine caller frame
-	 * on the real stack while the probe runs — the exact spoof the narrowed
-	 * {@code sun.security.provider.*}-only trust set is designed to reject, since
-	 * no genuine JDK seeding is actually taking place.
-	 */
-	private static void triggerFakeSecureRandomSeeding(SeedingProbe probe) throws Exception {
-		ProbingSecureRandomSpi.PROBE = probe;
-		try {
-			Provider provider = new Provider("ares-hotfix-test-secure-random-provider", "1.0",
-					"Ares test fixture provider for exercising the SecureRandom-seeding stack detector") {
-				private static final long serialVersionUID = 1L;
-			};
-			provider.put("SecureRandom.AresProbe", ProbingSecureRandomSpi.class.getName());
-			SecureRandom.getInstance("AresProbe", provider).generateSeed(1);
-		} finally {
-			ProbingSecureRandomSpi.PROBE = null;
-		}
-	}
-
-	@FunctionalInterface
-	private interface SeedingProbe {
-		void run();
-	}
-
-	public static final class ProbingSecureRandomSpi extends SecureRandomSpi {
-
-		private static volatile SeedingProbe PROBE;
-
-		@Override
-		protected byte[] engineGenerateSeed(int numBytes) {
-			PROBE.run();
-			return new byte[numBytes];
-		}
-
-		@Override
-		protected void engineSetSeed(byte[] seed) {
-			// Not exercised by these tests.
-		}
-
-		@Override
-		protected void engineNextBytes(byte[] bytes) {
-			// Not exercised by these tests.
-		}
-	}
-
 	// </editor-fold>
 }

src/test/java/de/tum/cit/ase/ares/testutilities/FakeSecureRandomSeedingFixture.java

@@ -0,0 +1,88 @@
+package de.tum.cit.ase.ares.testutilities;
+
+import java.security.Provider;
+import java.security.SecureRandom;
+import java.security.SecureRandomSpi;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Registers a synthetic, student-authored-style {@link SecureRandomSpi} whose
+ * {@code engineGenerateSeed} runs a caller-supplied probe, then calls
+ * {@link SecureRandom#generateSeed(int)} on it. This makes
+ * {@code java.security.SecureRandom.generateSeed(...)} a genuine caller frame
+ * on the real stack while the probe runs — the exact spoof both AOP backends'
+ * narrowed {@code sun.security.provider.*}-only SecureRandom-seeding stack
+ * detector is designed to reject, since no genuine JDK seeding is actually
+ * taking place.
+ * <p>
+ * Shared between the instrumentation and AspectJ baseline-low-risk-exemption
+ * unit tests. The probe is threaded through {@link ProbingSecureRandomSpi} as a
+ * constructor-injected instance field (via a custom
+ * {@link Provider.Service#newInstance}) rather than a static field, so
+ * concurrent/parallel test execution cannot cross-contaminate between callers.
+ */
+public final class FakeSecureRandomSeedingFixture {
+
+	private FakeSecureRandomSeedingFixture() {
+	}
+
+	@FunctionalInterface
+	public interface SeedingProbe {
+		void run() throws Exception;
+	}
+
+	public static void triggerFakeSecureRandomSeeding(SeedingProbe probe) throws Exception {
+		Provider provider = new Provider("ares-hotfix-test-secure-random-provider", "1.0",
+				"Ares test fixture provider for exercising the SecureRandom-seeding stack detector") {
+			private static final long serialVersionUID = 1L;
+
+			{
+				putService(new Service(this, "SecureRandom", "AresProbe", ProbingSecureRandomSpi.class.getName(),
+						List.of(), Map.of()) {
+					@Override
+					public Object newInstance(Object constructorParameter) {
+						return new ProbingSecureRandomSpi(probe);
+					}
+				});
+			}
+		};
+		SecureRandom.getInstance("AresProbe", provider).generateSeed(1);
+	}
+
+	public static final class ProbingSecureRandomSpi extends SecureRandomSpi {
+
+		private static final long serialVersionUID = 1L;
+
+		private final transient SeedingProbe probe;
+
+		ProbingSecureRandomSpi(SeedingProbe probe) {
+			this.probe = probe;
+		}
+
+		@Override
+		protected byte[] engineGenerateSeed(int numBytes) {
+			try {
+				probe.run();
+			} catch (RuntimeException e) {
+				// Let unchecked exceptions (in particular the SecurityException this fixture
+				// exists to provoke) propagate as-is; only a genuine checked exception from
+				// the functional interface needs wrapping to cross the override boundary.
+				throw e;
+			} catch (Exception e) {
+				throw new IllegalStateException(e);
+			}
+			return new byte[numBytes];
+		}
+
+		@Override
+		protected void engineSetSeed(byte[] seed) {
+			// Not exercised by these tests.
+		}
+
+		@Override
+		protected void engineNextBytes(byte[] bytes) {
+			// Not exercised by these tests.
+		}
+	}
+}