{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/kibana/issues/17496","repository_url":"https://api.github.com/repos/elastic/kibana","labels_url":"https://api.github.com/repos/elastic/kibana/issues/17496/labels{/name}","comments_url":"https://api.github.com/repos/elastic/kibana/issues/17496/comments","events_url":"https://api.github.com/repos/elastic/kibana/issues/17496/events","html_url":"https://github.com/elastic/kibana/pull/17496","id":310541457,"number":17496,"title":"Native controllers","user":{"login":"kobelb","id":627123,"avatar_url":"https://avatars0.githubusercontent.com/u/627123?v=4","gravatar_id":"","url":"https://api.github.com/users/kobelb","html_url":"https://github.com/kobelb","followers_url":"https://api.github.com/users/kobelb/followers","following_url":"https://api.github.com/users/kobelb/following{/other_user}","gists_url":"https://api.github.com/users/kobelb/gists{/gist_id}","starred_url":"https://api.github.com/users/kobelb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kobelb/subscriptions","organizations_url":"https://api.github.com/users/kobelb/orgs","repos_url":"https://api.github.com/users/kobelb/repos","events_url":"https://api.github.com/users/kobelb/events{/privacy}","received_events_url":"https://api.github.com/users/kobelb/received_events","type":"User","site_admin":false},"labels":[{"id":135307740,"url":"https://api.github.com/repos/elastic/kibana/labels/review","name":"review","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":43,"created_at":"2018-04-02T17:04:26Z","updated_at":"2018-05-08T14:48:49Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/elastic/kibana/pulls/17496","html_url":"https://github.com/elastic/kibana/pull/17496","diff_url":"https://github.com/elastic/kibana/pull/17496.diff","patch_url":"https://github.com/elastic/kibana/pull/17496.patch"},"body":"# Native Controllers\r\n\r\nImplements system call filtering for Linux and Windows, we don't currently support this level of protection with macOS, which is fine because we don't support macOS as an official operating system. This can currently be disabled via `server.systemCallFilters.enable: false` in the kibana.yml. I left this as an undocumented setting for the time being, as the only current use is with in the unit tests.\r\n\r\nNative controllers are currently the only supported way of running code outside of the context of the system call filters, and it's currently only implemented by Reporting.\r\n\r\nWhen installing a plugin that has a native controller, the user will be warned with the following prompt before the install configures:\r\n\r\n```\r\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\n@        WARNING: plugin forks a native controller        @\r\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nThis plugin launches a native controller that is not subject\r\nto the system call filters.\r\n\r\nContinue with installation? [y/N]\r\n```\r\n\r\nWhen the Kibana server is starting up, we scan for plugins that contain a native controller and fork an instance of the `src/server/native_controllers/native_controller_start.js` that will `require` the actual native controller when it later receives the `start` IPC message. We then activate the system call filtering so no additional processes will be able to be spawned. The rest of the plugin discovery process then occurs, and once we are able to determine whether the plugins are enabled/disabled we either kill the `native_controller_start.js` process or send it the `start` message which loads the actual native controller code. \r\n\r\n\r\n# Reporting Native Controller\r\n\r\nWith the implementation of the system call filters, we're no longer able to spawn headless browsers from the Kibana server directly. Instead we have to implement a native controller that is responsible for spawning the browsers, and all communication must then go through the native controller.\r\n\r\nReporting's native_controller/index.js is loaded in a separate process when the Kibana server is initializing, and then we're handed the native controller process in the plugin's init method. The native controller itself responds to two types of messages: kill and spawn.\r\n\r\nThe native_controller_client is used from within the Kibana server process to communicate with the native controller and the headless browsers that it spawns. The SyntheticProcess provides the necessary interfaces that emulates a browser process, while multiplexing all communication with the actual browser process through the native controller over IPC.\r\n\r\nWe also pulled the @elastic/node-phantom-simple code into the source code as we needed to make some modifications so we could pass it an instance of the SyntheticProcess instead of having it spawn itself.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/kibana/issues/comments/387428595","html_url":"https://github.com/elastic/kibana/pull/17496#issuecomment-387428595","issue_url":"https://api.github.com/repos/elastic/kibana/issues/17496","id":387428595,"user":{"login":"elasticmachine","id":15837671,"avatar_url":"https://avatars3.githubusercontent.com/u/15837671?v=4","gravatar_id":"","url":"https://api.github.com/users/elasticmachine","html_url":"https://github.com/elasticmachine","followers_url":"https://api.github.com/users/elasticmachine/followers","following_url":"https://api.github.com/users/elasticmachine/following{/other_user}","gists_url":"https://api.github.com/users/elasticmachine/gists{/gist_id}","starred_url":"https://api.github.com/users/elasticmachine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elasticmachine/subscriptions","organizations_url":"https://api.github.com/users/elasticmachine/orgs","repos_url":"https://api.github.com/users/elasticmachine/repos","events_url":"https://api.github.com/users/elasticmachine/events{/privacy}","received_events_url":"https://api.github.com/users/elasticmachine/received_events","type":"User","site_admin":false},"created_at":"2018-05-08T14:48:49Z","updated_at":"2018-05-08T14:48:49Z","author_association":"NONE","body":"## :green_heart: Build Succeeded\n* [continuous-integration/kibana-ci/pull-request](https://kibana-ci.elastic.co/job/elastic-kibana-pull-request/2801/)\n\n"}}
{"actor":{"display_login":"elasticmachine"}}