Add full support for Java attacher on Windows
A followup on #8590 , which doesn't include Windows support.
Two topics that require some investigation in this regard:
- ~~We don't yet have a proper
ps-equivalent for full command path discovery (some preliminary examination done by @jackshirazi ). Possible alternatives if we can't find such:~~- ~~rely on file system (
hsperfdatafiles), which is limited to HotSpot~~ - ~~bundle our own binaries for this task~~
- ~~rely on file system (
- The ability to run as a different user is handled differently, but seems to be possible - https://github.com/golang/go/issues/21105
I have modified https://github.com/elastic/apm-server/pull/8590 to use go-sysinfo for listing processes, so I believe point 1 is addressed now.
Update: after some initial testing, it appears that in Windows, a JVM that runs as the administrator can attach to JVM that is ran by other users, in which case the ability to run as a different user is not required.
One thing we did notice that is required is to identify when the JVM is ran by the non-console executable - javaw.exe and attach to such processes through the java.exe
With https://github.com/elastic/apm-server/pull/8803, the APM Server Java attacher code will always use the bundled attacher jar and invoke it with the current user.
The javaw.exe handling described above would be fixed through this same PR.
More testing shows that the same-user restriction for remote JVM attach is applicable in Windows as well after all. The former conclusion that this is not the case was apparently based on invalid testing.
So we will have to implement both proper tmp dir copying (probably per user temp dir discovery) and figure out how to run as a different user, if at all possible.
Following is the updated list of things required for full Windows support:
- [x] if the JVM is ran through
javaw.exe, don't use it but thejava.exeof the same JRE to run the attacher to attach to it - fixed through #8803 - [ ] figure out if and how external processes can be ran as a different user. https://github.com/golang/go/issues/21105 may be a good starting point
- [ ] investigate how to deal with file access. Hopefully we can apply a similar approach of relying on per-user temp directory, but it may mean we will need to find a way to discover the user's temp dir. Assuming we are on this step, we got a way to run as a different user (former bullet), in which case one option is to run
ECHO %Temp%as the target user and read the command output
Created a dedicated tracking issue for removing the technical blockers https://github.com/elastic/apm-server/issues/9186.
This issue should be kept open until the whole feature is implemented and tested.