You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by rm...@apache.org on 2020/12/01 02:20:10 UTC
[ranger] branch master updated: RANGER-3094:Ranger HDFS audit not
capturing the correct path for write rename operations
This is an automated email from the ASF dual-hosted git repository.
rmani pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 2030167 RANGER-3094:Ranger HDFS audit not capturing the correct path for write rename operations
2030167 is described below
commit 2030167bfbf4e7241d199fdd353437f5c312d9db
Author: Ramesh Mani <rm...@cloudera.com>
AuthorDate: Mon Nov 30 16:32:57 2020 -0800
RANGER-3094:Ranger HDFS audit not capturing the correct path for write rename operations
---
.../org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java b/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java
index 44fec7b..347abe7 100644
--- a/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java
+++ b/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java
@@ -279,6 +279,7 @@ public class RangerHdfsAuthorizer extends INodeAttributeProvider {
INode ancestor = null;
INode parent = null;
INode inode = null;
+ String providedPath = path;
boolean useDefaultAuthorizerOnly = false;
boolean doNotGenerateAuditRecord = false;
@@ -349,7 +350,7 @@ public class RangerHdfsAuthorizer extends INodeAttributeProvider {
parent = inodes.length > 1 ? inodes[inodes.length - 2] : null;
inode = inodes[inodes.length - 1]; // could be null while creating a new file
- auditHandler = doNotGenerateAuditRecord ? null : new RangerHdfsAuditHandler(resourcePath, isTraverseOnlyCheck, rangerPlugin.getHadoopModuleName(), rangerPlugin.getExcludedUsers(), operationName, callerctxt);
+ auditHandler = doNotGenerateAuditRecord ? null : new RangerHdfsAuditHandler(providedPath, isTraverseOnlyCheck, rangerPlugin.getHadoopModuleName(), rangerPlugin.getExcludedUsers(), operationName, callerctxt);
/* Hadoop versions prior to 2.8.0 didn't ask for authorization of parent/ancestor traversal for
* reading or writing a file. However, Hadoop version 2.8.0 and later ask traversal authorization for