You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by rm...@apache.org on 2022/05/10 17:37:18 UTC
[ranger] branch ranger-2.3 updated: RANGER-3753: fix for masking and row-filter policies to recognize {OWNER} user
This is an automated email from the ASF dual-hosted git repository.
rmani pushed a commit to branch ranger-2.3
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.3 by this push:
new 9a2b9a0b8 RANGER-3753: fix for masking and row-filter policies to recognize {OWNER} user
9a2b9a0b8 is described below
commit 9a2b9a0b8db215a8a149372ae9334dc09284a62d
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Tue May 10 00:49:01 2022 -0700
RANGER-3753: fix for masking and row-filter policies to recognize {OWNER} user
Signed-off-by: Ramesh Mani <rm...@cloudera.com>
---
.../hive/authorizer/RangerHiveAuthorizer.java | 29 ++++++++++++++++------
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
index 2fd257722..86abdf7e6 100644
--- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
+++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
@@ -1230,6 +1230,8 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
}
if(CollectionUtils.isNotEmpty(hiveObjs)) {
+ IMetaStoreClient metaStoreClient = getMetaStoreClient();
+
for (HivePrivilegeObject hiveObj : hiveObjs) {
HivePrivilegeObjectType hiveObjType = hiveObj.getType();
@@ -1247,7 +1249,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
String database = hiveObj.getDbname();
String table = hiveObj.getObjectName();
- String rowFilterExpr = getRowFilterExpression(queryContext, database, table);
+ String rowFilterExpr = getRowFilterExpression(queryContext, hiveObj, metaStoreClient);
if (StringUtils.isNotBlank(rowFilterExpr)) {
if(LOG.isDebugEnabled()) {
@@ -1262,7 +1264,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
List<String> columnTransformers = new ArrayList<String>();
for (String column : hiveObj.getColumns()) {
- boolean isColumnTransformed = addCellValueTransformerAndCheckIfTransformed(queryContext, database, table, column, columnTransformers);
+ boolean isColumnTransformed = addCellValueTransformerAndCheckIfTransformed(queryContext, hiveObj, column, columnTransformers, metaStoreClient);
if(LOG.isDebugEnabled()) {
LOG.debug("addCellValueTransformerAndCheckIfTransformed(database=" + database + ", table=" + table + ", column=" + column + "): " + isColumnTransformed);
@@ -1331,13 +1333,16 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
return result != null && result.isRowFilterEnabled() && StringUtils.isNotEmpty(result.getFilterExpr());
}
- private String getRowFilterExpression(HiveAuthzContext context, String databaseName, String tableOrViewName) throws SemanticException {
+ private String getRowFilterExpression(HiveAuthzContext context, HivePrivilegeObject tableOrView, IMetaStoreClient metaStoreClient) throws SemanticException {
UserGroupInformation ugi = getCurrentUserGroupInfo();
if(ugi == null) {
throw new SemanticException("user information not available");
}
+ String databaseName = tableOrView.getDbname();
+ String tableOrViewName = tableOrView.getObjectName();
+
if(LOG.isDebugEnabled()) {
LOG.debug("==> getRowFilterExpression(" + databaseName + ", " + tableOrViewName + ")");
}
@@ -1353,9 +1358,11 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
Set<String> roles = getCurrentRolesForUser(user, groups);
HiveObjectType objectType = HiveObjectType.TABLE;
RangerHiveResource resource = new RangerHiveResource(objectType, databaseName, tableOrViewName);
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, objectType.name(), HiveAccessType.SELECT, context, sessionContext);
- RangerAccessResult result = hivePlugin.evalRowFilterPolicies(request, auditHandler);
+ setOwnerUser(resource, tableOrView, metaStoreClient);
+
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, objectType.name(), HiveAccessType.SELECT, context, sessionContext);
+ RangerAccessResult result = hivePlugin.evalRowFilterPolicies(request, auditHandler);
if(isRowFilterEnabled(result)) {
ret = result.getFilterExpr();
@@ -1371,13 +1378,17 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
return ret;
}
- private boolean addCellValueTransformerAndCheckIfTransformed(HiveAuthzContext context, String databaseName, String tableOrViewName, String columnName, List<String> columnTransformers) throws SemanticException {
+ private boolean addCellValueTransformerAndCheckIfTransformed(HiveAuthzContext context, HivePrivilegeObject tableOrView, String columnName, List<String> columnTransformers, IMetaStoreClient metaStoreClient) throws SemanticException {
UserGroupInformation ugi = getCurrentUserGroupInfo();
if(ugi == null) {
throw new SemanticException("user information not available");
}
+
+ String databaseName = tableOrView.getDbname();
+ String tableOrViewName = tableOrView.getObjectName();
+
if(LOG.isDebugEnabled()) {
LOG.debug("==> addCellValueTransformerAndCheckIfTransformed(" + databaseName + ", " + tableOrViewName + ", " + columnName + ")");
}
@@ -1394,9 +1405,11 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
Set<String> roles = getCurrentRolesForUser(user, groups);
HiveObjectType objectType = HiveObjectType.COLUMN;
RangerHiveResource resource = new RangerHiveResource(objectType, databaseName, tableOrViewName, columnName);
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, objectType.name(), HiveAccessType.SELECT, context, sessionContext);
- RangerAccessResult result = hivePlugin.evalDataMaskPolicies(request, auditHandler);
+ setOwnerUser(resource, tableOrView, metaStoreClient);
+
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, objectType.name(), HiveAccessType.SELECT, context, sessionContext);
+ RangerAccessResult result = hivePlugin.evalDataMaskPolicies(request, auditHandler);
ret = isDataMaskEnabled(result);