You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Abhay Kulkarni <ak...@hortonworks.com> on 2016/11/06 19:51:31 UTC
Re: Review Request 53445: If the access-resource is empty then
short-circuit
matching of service-resources to get matching tags because all tags
downloaded to plugin match the empty access-resource
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/53445/
-----------------------------------------------------------
(Updated Nov. 6, 2016, 7:51 p.m.)
Review request for ranger and Madhan Neethiraj.
Changes
-------
Optimize tag enricher for requests containing empty resource
Bugs: RANGER-1208
https://issues.apache.org/jira/browse/RANGER-1208
Repository: ranger
Description
-------
A hive request to 'show databases' first checks if the requesting user has any access to any resource in the system by specifying empty resource as the resource being accessed by the user. In presence of tag-policies, policy evaluation first figures out matching tags and then evaluates all matching tags. The computation of matching tags can be inefficient as its time increases linearly with the number of tagged resources in the component. This step can be made efficient by recognizing that an empty resource matches all resources, and therefore all tags in the component, thus bypassing tag matching computation completely.
Diffs (updated)
-----
agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java 2a0896d
agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptExecutionContext.java 1428454
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java 62e7c99
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagForEval.java 014686d
agents-common/src/main/java/org/apache/ranger/plugin/model/RangerTag.java f19cc60
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java 6a9fc18
agents-common/src/main/java/org/apache/ranger/plugin/util/RangerAccessRequestUtil.java a46d975
agents-common/src/test/java/org/apache/ranger/plugin/contextenricher/TestTagEnricher.java 3454c30
agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java 71e2eb6
agents-common/src/test/resources/contextenricher/test_tagenricher_hive.json 9fba96b
agents-common/src/test/resources/policyengine/descendant_tags.json 101ae26
agents-common/src/test/resources/policyengine/test_policyengine_descendant_tags.json 831342f
security-admin/src/main/resources/META-INF/jpa_named_queries.xml fe9d91a
Diff: https://reviews.apache.org/r/53445/diff/
Testing
-------
Tested with local VM.
Thanks,
Abhay Kulkarni
Re: Review Request 53445: If the access-resource is empty then
short-circuit
matching of service-resources to get matching tags because all tags
downloaded to plugin match the empty access-resource
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/53445/#review155095
-----------------------------------------------------------
Ship it!
Ship It!
- Madhan Neethiraj
On Nov. 6, 2016, 7:51 p.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/53445/
> -----------------------------------------------------------
>
> (Updated Nov. 6, 2016, 7:51 p.m.)
>
>
> Review request for ranger and Madhan Neethiraj.
>
>
> Bugs: RANGER-1208
> https://issues.apache.org/jira/browse/RANGER-1208
>
>
> Repository: ranger
>
>
> Description
> -------
>
> A hive request to 'show databases' first checks if the requesting user has any access to any resource in the system by specifying empty resource as the resource being accessed by the user. In presence of tag-policies, policy evaluation first figures out matching tags and then evaluates all matching tags. The computation of matching tags can be inefficient as its time increases linearly with the number of tagged resources in the component. This step can be made efficient by recognizing that an empty resource matches all resources, and therefore all tags in the component, thus bypassing tag matching computation completely.
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java 2a0896d
> agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptExecutionContext.java 1428454
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java 62e7c99
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagForEval.java 014686d
> agents-common/src/main/java/org/apache/ranger/plugin/model/RangerTag.java f19cc60
> agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java 6a9fc18
> agents-common/src/main/java/org/apache/ranger/plugin/util/RangerAccessRequestUtil.java a46d975
> agents-common/src/test/java/org/apache/ranger/plugin/contextenricher/TestTagEnricher.java 3454c30
> agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java 71e2eb6
> agents-common/src/test/resources/contextenricher/test_tagenricher_hive.json 9fba96b
> agents-common/src/test/resources/policyengine/descendant_tags.json 101ae26
> agents-common/src/test/resources/policyengine/test_policyengine_descendant_tags.json 831342f
> security-admin/src/main/resources/META-INF/jpa_named_queries.xml fe9d91a
>
> Diff: https://reviews.apache.org/r/53445/diff/
>
>
> Testing
> -------
>
> Tested with local VM.
>
>
> Thanks,
>
> Abhay Kulkarni
>
>