You are viewing a plain text version of this content. The canonical link for it is here.

Posted to reviews@impala.apache.org by "Fang-Yu Rao (Code Review)" <ge...@cloudera.org> on 2020/06/07 22:07:06 UTC

[Impala-ASF-CR] IMPALA-9341: Set delegateAdmin to false for REVOKE without GRANT OPTION

Fang-Yu Rao has uploaded this change for review. ( http://gerrit.cloudera.org:8080/16046


Change subject: IMPALA-9341: Set delegateAdmin to false for REVOKE without GRANT OPTION
......................................................................

IMPALA-9341: Set delegateAdmin to false for REVOKE without GRANT OPTION

When executing a GRANT or REVOKE statement with Ranger being the
authorization provider, Impala has to prepare a GrantRevokeRequest to
allow Ranger to add/delete the corresponding RangerPolicy or modify the
existing RangerPolicyItem's in the related RangerPolicy. One of the
fields that has to be set in a GrantRevokeRequest is delegateAdmin,
which dictates whether the grantee is allowed to transfer the privilege
on the resource to other principals. Specifically, the field
of delegateAdmin in the updated RangerPolicyItem corresponding to the
grantee would be set to the value of delegateAdmin in the
GrantRevokeRequest prepared by Impala.

Before this patch, when executing a REVOKE statement without the GRANT
OPTION, Impala would set delegateAdmin in the GrantRevokeRequest to
true. This is fine if the privilege to be revoked is the only privilege
that was previously granted to the grantee. However, in the case when
the privilege to be revoked was not granted and there is a
RangerPolicyItem with respect to the other privilege on the same
resource, the grantee actually obtains the permission to transfer the
non-matching privilege afterwards. The root cause of this issue is that
the privileges on the same resource share the same field of
delegateAdmin in the corresponding RangerPolicyItem, a current
limitation of Ranger. In this regard, as a workaround, we set
delegateAdmin in the GrantRevokeRequest to false for a REVOKE statement
without the GRANT OPTION.

We would like to point out that there is a limitation of this
workaround. More precisely, in the case when the grantee was permitted
to transfer the non-matching privilege, setting delegateAdmin to false
in the GrantRevokeRequest would deprive the grantee of the permission
that should not have been revoked, making it a bit inconvenient for both
the administrator and the grantee since the permission to transfer the
non-matching privilege should be restored afterwards if necessary.

An alternative approach is for Impala to always check the current
delegateAdmin value when performing a REVOKE statement without the GRANT
OPTION. Specifically, we could resolve this problem by 1) checking
whether or not there exists a RangerPolicyItem with respect to the same
resource and the grantee such that the delegateAdmin field is set to
true and 2) setting up the delegateAdmin field in the GrantRevokeRequest
accordingly. This alternative, however, suffers from the drawback that
additional logic has to be added to iterate over the RangerPolicy's
for the resource in the query, slowing down the query execution.
Therefore, we decide to choose the approach proposed in this patch over
the alternative that is less efficient.

Testing:
- Revised a test case in test_ranger.py to reflect the behavior change
  of Impala when a REVOKE statement without the GRANT OPTION is
  executed.
- Verified that this patch passed the exhaustive tests in the DEBUG
  build.

Change-Id: I19ff45a5a30293e9c6cf35b22ea4aa5cb10355c9
---
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M tests/authorization/test_ranger.py
2 files changed, 7 insertions(+), 3 deletions(-)



  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/46/16046/1
-- 
To view, visit http://gerrit.cloudera.org:8080/16046
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I19ff45a5a30293e9c6cf35b22ea4aa5cb10355c9
Gerrit-Change-Number: 16046
Gerrit-PatchSet: 1
Gerrit-Owner: Fang-Yu Rao <fa...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Fang-Yu Rao <fa...@cloudera.com>
Gerrit-Reviewer: Quanlong Huang <hu...@gmail.com>