[ranger] branch master updated: RANGER-3754: Chained plugins access evaluation result is not considered in some cases

[ab...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

abhay pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git


The following commit(s) were added to refs/heads/master by this push:
     new f375e3606 RANGER-3754: Chained plugins access evaluation result is not considered in some cases
f375e3606 is described below

commit f375e3606226e00677a95f9260e2a6e5cbc09983
Author: Abhay Kulkarni <ab...@apache.org>
AuthorDate: Thu May 12 10:41:09 2022 -0700

    RANGER-3754: Chained plugins access evaluation result is not considered in some cases
---
 .../java/org/apache/ranger/plugin/service/RangerBasePlugin.java   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java b/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java
index f157475bf..b474de31c 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java
@@ -1156,12 +1156,12 @@ public class RangerBasePlugin {
 		int     policyType     = result.getPolicyType();
 
 		if (chainedResult.getIsAccessDetermined()) { // only if chained-result is definitive
-			// override if result is not definitive or chained-result is by a higher priority policy
-			overrideResult = !result.getIsAccessDetermined() || chainedResult.getPolicyPriority() > result.getPolicyPriority();
+			// override if chained-result is by a higher priority policy or result is not definitive or the result is not-allowed and no matching Ranger policy found
+			overrideResult = chainedResult.getPolicyPriority() > result.getPolicyPriority() || !result.getIsAccessDetermined() || (!result.getIsAllowed() && result.getPolicyId() == -1L);
 
 			if (!overrideResult) {
-				// override if chained-result is from the same policy priority, and if denies access
-				if (chainedResult.getPolicyPriority() == result.getPolicyPriority() && !chainedResult.getIsAllowed()) {
+				// override if chained-result is from the same policy priority, and if denies access with a specific policy id
+				if (chainedResult.getPolicyPriority() == result.getPolicyPriority() && (!chainedResult.getIsAllowed() && chainedResult.getPolicyId() != -1L)) {
 					// let's not override if result is already denied
 					if (result.getIsAllowed()) {
 						overrideResult = true;