You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org> on 2025/04/23 19:47:29 UTC
[kudu-CR] [RANGER] KUDU-3661 Ranger policy not honored in Kudu
Abhishek Chennaka has uploaded this change for review. ( http://gerrit.cloudera.org:8080/22806
Change subject: [RANGER] KUDU-3661 Ranger policy not honored in Kudu
......................................................................
[RANGER] KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider where
we return prematurely from RangerAuthzProvider::FillTablePrivilegePB()
when the SELECT action is encountered while iterating through
an unordered_set<ActionPB, ActionHash> named actions, potentially resulting
in missing privileges depending on the position of the SELECT action in the set.
While this behavior depends on the libc++/libstdc++ implementation,
we have observed reports of this issue on RHEL/CentOS 8 machines.
Testing this is not straightforward, as the ordering of elements
in the unordered_set depends on the standard library implementation.
An existing test has been modified to also check for the UPDATE privilege,
in addition to the already present permissions (INSERT, DELETE, and UPDATE).
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
---
M src/kudu/master/ranger_authz_provider.cc
M src/kudu/ranger/ranger_client-test.cc
2 files changed, 6 insertions(+), 4 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/06/22806/1
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 1
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Alexey Serbin, Attila Bukor, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/22806
to look at the new patch set (#9).
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider
where we return prematurely from
RangerAuthzProvider::FillTablePrivilegePB() when the SELECT
action is encountered while iterating through
unordered_set<ActionPB, ActionHas> container, potentially
resulting in missing privileges depending on the position of the
SELECT action in the set. While this behavior depends on the
libc++/libstdc++ implementation, we have observed reports of this
issue on RHEL/CentOS 8 machines.
Thanks to Alexey Serbin for valuable inputs and contributions on
this fix.
Test case source: https://gerrit.cloudera.org/#/c/22809/
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
---
M src/kudu/integration-tests/ts_authz-itest.cc
M src/kudu/master/ranger_authz_provider.cc
2 files changed, 47 insertions(+), 6 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/06/22806/9
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Abhishek Chennaka has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 9: Verified+1
Unrelated test failures
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 21:58:22 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 8: Code-Review+1
(3 comments)
http://gerrit.cloudera.org:8080/#/c/22806/8/src/kudu/integration-tests/ts_authz-itest.cc
File src/kudu/integration-tests/ts_authz-itest.cc:
http://gerrit.cloudera.org:8080/#/c/22806/8/src/kudu/integration-tests/ts_authz-itest.cc@633
PS8, Line 633: for
nit: to
http://gerrit.cloudera.org:8080/#/c/22806/8/src/kudu/integration-tests/ts_authz-itest.cc@635
PS8, Line 635: cluster_));
nit for this and two other ASSERT_OK() lines below: wrong indent
http://gerrit.cloudera.org:8080/#/c/22806/8/src/kudu/integration-tests/ts_authz-itest.cc@641
PS8, Line 641: // Perform INSERT and UPDATE operations on the table.
Nit for this and other comments in this new test scenario: these don't have much value since they are just re-stating what's quite clear from the code itself. Meaningful comments tend to explain the reason behind a particular action, answering to 'why?' rather than 'what?' question (but the latter also happens if there is something non-obvious going on behind the scene).
If you are up to adding a few comments, please shed some light on the following:
* Why to have SELECT privilege granted to the user while not a single read/scan is performed?
* What part of the scenario fails if KUDU-3661 fix is absent?
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 18:27:26 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Alexey Serbin, Attila Bukor, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/22806
to look at the new patch set (#5).
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider
where we return prematurely from
RangerAuthzProvider::FillTablePrivilegePB() when the SELECT
action is encountered while iterating through
unordered_set<ActionPB, ActionHas> container, potentially
resulting in missing privileges depending on the position of the
SELECT action in the set. While this behavior depends on the
libc++/libstdc++ implementation, we have observed reports of this
issue on RHEL/CentOS 8 machines.
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
---
M src/kudu/master/ranger_authz_provider.cc
M src/kudu/ranger/ranger_client-test.cc
2 files changed, 29 insertions(+), 3 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/06/22806/5
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 5
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 4:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/1304/
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 4
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 23:04:46 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 6: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/1305/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 23:39:43 +0000
Gerrit-HasComments: No
[kudu-CR] [RANGER] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: [RANGER] KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 2:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/22806/2//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/22806/2//COMMIT_MSG@19
PS2, Line 19: Testing this is not straightforward
To me it looks quite straightforward. At least, with the following patch the issue is exposed as-is. Please add a similar test scenario (or this code as-is) -- it should be able to catch a regression in future, if any.
[ RUN ] RangerClientTest.FatFingerTypo
src/kudu/ranger/ranger_client-test.cc:364: Failure
Expected equality of these values:
2
actions.size()
Which is: 1
Google Test trace:
src/kudu/ranger/ranger_client-test.cc:350: CREATE
src/kudu/ranger/ranger_client-test.cc:364: Failure
Expected equality of these values:
2
actions.size()
Which is: 1
Google Test trace:
src/kudu/ranger/ranger_client-test.cc:350: ALTER
src/kudu/ranger/ranger_client-test.cc:364: Failure
Expected equality of these values:
2
actions.size()
Which is: 1
Google Test trace:
src/kudu/ranger/ranger_client-test.cc:350: DROP
I20250423 13:38:18.878540 4243 test_util.cc:183] -----------------------------------------------
I20250423 13:38:18.878605 4243 test_util.cc:184] Had failures, leaving test files at /tmp/kudutest-0/ranger_client-test.RangerClientTest.FatFingerTypo.1745440698874642-4243-0
[ FAILED ] RangerClientTest.FatFingerTypo (2 ms)
[----------] 1 test from RangerClientTest (2 ms total)
[----------] Global test environment tear-down
[==========] 1 test from 1 test suite ran. (2 ms total)
[ PASSED ] 0 tests.
[ FAILED ] 1 test, listed below:
[ FAILED ] RangerClientTest.FatFingerTypo
diff --git a/src/kudu/ranger/ranger_client-test.cc b/src/kudu/ranger/ranger_client-test.cc
index 62ee8027a..f141c87ea 100644
--- a/src/kudu/ranger/ranger_client-test.cc
+++ b/src/kudu/ranger/ranger_client-test.cc
@@ -340,6 +340,31 @@ TEST_F(RangerClientTest, TestAuthorizeActionsAllAuthorized) {
ASSERT_EQ(3, actions.size());
}
+TEST_F(RangerClientTest, FatFingerTypo) {
+ for (auto action : { ActionPB::DELETE,
+ ActionPB::INSERT,
+ ActionPB::UPDATE,
+ ActionPB::CREATE,
+ ActionPB::ALTER,
+ ActionPB::DROP }) {
+ SCOPED_TRACE(ActionPB_Name(action));
+ // Clear the mock response from prior iteration (if any).
+ next_response_->clear();
+
+ // Allow only SELECT and one of the other actions (but not ALL).
+ Allow("jdoe", action, "default", "foobar");
+ Allow("jdoe", ActionPB::SELECT, "default", "foobar");
+ unordered_set<ActionPB, ActionHash> actions = {
+ ActionPB::DELETE,
+ ActionPB::INSERT,
+ ActionPB::UPDATE,
+ ActionPB::SELECT
+ };
+ ASSERT_OK(client_.AuthorizeActions("jdoe", "default", "foobar", /*is_owner=*/false, &actions));
+ EXPECT_EQ(2, actions.size());
+ }
+}
+
TEST_F(RangerClientTest, TestInvalidJARFails) {
FLAGS_ranger_config_path = test_dir_;
FLAGS_ranger_jar_path = "/this/is/not/a/real/location/hopefully.jar";
http://gerrit.cloudera.org:8080/#/c/22806/2/src/kudu/master/ranger_authz_provider.cc
File src/kudu/master/ranger_authz_provider.cc:
http://gerrit.cloudera.org:8080/#/c/22806/2/src/kudu/master/ranger_authz_provider.cc@315
PS2, Line 315: if (pb->scan_privilege()) {
nit: add a comment to explain why the control returns out of the function here (it's something related to the comment in lines 319-320)?
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 2
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 20:42:41 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Abhishek Chennaka has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 5:
(3 comments)
http://gerrit.cloudera.org:8080/#/c/22806/3//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/22806/3//COMMIT_MSG@12
PS3, Line 12:
: unordered_set<ActionPB, ActionHas> container, pot
> unordered_set<ActionPB, ActionHas> container
Done
http://gerrit.cloudera.org:8080/#/c/22806/3/src/kudu/master/ranger_authz_provider.cc
File src/kudu/master/ranger_authz_provider.cc:
http://gerrit.cloudera.org:8080/#/c/22806/3/src/kudu/master/ranger_authz_provider.cc@315
PS3, Line 315: we can skip checking column-level privileges a
> It's vice-versa, actually, so that's why this early return. Maybe, replace
Done
http://gerrit.cloudera.org:8080/#/c/22806/3/src/kudu/ranger/ranger_client-test.cc
File src/kudu/ranger/ranger_client-test.cc:
http://gerrit.cloudera.org:8080/#/c/22806/3/src/kudu/ranger/ranger_client-test.cc@343
PS3, Line 343: KUDU3661Regre
> Maybe, rename this into KUDU3661 or something similar instead of fun-generi
Done
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 5
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 23:06:46 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 7:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/1308/
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 7
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 07:08:58 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Alexey Serbin, Attila Bukor, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/22806
to look at the new patch set (#8).
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider
where we return prematurely from
RangerAuthzProvider::FillTablePrivilegePB() when the SELECT
action is encountered while iterating through
unordered_set<ActionPB, ActionHas> container, potentially
resulting in missing privileges depending on the position of the
SELECT action in the set. While this behavior depends on the
libc++/libstdc++ implementation, we have observed reports of this
issue on RHEL/CentOS 8 machines.
Thanks to Alexey Serbin for valuable inputs and contributions on
this fix.
Test case source: https://gerrit.cloudera.org/#/c/22809/
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
---
M src/kudu/integration-tests/ts_authz-itest.cc
M src/kudu/master/ranger_authz_provider.cc
2 files changed, 47 insertions(+), 6 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/06/22806/8
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 8: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/1314/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 17:20:35 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 9: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/1315/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 19:47:14 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Alexey Serbin, Attila Bukor, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/22806
to look at the new patch set (#6).
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider
where we return prematurely from
RangerAuthzProvider::FillTablePrivilegePB() when the SELECT
action is encountered while iterating through
unordered_set<ActionPB, ActionHas> container, potentially
resulting in missing privileges depending on the position of the
SELECT action in the set. While this behavior depends on the
libc++/libstdc++ implementation, we have observed reports of this
issue on RHEL/CentOS 8 machines.
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
---
M src/kudu/master/ranger_authz_provider.cc
M src/kudu/ranger/ranger_client-test.cc
2 files changed, 30 insertions(+), 3 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/06/22806/6
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 6:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/22806/6/src/kudu/ranger/ranger_client-test.cc
File src/kudu/ranger/ranger_client-test.cc:
http://gerrit.cloudera.org:8080/#/c/22806/6/src/kudu/ranger/ranger_client-test.cc@359
PS6, Line 359: ActionPB::DELETE,
: ActionPB::INSERT,
: ActionPB::UPDATE,
: ActionPB::SELECT
Whoops, sorry. It's necessary to add ActionPB::CREATE, ActionPB::ALTER, ActionPB::DROP into the set.
With this, I'm not sure this is exposing the issue as reported by KUDU-3661. Sorry -- I need to re-evaluate the approach to the test scenario.
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 23:46:36 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 3:
(4 comments)
> Build Failed
>
> http://jenkins.kudu.apache.org/job/pre_commit/1303/ : FAILURE
IWYU isn't yet happy:
>>> Fixing #includes in '/home/jenkins-slave/workspace/build_and_test/src/kudu/ranger/ranger_client-test.cc'
@@ -18,6 +18,7 @@
#include "kudu/ranger/ranger_client.h"
#include <cstddef>
+#include <initializer_list>
#include <memory>
#include <string>
#include <unordered_map>
IWYU would have edited 1 files on your behalf.
make[3]: *** [CMakeFiles/iwyu] Error 1
http://gerrit.cloudera.org:8080/#/c/22806/2//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/22806/2//COMMIT_MSG@19
PS2, Line 19: Change-Id: I635132154d622eb41e993a0
> Ah okay, so basically the idea is to ensure 2 actions are present and we ar
Having just 2 allowed actions is the easiest way to expose that, yes. There could be a fuzzy-style w.r.t. the allowed actions which would expose the bug right away, but nobody added such one. So, adding a simplest scenario to expose this bug and protect against future regressions looks like a good enough approach to me in this context.
http://gerrit.cloudera.org:8080/#/c/22806/3//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/22806/3//COMMIT_MSG@12
PS3, Line 12: an
: unordered_set<ActionPB, ActionHash> named actions
unordered_set<ActionPB, ActionHas> container
http://gerrit.cloudera.org:8080/#/c/22806/3/src/kudu/master/ranger_authz_provider.cc
File src/kudu/master/ranger_authz_provider.cc:
http://gerrit.cloudera.org:8080/#/c/22806/3/src/kudu/master/ranger_authz_provider.cc@315
PS3, Line 315: we need to worry about column level privileges
It's vice-versa, actually, so that's why this early return. Maybe, replace the selected text with:
there isn't a need to check against column-level privileges
http://gerrit.cloudera.org:8080/#/c/22806/3/src/kudu/ranger/ranger_client-test.cc
File src/kudu/ranger/ranger_client-test.cc:
http://gerrit.cloudera.org:8080/#/c/22806/3/src/kudu/ranger/ranger_client-test.cc@343
PS3, Line 343: FatFingerTypo
Maybe, rename this into KUDU3661 or something similar instead of fun-generic FatFingerTypo.
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 3
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 22:54:39 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 7:
> Build Failed
>
> http://jenkins.kudu.apache.org/job/pre_commit/1308/ : FAILURE
Compilation error:
https://jenkins.kudu.apache.org/job/build_and_test/8191/console
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 7
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 16:36:47 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 7: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/1308/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 7
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 07:16:55 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Abhishek Chennaka has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 8: Verified+1
Unrelated test failures
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 17:41:39 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Abhishek Chennaka has removed a vote on this change.
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Removed Verified-1 by Kudu Jenkins (120)
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: deleteVote
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] [RANGER] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: [RANGER] KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 2:
(2 comments)
http://gerrit.cloudera.org:8080/#/c/22806/2//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/22806/2//COMMIT_MSG@7
PS2, Line 7: [RANGER]
nit: drop this since JIRA ID should be enough already?
http://gerrit.cloudera.org:8080/#/c/22806/2/src/kudu/master/ranger_authz_provider.cc
File src/kudu/master/ranger_authz_provider.cc:
http://gerrit.cloudera.org:8080/#/c/22806/2/src/kudu/master/ranger_authz_provider.cc@286
PS2, Line 286: unordered_set
BTW, using unordered_set here isn't a good idea from performance perspective. It's trivial thing to fix, but that should be handled in a separate changelist, of course.
Probably, we could take care of that after 1.18.0 is released.
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 2
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 20:50:16 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 9: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 19:43:52 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Abhishek Chennaka has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider
where we return prematurely from
RangerAuthzProvider::FillTablePrivilegePB() when the SELECT
action is encountered while iterating through
unordered_set<ActionPB, ActionHas> container, potentially
resulting in missing privileges depending on the position of the
SELECT action in the set. While this behavior depends on the
libc++/libstdc++ implementation, we have observed reports of this
issue on RHEL/CentOS 8 machines.
Thanks to Alexey Serbin for valuable inputs and contributions on
this fix.
Test case source: https://gerrit.cloudera.org/#/c/22809/
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Reviewed-on: http://gerrit.cloudera.org:8080/22806
Reviewed-by: Alexey Serbin <al...@apache.org>
Tested-by: Abhishek Chennaka <ac...@cloudera.com>
---
M src/kudu/integration-tests/ts_authz-itest.cc
M src/kudu/master/ranger_authz_provider.cc
2 files changed, 47 insertions(+), 6 deletions(-)
Approvals:
Alexey Serbin: Looks good to me, approved
Abhishek Chennaka: Verified
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 10
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] [RANGER] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: [RANGER] KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 1:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/1302/
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 1
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Wed, 23 Apr 2025 19:47:35 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Abhishek Chennaka has removed a vote on this change.
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Removed Verified-1 by Kudu Jenkins (120)
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: deleteVote
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Abhishek Chennaka has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 3:
(4 comments)
http://gerrit.cloudera.org:8080/#/c/22806/2//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/22806/2//COMMIT_MSG@7
PS2, Line 7: KUDU-3661
> nit: drop this since JIRA ID should be enough already?
Done
http://gerrit.cloudera.org:8080/#/c/22806/2//COMMIT_MSG@19
PS2, Line 19: Change-Id: I635132154d622eb41e993a0
> To me it looks quite straightforward. At least, with the following patch t
Ah okay, so basically the idea is to ensure 2 actions are present and we are not prematurely exiting where one actions is SELECT and the other is any available action.
Makes sense. Thanks Alexey
http://gerrit.cloudera.org:8080/#/c/22806/2/src/kudu/master/ranger_authz_provider.cc
File src/kudu/master/ranger_authz_provider.cc:
http://gerrit.cloudera.org:8080/#/c/22806/2/src/kudu/master/ranger_authz_provider.cc@286
PS2, Line 286: unordered_set
> BTW, using unordered_set here isn't a good idea from performance perspectiv
Yes, agreed.
http://gerrit.cloudera.org:8080/#/c/22806/2/src/kudu/master/ranger_authz_provider.cc@315
PS2, Line 315: // If select is allowed, we need to worry about column level privileges.
> nit: add a comment to explain why the control returns out of the function h
Done
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 3
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 21:23:22 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 3: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/1303/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 3
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 21:25:43 +0000
Gerrit-HasComments: No
[kudu-CR] [RANGER] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: [RANGER] KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 1: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/1302/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 1
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 20:52:11 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 6:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/22806/6/src/kudu/ranger/ranger_client-test.cc
File src/kudu/ranger/ranger_client-test.cc:
http://gerrit.cloudera.org:8080/#/c/22806/6/src/kudu/ranger/ranger_client-test.cc@359
PS6, Line 359: ActionPB::DELETE,
: ActionPB::INSERT,
: ActionPB::UPDATE,
: ActionPB::SELECT
> Whoops, sorry. It's necessary to add ActionPB::CREATE, ActionPB::ALTER, Act
After closer look, I figured that ranger authz provider isn't used in ranger_client-test.cc, so all those scenarios are irrelevant in this context. You'd need to modify something like ts_authz-test.cc and add a new test scenario there for involve the actual code of the provider where the bug is present.
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 00:58:09 +0000
Gerrit-HasComments: Yes
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 8:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/1314/
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 8
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 16:39:20 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Abhishek Chennaka has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 9:
(3 comments)
http://gerrit.cloudera.org:8080/#/c/22806/8/src/kudu/integration-tests/ts_authz-itest.cc
File src/kudu/integration-tests/ts_authz-itest.cc:
http://gerrit.cloudera.org:8080/#/c/22806/8/src/kudu/integration-tests/ts_authz-itest.cc@633
PS8, Line 633: Gra
> nit: to
Removed the comment.
http://gerrit.cloudera.org:8080/#/c/22806/8/src/kudu/integration-tests/ts_authz-itest.cc@635
PS8, Line 635: ASSERT_OK(h
> nit for this and two other ASSERT_OK() lines below: wrong indent
Done
http://gerrit.cloudera.org:8080/#/c/22806/8/src/kudu/integration-tests/ts_authz-itest.cc@641
PS8, Line 641: // from being granted.
> Nit for this and other comments in this new test scenario: these don't have
Done
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 19:15:22 +0000
Gerrit-HasComments: Yes
[kudu-CR] [RANGER] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Hello Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/22806
to look at the new patch set (#2).
Change subject: [RANGER] KUDU-3661 Ranger policy not honored in Kudu
......................................................................
[RANGER] KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider
where we return prematurely from
RangerAuthzProvider::FillTablePrivilegePB() when the SELECT
action is encountered while iterating through an
unordered_set<ActionPB, ActionHash> named actions, potentially
resulting in missing privileges depending on the position of the
SELECT action in the set. While this behavior depends on the
libc++/libstdc++ implementation, we have observed reports of this
issue on RHEL/CentOS 8 machines.
Testing this is not straightforward, as the ordering of elements in
the unordered_set depends on the standard library implementation.
An existing test has been modified to also check for the UPDATE
privilege, in addition to the already present permissions (INSERT,
DELETE, and UPDATE).
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
---
M src/kudu/master/ranger_authz_provider.cc
M src/kudu/ranger/ranger_client-test.cc
2 files changed, 6 insertions(+), 4 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/06/22806/2
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 2
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Kudu Jenkins (120)
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Alexey Serbin, Attila Bukor, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/22806
to look at the new patch set (#3).
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider
where we return prematurely from
RangerAuthzProvider::FillTablePrivilegePB() when the SELECT
action is encountered while iterating through an
unordered_set<ActionPB, ActionHash> named actions, potentially
resulting in missing privileges depending on the position of the
SELECT action in the set. While this behavior depends on the
libc++/libstdc++ implementation, we have observed reports of this
issue on RHEL/CentOS 8 machines.
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
---
M src/kudu/master/ranger_authz_provider.cc
M src/kudu/ranger/ranger_client-test.cc
2 files changed, 29 insertions(+), 3 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/06/22806/3
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 3
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 3:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/1303/
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 3
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 21:23:01 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Alexey Serbin, Attila Bukor, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/22806
to look at the new patch set (#4).
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider
where we return prematurely from
RangerAuthzProvider::FillTablePrivilegePB() when the SELECT
action is encountered while iterating through an
unordered_set<ActionPB, ActionHash> named actions, potentially
resulting in missing privileges depending on the position of the
SELECT action in the set. While this behavior depends on the
libc++/libstdc++ implementation, we have observed reports of this
issue on RHEL/CentOS 8 machines.
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
---
M src/kudu/master/ranger_authz_provider.cc
M src/kudu/ranger/ranger_client-test.cc
2 files changed, 29 insertions(+), 3 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/06/22806/4
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 4
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 4: Verified-1
Build Failed
http://jenkins.kudu.apache.org/job/pre_commit/1304/ : FAILURE
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 4
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 23:07:28 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 6:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/1305/
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 23:08:16 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 6:
> Build Failed
>
> http://jenkins.kudu.apache.org/job/pre_commit/1305/ : FAILURE
For some reason, I see the newly added test failing. I'm not sure whether that's something I did wrong, or the fix isn't working as expected. Could you please take a look?
[ RUN ] RangerClientTest.KUDU3661Regression
/home/jenkins-slave/workspace/build_and_test/src/kudu/ranger/ranger_client-test.cc:365: Failure
Expected equality of these values:
2
actions.size()
Which is: 1
Google Test trace:
/home/jenkins-slave/workspace/build_and_test/src/kudu/ranger/ranger_client-test.cc:351: CREATE
/home/jenkins-slave/workspace/build_and_test/src/kudu/ranger/ranger_client-test.cc:365: Failure
Expected equality of these values:
2
actions.size()
Which is: 1
Google Test trace:
/home/jenkins-slave/workspace/build_and_test/src/kudu/ranger/ranger_client-test.cc:351: ALTER
/home/jenkins-slave/workspace/build_and_test/src/kudu/ranger/ranger_client-test.cc:365: Failure
Expected equality of these values:
2
actions.size()
Which is: 1
Google Test trace:
/home/jenkins-slave/workspace/build_and_test/src/kudu/ranger/ranger_client-test.cc:351: DROP
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 6
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Wed, 23 Apr 2025 23:41:37 +0000
Gerrit-HasComments: No
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Abhishek Chennaka (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Alexey Serbin, Attila Bukor, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/22806
to look at the new patch set (#7).
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
KUDU-3661 Ranger policy not honored in Kudu
This fixes a long-standing bug in the Ranger authorization provider
where we return prematurely from
RangerAuthzProvider::FillTablePrivilegePB() when the SELECT
action is encountered while iterating through
unordered_set<ActionPB, ActionHas> container, potentially
resulting in missing privileges depending on the position of the
SELECT action in the set. While this behavior depends on the
libc++/libstdc++ implementation, we have observed reports of this
issue on RHEL/CentOS 8 machines.
Thanks to Alexey Serbin for valuable inputs and contributions on
this fix.
Test case source: https://gerrit.cloudera.org/#/c/22809/
Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
---
M src/kudu/integration-tests/ts_authz-itest.cc
M src/kudu/master/ranger_authz_provider.cc
2 files changed, 47 insertions(+), 6 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/06/22806/7
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 7
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] KUDU-3661 Ranger policy not honored in Kudu
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/22806 )
Change subject: KUDU-3661 Ranger policy not honored in Kudu
......................................................................
Patch Set 9:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/1315/
--
To view, visit http://gerrit.cloudera.org:8080/22806
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I635132154d622eb41e993a0a1a818b21b5af6bb7
Gerrit-Change-Number: 22806
Gerrit-PatchSet: 9
Gerrit-Owner: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Abhishek Chennaka <ac...@cloudera.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Attila Bukor <ab...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Thu, 24 Apr 2025 19:14:55 +0000
Gerrit-HasComments: No