You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Alok Lal <al...@hortonworks.com> on 2015/06/06 01:28:11 UTC
Review Request 35162: RANGER-533: Hbase plugin: if user does not have
family-level access to any family in a table then user may be
incorrectly
denied access done at table/family level during get or scan. Scan/get done
at column level is working correctly,
so are other operations like put and delete.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/35162/
-----------------------------------------------------------
Review request for ranger and Madhan Neethiraj.
Bugs: RANGER-533
https://issues.apache.org/jira/browse/RANGER-533
Repository: ranger
Description
-------
- Changed code for filter and authorizer.
- Added misc logging to some classes for ease of debuggin
Diffs
-----
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java cea3e05
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/AuthorizationSession.java e0b652e
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/HbaseAuditHandlerImpl.java e383614
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java abf8a33
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilter.java ae61a1e
hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilterTest.java 4b49721
Diff: https://reviews.apache.org/r/35162/diff/
Testing
-------
Testing scenario laid out in the apache JIRA.
Thanks,
Alok Lal
Re: Review Request 35162: RANGER-533: Hbase plugin: if user does not
have
family-level access to any family in a table then user may be incorrectly
denied access done at table/family level during get or scan. Scan/get done
at column level is working correctly,
so are other operations like put and delete.
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/35162/#review86907
-----------------------------------------------------------
Ship it!
Ship It!
- Madhan Neethiraj
On June 6, 2015, 7:37 a.m., Alok Lal wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/35162/
> -----------------------------------------------------------
>
> (Updated June 6, 2015, 7:37 a.m.)
>
>
> Review request for ranger and Madhan Neethiraj.
>
>
> Bugs: RANGER-533
> https://issues.apache.org/jira/browse/RANGER-533
>
>
> Repository: ranger
>
>
> Description
> -------
>
> - Changed code for filter and authorizer.
> - Added misc logging to some classes for ease of debuggin
>
>
> Diffs
> -----
>
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java abf8a33
>
> Diff: https://reviews.apache.org/r/35162/diff/
>
>
> Testing
> -------
>
> Testing scenario laid out in the apache JIRA.
>
>
> Thanks,
>
> Alok Lal
>
>
Re: Review Request 35162: RANGER-533: Hbase plugin: if user does not
have
family-level access to any family in a table then user may be incorrectly
denied access done at table/family level during get or scan. Scan/get done
at column level is working correctly,
so are other operations like put and delete.
Posted by Alok Lal <al...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/35162/
-----------------------------------------------------------
(Updated June 6, 2015, 12:37 a.m.)
Review request for ranger and Madhan Neethiraj.
Changes
-------
Fixed the bug introduced due to refactoring of how audit is recorded reported in last rework comment.
Bugs: RANGER-533
https://issues.apache.org/jira/browse/RANGER-533
Repository: ranger
Description
-------
- Changed code for filter and authorizer.
- Added misc logging to some classes for ease of debuggin
Diffs (updated)
-----
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java abf8a33
Diff: https://reviews.apache.org/r/35162/diff/
Testing
-------
Testing scenario laid out in the apache JIRA.
Thanks,
Alok Lal
Re: Review Request 35162: RANGER-533: Hbase plugin: if user does not
have
family-level access to any family in a table then user may be incorrectly
denied access done at table/family level during get or scan. Scan/get done
at column level is working correctly,
so are other operations like put and delete.
Posted by Alok Lal <al...@hortonworks.com>.
> On June 5, 2015, 10:07 p.m., Madhan Neethiraj wrote:
> > hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilter.java, line 91
> > <https://reviews.apache.org/r/35162/diff/2/?file=980353#file980353line91>
> >
> > When the user has family level access, I think we still have to audit the access to each column. Please make sure that this is done.
Those for which we know access for certain would have already been logged in the pre-hook. Only those for which audit is ascertained in filter would be logged here.
- Alok
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/35162/#review86901
-----------------------------------------------------------
On June 6, 2015, 12:37 a.m., Alok Lal wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/35162/
> -----------------------------------------------------------
>
> (Updated June 6, 2015, 12:37 a.m.)
>
>
> Review request for ranger and Madhan Neethiraj.
>
>
> Bugs: RANGER-533
> https://issues.apache.org/jira/browse/RANGER-533
>
>
> Repository: ranger
>
>
> Description
> -------
>
> - Changed code for filter and authorizer.
> - Added misc logging to some classes for ease of debuggin
>
>
> Diffs
> -----
>
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java abf8a33
>
> Diff: https://reviews.apache.org/r/35162/diff/
>
>
> Testing
> -------
>
> Testing scenario laid out in the apache JIRA.
>
>
> Thanks,
>
> Alok Lal
>
>
Re: Review Request 35162: RANGER-533: Hbase plugin: if user does not
have
family-level access to any family in a table then user may be incorrectly
denied access done at table/family level during get or scan. Scan/get done
at column level is working correctly,
so are other operations like put and delete.
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/35162/#review86901
-----------------------------------------------------------
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
<https://reviews.apache.org/r/35162/#comment139062>
discardAuditEvent is outside the following loop. Earlier, discardMostRecentEvent() was called within the loop multiple times. Can you please make sure that after this refactoring, the audit-events list remains the same.
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilter.java
<https://reviews.apache.org/r/35162/#comment139063>
The code is much easier to read. Thanks!
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilter.java
<https://reviews.apache.org/r/35162/#comment139064>
When the user has family level access, I think we still have to audit the access to each column. Please make sure that this is done.
- Madhan Neethiraj
On June 6, 2015, 3:36 a.m., Alok Lal wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/35162/
> -----------------------------------------------------------
>
> (Updated June 6, 2015, 3:36 a.m.)
>
>
> Review request for ranger and Madhan Neethiraj.
>
>
> Bugs: RANGER-533
> https://issues.apache.org/jira/browse/RANGER-533
>
>
> Repository: ranger
>
>
> Description
> -------
>
> - Changed code for filter and authorizer.
> - Added misc logging to some classes for ease of debuggin
>
>
> Diffs
> -----
>
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/AuthorizationSession.java e0b652e
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/HbaseAuditHandler.java bbff6df
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/HbaseAuditHandlerImpl.java e383614
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java abf8a33
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilter.java ae61a1e
>
> Diff: https://reviews.apache.org/r/35162/diff/
>
>
> Testing
> -------
>
> Testing scenario laid out in the apache JIRA.
>
>
> Thanks,
>
> Alok Lal
>
>
Re: Review Request 35162: RANGER-533: Hbase plugin: if user does not
have
family-level access to any family in a table then user may be incorrectly
denied access done at table/family level during get or scan. Scan/get done
at column level is working correctly,
so are other operations like put and delete.
Posted by Alok Lal <al...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/35162/
-----------------------------------------------------------
(Updated June 5, 2015, 8:36 p.m.)
Review request for ranger and Madhan Neethiraj.
Changes
-------
Rework comments addressed:
- move access type changes to one place
- changed filter to have single return
- abstracted audit handling in authorizer and filter out of main loop/processing.
Bugs: RANGER-533
https://issues.apache.org/jira/browse/RANGER-533
Repository: ranger
Description
-------
- Changed code for filter and authorizer.
- Added misc logging to some classes for ease of debuggin
Diffs (updated)
-----
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/AuthorizationSession.java e0b652e
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/HbaseAuditHandler.java bbff6df
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/HbaseAuditHandlerImpl.java e383614
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java abf8a33
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilter.java ae61a1e
Diff: https://reviews.apache.org/r/35162/diff/
Testing
-------
Testing scenario laid out in the apache JIRA.
Thanks,
Alok Lal
Re: Review Request 35162: RANGER-533: Hbase plugin: if user does not
have
family-level access to any family in a table then user may be incorrectly
denied access done at table/family level during get or scan. Scan/get done
at column level is working correctly,
so are other operations like put and delete.
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/35162/#review86881
-----------------------------------------------------------
Ship it!
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
<https://reviews.apache.org/r/35162/#comment139022>
should access be reset here as well?
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilter.java
<https://reviews.apache.org/r/35162/#comment139023>
make sure that access is set correctly by the time this code is executed.
- Madhan Neethiraj
On June 5, 2015, 11:28 p.m., Alok Lal wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/35162/
> -----------------------------------------------------------
>
> (Updated June 5, 2015, 11:28 p.m.)
>
>
> Review request for ranger and Madhan Neethiraj.
>
>
> Bugs: RANGER-533
> https://issues.apache.org/jira/browse/RANGER-533
>
>
> Repository: ranger
>
>
> Description
> -------
>
> - Changed code for filter and authorizer.
> - Added misc logging to some classes for ease of debuggin
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java cea3e05
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/AuthorizationSession.java e0b652e
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/HbaseAuditHandlerImpl.java e383614
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java abf8a33
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilter.java ae61a1e
> hbase-agent/src/test/java/org/apache/ranger/authorization/hbase/RangerAuthorizationFilterTest.java 4b49721
>
> Diff: https://reviews.apache.org/r/35162/diff/
>
>
> Testing
> -------
>
> Testing scenario laid out in the apache JIRA.
>
>
> Thanks,
>
> Alok Lal
>
>