[jira] [Created] (RANGER-3921) User with DROP ACL on "db=dummy; table=*; column=*" can do drop table.

["kirby zhou (Jira)" <ji...@apache.org>]

kirby zhou created RANGER-3921:
----------------------------------

             Summary: User with DROP ACL on "db=dummy; table=*; column=*" can do drop table.
                 Key: RANGER-3921
                 URL: https://issues.apache.org/jira/browse/RANGER-3921
             Project: Ranger
          Issue Type: Bug
          Components: plugins
    Affects Versions: 2.3.0, 3.0.0, 2.4.0
            Reporter: kirby zhou


In agents-common/src/test/resources/policyengine/test_policyengine_hive.json,

we have hive policy:
{code:java}
{"id":8,"name":"db=dummy; table=*; column=*","isEnabled":true,"isAuditEnabled":true,
"resources":{"database":{"values":["dummy"]},"table":{"values":["*"]},"column":{"values":["*"]}},
"policyItems":[
{"accesses":[{"type":"create","isAllowed":true},{"type":"update","isAllowed":true},{"type":"drop","isAllowed":true}],"users":["user1","user2"],"groups":[],"delegateAdmin":false}
],
"allowExceptions":[
{"accesses":[{"type":"create","isAllowed":true}, {"type":"update","isAllowed":true}],"users":["user1"],"groups":[],"delegateAdmin":false},
{"accesses":[{"type":"create","isAllowed":true}, {"type":"update","isAllowed":true},{"type":"drop","isAllowed":true}],"users":["user2"],"groups":[],"delegateAdmin":false}
]
} {code}
According to the general understanding, this is given the permission of column level, rather than the permission of table level or database level.

 

But these 2 new test case can pass:
{code:java}
{"name":"ALLOW 'drop dummy/*;' for user1",
  "request":{
    "resource":{"elements":{"database":"dummy", "table": "dummy"}},
    "accessType":"drop","user":"user1","userGroups":["users"],"requestData":"drop dummy/dummy for user1"
  },
  "result":{"isAudited":true,"isAllowed":true,"policyId":8}
}
,
{"name":"ALLOW 'drop dummy;' for user1",
  "request":{
    "resource":{"elements":{"database":"dummy"}},
    "accessType":"drop","user":"user1","userGroups":["users"],"requestData":"drop dummy for user1"
  },
  "result":{"isAudited":true,"isAllowed":true,"policyId":8}
}
 {code}
 

This doesn't seem reasonable.

Or can someone tell me how to only give users column-level permissions without involving table or database?

 

 

 

 

 

 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)