You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2022/02/12 06:02:25 UTC
[ranger] branch ranger-2.3 updated: RANGER-3617: incorrect deny for _any access due to tag policy
This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch ranger-2.3
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.3 by this push:
new 70c614b RANGER-3617: incorrect deny for _any access due to tag policy
70c614b is described below
commit 70c614b1ab936e3f8d17d749b7ea78be499e58e4
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Thu Feb 10 15:23:09 2022 -0800
RANGER-3617: incorrect deny for _any access due to tag policy
(cherry picked from commit 9a2c732d6584802d30e7e847a1e6b8c4050e5652)
---
.../RangerDefaultPolicyEvaluator.java | 8 +-
.../plugin/policyengine/TestPolicyEngine.java | 7 ++
.../plugin/test_plugin_capability.json | 4 +-
.../test_policyengine_descendant_tags.json | 4 +-
.../test_policyengine_descendant_tags_deny.json | 107 +++++++++++++++++++++
.../test_policyengine_tag_hive_filebased.json | 2 +-
...t_policyengine_tag_hive_for_show_databases.json | 4 +-
7 files changed, 124 insertions(+), 12 deletions(-)
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
index 7e2dd7e..56c8ba2 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
@@ -30,7 +30,6 @@ import java.util.Map;
import java.util.Set;
import org.apache.commons.collections.CollectionUtils;
-import org.apache.commons.collections.MapUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.ranger.plugin.conditionevaluator.RangerAbstractConditionEvaluator;
import org.apache.ranger.plugin.conditionevaluator.RangerConditionEvaluator;
@@ -509,8 +508,7 @@ public class RangerDefaultPolicyEvaluator extends RangerAbstractPolicyEvaluator
LOG.debug("==> RangerDefaultPolicyEvaluator.updateAccessResult(" + result + ", " + matchType +", " + isAllowed + ", " + reason + ", " + getId() + ")");
}
if (!isAllowed) {
- RangerAccessResource resource = result.getAccessRequest().getResource();
- if (resource != null && MapUtils.isNotEmpty(resource.getAsMap())) {
+ if (matchType != RangerPolicyResourceMatcher.MatchType.DESCENDANT) {
result.setIsAllowed(false);
result.setPolicyPriority(getPolicyPriority());
result.setPolicyId(getId());
@@ -765,7 +763,7 @@ public class RangerDefaultPolicyEvaluator extends RangerAbstractPolicyEvaluator
if (accessResult != null) {
updateAccessResult(result, matchType, accessResult.equals(RangerPolicyEvaluator.ACCESS_ALLOWED), null);
} else if (getPolicy().getIsDenyAllElse()) {
- updateAccessResult(result, RangerPolicyResourceMatcher.MatchType.NONE, false, "matched deny-all-else policy");
+ updateAccessResult(result, matchType, false, "matched deny-all-else policy");
}
} else {
if (LOG.isDebugEnabled()) {
@@ -777,7 +775,7 @@ public class RangerDefaultPolicyEvaluator extends RangerAbstractPolicyEvaluator
if (matchedPolicyItem != null) {
matchedPolicyItem.updateAccessResult(this, result, matchType);
} else if (getPolicy().getIsDenyAllElse() && (getPolicy().getPolicyType() == null || getPolicy().getPolicyType() == RangerPolicy.POLICY_TYPE_ACCESS)) {
- updateAccessResult(result, RangerPolicyResourceMatcher.MatchType.NONE, false, "matched deny-all-else policy");
+ updateAccessResult(result, matchType, false, "matched deny-all-else policy");
}
}
diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java b/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
index 9ba418a..824516a 100644
--- a/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
+++ b/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
@@ -436,6 +436,13 @@ public class TestPolicyEngine {
runTestsFromResourceFiles(resourceFiles);
}
+ @Test
+ public void testPolicyEngine_descendantTagsDeny() {
+ String[] resourceFiles = {"/policyengine/test_policyengine_descendant_tags_deny.json"};
+
+ runTestsFromResourceFiles(resourceFiles);
+ }
+
@Test
public void testPolicyEngine_auditFilterHive() {
diff --git a/agents-common/src/test/resources/policyengine/plugin/test_plugin_capability.json b/agents-common/src/test/resources/policyengine/plugin/test_plugin_capability.json
index b968743..f503c23 100644
--- a/agents-common/src/test/resources/policyengine/plugin/test_plugin_capability.json
+++ b/agents-common/src/test/resources/policyengine/plugin/test_plugin_capability.json
@@ -21,14 +21,14 @@
{
"name": "Using all existing capabilities",
"myCapabilities": [],
- "otherCapabilities": ["RANGER_PLUGIN_CAPABILITY_TAG_POLICIES","RANGER_PLUGIN_CAPABILITY_MASKING_AND_ROW_FILTERING", "RANGER_PLUGIN_CAPABILITY_MACROS", "RANGER_PLUGIN_CAPABILITY_AUDIT_MODE", "RANGER_PLUGIN_CAPABILITY_RESOURCE_IS_VALID_LEAF", "RANGER_PLUGIN_CAPABILITY_VALIDITY_PERIOD", "RANGER_PLUGIN_CAPABILITY_POLICY_PRIORITY","RANGER_PLUGIN_CAPABILITY_SECURITY_ZONE","RANGER_PLUGIN_CAPABILITY_POLICY_LEVEL_CONDITION", "RANGER_PLUGIN_CAPABILITY_DENY_ALL_ELSE_POLICY","RANGER_PLUGIN_CAP [...]
+ "otherCapabilities": ["RANGER_PLUGIN_CAPABILITY_TAG_POLICIES","RANGER_PLUGIN_CAPABILITY_MASKING_AND_ROW_FILTERING", "RANGER_PLUGIN_CAPABILITY_MACROS", "RANGER_PLUGIN_CAPABILITY_AUDIT_MODE", "RANGER_PLUGIN_CAPABILITY_RESOURCE_IS_VALID_LEAF", "RANGER_PLUGIN_CAPABILITY_VALIDITY_PERIOD", "RANGER_PLUGIN_CAPABILITY_POLICY_PRIORITY","RANGER_PLUGIN_CAPABILITY_SECURITY_ZONE","RANGER_PLUGIN_CAPABILITY_POLICY_LEVEL_CONDITION", "RANGER_PLUGIN_CAPABILITY_DENY_ALL_ELSE_POLICY","RANGER_PLUGIN_CAP [...]
"difference": []
},
{
"name": "Using all existing capabilities, other has fewer",
"myCapabilities": [],
"otherCapabilities": ["RANGER_PLUGIN_CAPABILITY_ROLE_DOWNLOAD_TIMER","RANGER_PLUGIN_CAPABILITY_MASKING_AND_ROW_FILTERING", "RANGER_PLUGIN_CAPABILITY_MACROS", "RANGER_PLUGIN_CAPABILITY_AUDIT_MODE", "RANGER_PLUGIN_CAPABILITY_RESOURCE_IS_VALID_LEAF", "RANGER_PLUGIN_CAPABILITY_VALIDITY_PERIOD", "RANGER_PLUGIN_CAPABILITY_POLICY_PRIORITY","RANGER_PLUGIN_CAPABILITY_SECURITY_ZONE","RANGER_PLUGIN_CAPABILITY_POLICY_LEVEL_CONDITION", "RANGER_PLUGIN_CAPABILITY_DENY_ALL_ELSE_POLICY","RANGER_PLU [...]
- "difference": ["RANGER_PLUGIN_CAPABILITY_TAG_POLICIES", "RANGER_PLUGIN_CAPABILITY_AUDIT_EXCLUDED_USERS", "RANGER_PLUGIN_CAPABILITY_CHAINED_PLUGINS", "RANGER_PLUGIN_CAPABILITY_SUPERUSER_PERMISSIONS", "RANGER_PLUGIN_CAPABILITY_USERSTORE_DOWNLOAD", "RANGER_PLUGIN_CAPABILITY_AUDIT_POLICY"]
+ "difference": ["RANGER_PLUGIN_CAPABILITY_TAG_POLICIES", "RANGER_PLUGIN_CAPABILITY_AUDIT_EXCLUDED_USERS", "RANGER_PLUGIN_CAPABILITY_CHAINED_PLUGINS", "RANGER_PLUGIN_CAPABILITY_SUPERUSER_PERMISSIONS", "RANGER_PLUGIN_CAPABILITY_USERSTORE_DOWNLOAD", "RANGER_PLUGIN_CAPABILITY_AUDIT_POLICY", "RANGER_PLUGIN_CAPABILITY_UGT_ATTRIBUTES_IN_POLICY"]
}
]
}
\ No newline at end of file
diff --git a/agents-common/src/test/resources/policyengine/test_policyengine_descendant_tags.json b/agents-common/src/test/resources/policyengine/test_policyengine_descendant_tags.json
index 1b3fc04..7fa78ff 100644
--- a/agents-common/src/test/resources/policyengine/test_policyengine_descendant_tags.json
+++ b/agents-common/src/test/resources/policyengine/test_policyengine_descendant_tags.json
@@ -253,7 +253,7 @@
"resource":{"elements":{"database":"default"}},
"accessType":"","user":"hive","userGroups":[],"requestData":"'use default;' for hive"
},
- "result":{"isAudited":true,"isAllowed":false,"policyId":3}
+ "result":{"isAudited":true,"isAllowed":true,"policyId":2}
}
,
{
@@ -289,7 +289,7 @@
"resource":{"elements":{}},
"accessType":"","user":"hive","userGroups":[],"requestData":"'show databases;' for hive"
},
- "result":{"isAudited":true,"isAllowed":false,"policyId":3}
+ "result":{"isAudited":true,"isAllowed":true,"policyId":2}
}
]
}
diff --git a/agents-common/src/test/resources/policyengine/test_policyengine_descendant_tags_deny.json b/agents-common/src/test/resources/policyengine/test_policyengine_descendant_tags_deny.json
new file mode 100644
index 0000000..33270ed
--- /dev/null
+++ b/agents-common/src/test/resources/policyengine/test_policyengine_descendant_tags_deny.json
@@ -0,0 +1,107 @@
+{
+ "serviceName":"hivedev",
+
+ "serviceDef":{
+ "name":"hive",
+ "id":3,
+ "resources":[
+ {"name":"database","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Hive Database","description":"Hive Database"},
+ {"name":"table","level":2,"parent":"database","mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Hive Table","description":"Hive Table"},
+ {"name":"udf","level":2,"parent":"database","mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Hive UDF","description":"Hive UDF"},
+ {"name":"column","level":3,"parent":"table","mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Hive Column","description":"Hive Column"}
+ ],
+ "accessTypes":[
+ {"name":"select","label":"Select"},
+ {"name":"update","label":"Update"},
+ {"name":"create","label":"Create"},
+ {"name":"grant","label":"Grant"},
+ {"name":"drop","label":"Drop"},
+ {"name":"alter","label":"Alter"},
+ {"name":"index","label":"Index"},
+ {"name":"lock","label":"Lock"},
+ {"name":"all","label":"All", "impliedGrants": [ "select", "update", "create", "grant", "drop", "alter", "index", "lock" ] }
+ ]
+ },
+
+ "policies":[
+ {"id":101,"name":"db=*, table=*, column=*","isEnabled":true,"isAuditEnabled":true,
+ "resources":{"database":{"values":["*"]},"table":{"values":["*"]},"column":{"values":["*"]}},
+ "policyItems":[
+ {"accesses":[{"type":"select","isAllowed":true}],"users":["user1", "user2"],"groups":["public"],"delegateAdmin":false}
+ ]
+ }
+ ],
+ "tagPolicyInfo": {
+ "serviceName":"tagdev",
+ "serviceDef": {
+ "name": "tag",
+ "id": 100,
+ "resources": [
+ { "itemId": 1, "name": "tag", "type": "string", "level": 1, "parent": "", "mandatory": true, "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher", "matcherOptions": { "wildCard": true, "ignoreCase": false }, "label": "TAG", "description": "TAG" }
+ ],
+ "accessTypes": [
+ { "itemId": 1, "name": "hive:select", "label": "hive:select" },
+ { "itemId": 2, "name": "hive:update", "label": "hive:update" },
+ { "itemId": 3, "name": "hive:create", "label": "hive:create" } ,
+ { "itemId": 4, "name": "hive:grant", "label": "hive:grant" } ,
+ { "itemId": 5, "name": "hive:drop", "label": "hive:drop" } ,
+ { "itemId": 6, "name": "hive:alter", "label": "hive:alter" },
+ { "itemId": 7, "name": "hive:index", "label": "hive:index" },
+ { "itemId": 8, "name": "hive:lock", "label": "hive:lock" },
+ { "itemId": 9, "name": "hive:all", "label": "hive:all", "impliedGrants": [ "hive:select", "hive:update", "hive:create", "hive:grant", "hive:drop", "hive:alter", "hive:index", "hive:lock" ] }
+ ],
+ "contextEnrichers": [
+ {
+ "itemId": 1,
+ "name" : "TagEnricher",
+ "enricher" : "org.apache.ranger.plugin.contextenricher.RangerTagEnricher",
+ "enricherOptions" : {"tagRetrieverClassName":"org.apache.ranger.plugin.contextenricher.RangerFileBasedTagRetriever", "tagRefresherPollingInterval":60000, "serviceTagsFileName":"/policyengine/descendant_tags.json"}
+ }
+ ]
+ },
+ "tagPolicies":[
+ {"id":1,"name":"RESTRICTED","isEnabled":true,"isAuditEnabled":true,
+ "resources":{"tag":{"values":["RESTRICTED"],"isRecursive":false}},
+ "isDenyAllElse": false,
+ "policyItems":[
+ { "accesses":[{"type":"hive:select","isAllowed":true}],"users":["user1"],"groups":[],"delegateAdmin":false }
+ ],
+ "denyPolicyItems":[
+ { "accesses":[{"type":"hive:select","isAllowed":true}],"users":["user2"],"groups":[],"delegateAdmin":false }
+ ]
+ }
+ ]
+ },
+
+ "tests":[
+ {"name":"ALLOW 'select name from finance.tax_2016;' for user1",
+ "request":{
+ "resource":{"elements":{"database":"finance", "table":"tax_2016", "column":"name"}},
+ "accessType":"select","user":"user1","userGroups":[],"requestData":"select name from finance.tax_2016;' for user1"
+ },
+ "result":{"isAudited":true,"isAllowed":true,"policyId":1}
+ },
+ {"name":"DENY 'select name from finance.tax_2016;' for user2",
+ "request":{
+ "resource":{"elements":{"database":"finance", "table":"tax_2016", "column":"name"}},
+ "accessType":"select","user":"user2","userGroups":[],"requestData":"select name from finance.tax_2016;' for user2"
+ },
+ "result":{"isAudited":true,"isAllowed":false,"policyId":1}
+ },
+ {"name":"ALLOW 'show databases' for user1",
+ "request":{
+ "resource":{"elements":{}},
+ "accessType":"_any","user":"user1","userGroups":[],"requestData":"show databases;' for user1"
+ },
+ "result":{"isAudited":true,"isAllowed":true,"policyId":1}
+ },
+ {"name":"ALLOW 'use finance' for user2",
+ "request":{
+ "resource":{"elements":{"database": "finance"}},
+ "accessType":"_any","user":"user2","userGroups":[],"requestData":"use finance;' for user2"
+ },
+ "result":{"isAudited":true,"isAllowed":true,"policyId":101}
+ }
+ ]
+}
+
diff --git a/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_filebased.json b/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_filebased.json
index 7beb5ab..fad08e7 100644
--- a/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_filebased.json
+++ b/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_filebased.json
@@ -231,7 +231,7 @@
"accessType":"select","user":"user1","userGroups":[],"requestData":"select from employee.personal;' for user1"
},
- "result":{"isAudited":true,"isAllowed":false,"policyId":5}
+ "result":{"isAudited":true,"isAllowed":true,"policyId":101}
},
{"name":"ALLOW 'select ssn from employee.personal;' for user1 using EXPIRES_ON tag",
"request":{
diff --git a/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_for_show_databases.json b/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_for_show_databases.json
index 1686b1f..97f7c27 100644
--- a/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_for_show_databases.json
+++ b/agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_for_show_databases.json
@@ -179,7 +179,7 @@
"resource":{"elements":{}},
"accessType":"","user":"hive","userGroups":["public"],"requestData":"show databases for hive"
},
- "result":{"isAudited":true,"isAllowed":false,"policyId":1}
+ "result":{"isAudited":true,"isAllowed":true,"policyId":101}
}
,
{"name":"ALLOW 'use default;' for hive",
@@ -195,7 +195,7 @@
"resource":{"elements":{"database":"employee"}},
"accessType":"","user":"hive","userGroups":["public"],"requestData":"use employee for hive"
},
- "result":{"isAudited":true,"isAllowed":false,"policyId":1}
+ "result":{"isAudited":true,"isAllowed":true,"policyId":101}
}
,
{"name":"DENY 'select ssn from employee.personal;' for hive",