This is an automated email from the ASF dual-hosted git repository.
maheshbandal15 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 5f88104f3 RANGER-5797: Improve policy evaluation logic for _any access
type and priority handling (#1234)
5f88104f3 is described below
commit 5f88104f31cfa2477096f1341094f9ca1b8760b2
Author: Mahesh Bandal <[email protected]>
AuthorDate: Fri Sep 25 23:00:10 2026 +0530
RANGER-5797: Improve policy evaluation logic for _any access type and
priority handling (#1234)
---
.../RangerDefaultPolicyEvaluator.java | 19 ++--
.../plugin/policyengine/TestPolicyEngine.java | 7 ++
...test_policyengine_hive_any_access_priority.json | 126 +++++++++++++++++++++
3 files changed, 142 insertions(+), 10 deletions(-)
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
b/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
index 962733211..681fe0c4e 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
@@ -608,15 +608,11 @@ protected void evaluatePolicyItems(RangerAccessRequest
request, MatchType matchT
}
}
} else { // Earlier evaluator denied this access
- if (getPolicyPriority() >= oldPriority &&
allowResult != null && (oneRequest.isAccessTypeAny() ||
RangerAccessRequestUtil.getIsAnyAccessInContext(oneRequest.getContext()))) {
- accessTypeResults.put(accessType, allowResult);
- } else {
- if (getPolicyPriority() > oldPriority) {
- if (allowResult != null) {
- accessTypeResults.put(accessType,
allowResult);
- } else if (denyResult != null) {
- accessTypeResults.put(accessType,
denyResult);
- }
+ if (getPolicyPriority() > oldPriority) {
+ if (allowResult != null) {
+ accessTypeResults.put(accessType,
allowResult);
+ } else if (denyResult != null) {
+ accessTypeResults.put(accessType,
denyResult);
}
}
}
@@ -626,7 +622,10 @@ protected void evaluatePolicyItems(RangerAccessRequest
request, MatchType matchT
*/
if (oneRequest.isAccessTypeAny() ||
RangerAccessRequestUtil.getIsAnyAccessInContext(oneRequest.getContext())) {
if (oneRequest.ignoreDescendantDeny() && allowResult
!= null) {
- break;
+ RangerAccessResult storedResult =
accessTypeResults.get(accessType);
+ if (storedResult != null &&
storedResult.getIsAllowed()) {
+ break;
+ }
} else if (!oneRequest.ignoreDescendantDeny() &&
denyResult != null) {
break;
}
diff --git
a/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
b/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
index f83d4bfdd..74504c242 100644
---
a/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
+++
b/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
@@ -379,6 +379,13 @@ public void testPolicyEngine_hive() {
runTestsFromResourceFiles(hiveTestResourceFiles);
}
+ @Test
+ void testPolicyEngine_hive_any_access_priority() {
+ String[] hiveTestResourceFiles =
{"/policyengine/test_policyengine_hive_any_access_priority.json"};
+
+ runTestsFromResourceFiles(hiveTestResourceFiles);
+ }
+
@Test
public void testPolicyEngine_hive_incremental_add() {
String[] hiveTestResourceFiles =
{"/policyengine/test_policyengine_hive_incremental_add.json"};
diff --git
a/agents-common/src/test/resources/policyengine/test_policyengine_hive_any_access_priority.json
b/agents-common/src/test/resources/policyengine/test_policyengine_hive_any_access_priority.json
new file mode 100644
index 000000000..866e495d4
--- /dev/null
+++
b/agents-common/src/test/resources/policyengine/test_policyengine_hive_any_access_priority.json
@@ -0,0 +1,126 @@
+{
+ "serviceName":"hivedev",
+
+ "serviceDef":{
+ "name":"hive",
+ "id":3,
+ "resources":[
+
{"name":"database","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true,
"ignoreCase":true},"label":"Hive Database","description":"Hive Database"},
+
{"name":"url","level":1,"mandatory":true,"lookupSupported":false,"recursiveSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerURLResourceMatcher","matcherOptions":{"wildCard":true,
"ignoreCase":true},"label":"URL","description":"URL"},
+
{"name":"hiveservice","level":1,"mandatory":true,"lookupSupported":false,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true,
"ignoreCase":true},"label":"HiveService","description":"HiveService"},
+
{"name":"table","level":2,"parent":"database","mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true,
"ignoreCase":true},"label":"Hive Table","description":"Hive Table"},
+
{"name":"udf","level":2,"parent":"database","mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true,
"ignoreCase":true},"label":"Hive UDF","description":"Hive UDF"},
+
{"name":"column","level":3,"parent":"table","mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true,
"ignoreCase":true},"label":"Hive Column","description":"Hive Column"}
+ ],
+ "accessTypes":[
+ {"name":"select","label":"Select"},
+ {"name":"update","label":"Update"},
+ {"name":"create","label":"Create"},
+ {"name":"drop","label":"Drop"},
+ {"name":"alter","label":"Alter"},
+ {"name":"index","label":"Index"},
+ {"name":"lock","label":"Lock"},
+ {"name":"read","label":"Read"},
+ {"name":"write","label":"Write"},
+ {"name":"repladmin","label":"ReplAdmin"},
+ {"name":"serviceadmin","label":"ServiceAdmin"},
+ {"name":"all","label":"All",
+ "impliedGrants": [
+ "select",
+ "update",
+ "create",
+ "drop",
+ "alter",
+ "index",
+ "lock",
+ "read",
+ "write",
+ "repladmin",
+ "serviceadmin"
+ ]
+ }
+ ]
+ },
+
+ "policies":[
+ {"id":101,"name":"case1 deny create/drop/alter for
public","isEnabled":true,"isAuditEnabled":true,"policyPriority":1,
+
"resources":{"database":{"values":["case1_db"]},"table":{"values":["*"]},"column":{"values":["*"]}},
+ "denyPolicyItems":[
+
{"accesses":[{"type":"create","isAllowed":true},{"type":"drop","isAllowed":true},{"type":"alter","isAllowed":true}],"users":[],"groups":["public"],"delegateAdmin":false}
+ ]
+ },
+ {"id":102,"name":"case1 allow select/update/drop/read/write for
hrt15","isEnabled":true,"isAuditEnabled":true,"policyPriority":0,
+
"resources":{"database":{"values":["case1_db"]},"table":{"values":["test1"]},"column":{"values":["*"]}},
+ "policyItems":[
+
{"accesses":[{"type":"select","isAllowed":true},{"type":"update","isAllowed":true},{"type":"drop","isAllowed":true},{"type":"read","isAllowed":true},{"type":"write","isAllowed":true}],"users":["hrt15"],"groups":[],"delegateAdmin":false}
+ ]
+ },
+ {"id":201,"name":"case2 deny create/drop/alter for
public","isEnabled":true,"isAuditEnabled":true,"policyPriority":0,
+
"resources":{"database":{"values":["case2_db"]},"table":{"values":["*"]},"column":{"values":["*"]}},
+ "denyPolicyItems":[
+
{"accesses":[{"type":"create","isAllowed":true},{"type":"drop","isAllowed":true},{"type":"alter","isAllowed":true}],"users":[],"groups":["public"],"delegateAdmin":false}
+ ]
+ },
+ {"id":202,"name":"case2 allow select/update/drop/read/write for
hrt15","isEnabled":true,"isAuditEnabled":true,"policyPriority":0,
+
"resources":{"database":{"values":["case2_db"]},"table":{"values":["test1"]},"column":{"values":["*"]}},
+ "policyItems":[
+
{"accesses":[{"type":"select","isAllowed":true},{"type":"update","isAllowed":true},{"type":"drop","isAllowed":true},{"type":"read","isAllowed":true},{"type":"write","isAllowed":true}],"users":["hrt15"],"groups":[],"delegateAdmin":false}
+ ]
+ },
+ {"id":301,"name":"case3 deny create/drop/alter for
public","isEnabled":true,"isAuditEnabled":true,"policyPriority":1,
+
"resources":{"database":{"values":["case3_db"]},"table":{"values":["*"]},"column":{"values":["*"]}},
+ "denyPolicyItems":[
+
{"accesses":[{"type":"create","isAllowed":true},{"type":"drop","isAllowed":true},{"type":"alter","isAllowed":true}],"users":[],"groups":["public"],"delegateAdmin":false}
+ ]
+ },
+ {"id":302,"name":"case3 allow
select/update/create/alter/index/lock/read/write for
hrt15","isEnabled":true,"isAuditEnabled":true,"policyPriority":0,
+
"resources":{"database":{"values":["case3_db"]},"table":{"values":["test1"]},"column":{"values":["*"]}},
+ "policyItems":[
+
{"accesses":[{"type":"select","isAllowed":true},{"type":"update","isAllowed":true},{"type":"create","isAllowed":true},{"type":"alter","isAllowed":true},{"type":"index","isAllowed":true},{"type":"lock","isAllowed":true},{"type":"read","isAllowed":true},{"type":"write","isAllowed":true}],"users":["hrt15"],"groups":[],"delegateAdmin":false}
+ ]
+ },
+ {"id":401,"name":"case4 deny create/drop/alter for
public","isEnabled":true,"isAuditEnabled":true,"policyPriority":1,
+
"resources":{"database":{"values":["case4_db"]},"table":{"values":["*"]},"column":{"values":["*"]}},
+ "denyPolicyItems":[
+
{"accesses":[{"type":"create","isAllowed":true},{"type":"drop","isAllowed":true},{"type":"alter","isAllowed":true}],"users":[],"groups":["public"],"delegateAdmin":false}
+ ]
+ },
+ {"id":402,"name":"case4 allow create/drop/alter for
hrt15","isEnabled":true,"isAuditEnabled":true,"policyPriority":1,
+
"resources":{"database":{"values":["case4_db"]},"table":{"values":["test1"]},"column":{"values":["*"]}},
+ "policyItems":[
+
{"accesses":[{"type":"create","isAllowed":true},{"type":"drop","isAllowed":true},{"type":"alter","isAllowed":true}],"users":["hrt15"],"groups":[],"delegateAdmin":false}
+ ]
+ }
+ ],
+
+ "tests":[
+ {"name":"CASE-1: higher-priority deny, _any allowed via select",
+ "request":{
+ "resource":{"elements":{"database":"case1_db"}},
+
"accessType":"","user":"hrt15","userGroups":["public"],"requestData":"use
case1_db"
+ },
+ "result":{"isAudited":true,"isAllowed":true,"policyId":102}
+ },
+ {"name":"CASE-2: same-priority deny, deny wins per type, _any allowed via
select",
+ "request":{
+ "resource":{"elements":{"database":"case2_db"}},
+
"accessType":"","user":"hrt15","userGroups":["public"],"requestData":"use
case2_db"
+ },
+ "result":{"isAudited":true,"isAllowed":true,"policyId":202}
+ },
+ {"name":"CASE-3: higher-priority deny, allow policy skips denied types to
find select",
+ "request":{
+ "resource":{"elements":{"database":"case3_db"}},
+
"accessType":"","user":"hrt15","userGroups":["public"],"requestData":"use
case3_db"
+ },
+ "result":{"isAudited":true,"isAllowed":true,"policyId":302}
+ },
+ {"name":"CASE-4: same-priority deny+allow for all allowed types, _any
denied",
+ "request":{
+ "resource":{"elements":{"database":"case4_db"}},
+
"accessType":"","user":"hrt15","userGroups":["public"],"requestData":"use
case4_db"
+ },
+ "result":{"isAudited":true,"isAllowed":false,"policyId":-1}
+ }
+ ]
+}
