maheshbandal15 opened a new pull request, #1315:
URL: https://github.com/apache/ranger/pull/1315
## What changes were proposed in this pull request?
OperationOptimizer tries to merge NN authorization calls when
ranger.hdfs.authz.enable.optimization=true. For directory renames, the inode is
itself a directory, so getINodeToAuthorize() intentionally returns null and
logs:
```
} else {
LOG.debug("inode is not null and it is not a file for a
create/rename/mkdirs operation! Optimization skipped");
}
```
But optimizeRenameOp() treats any null from getINodeToAuthorize() as
unconditional allow:
```
private OptimizedAuthzContext optimizeRenameOp() {
INode nodeToAuthorize = getINodeToAuthorize();
if (nodeToAuthorize == null) {
return optByPassAuthz;
}
```
It incorrectly optimizes away with authzStatus=ALLOW.
This patch fixes optimizeRenameOp(). When inode != null &&
inode.isDirectory(), it will not call getINodeToAuthorize() and thus it will
not return optByPassAuthz for substantive checks. It reuses the same pattern
already proven for directory delete in optimizeDeleteOp(). When inode is a
directory, it evaluates access of source (parent) dir.
## How was this patch tested?
manually verified failing scenarios. Ranger HDFS policy grants user=sam
read/write/execute only under /user/**. Paths /dev1, /dev2, /dev3, /dev4 are
outside that policy.
Below operations are denied as expected:
```
kint sam
hdfs dfs -rm -r /dev1
hdfs dfs -mv /dev4 /user/sam/.Trash/
hdfs dfs -rm -r -skipTrash /dev2
hdfs dfs -rm /dev3/file1
hdfs dfs -mv /dev3/file2 /user/sam/.Trash/Current/
```
Added unit tests to cover these scenarios and verify regressions.
build successful with command "mvn clean install"
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
