vyommani opened a new pull request, #1324:
URL: https://github.com/apache/ranger/pull/1324
## What changes were proposed in this pull request?
Roles can contain other roles, but nothing stops a role from ending up
inside itself, directly or through other roles. Several RoleREST helpers also
expand nested roles recursively, without tracking roles already visited. When a
cycle is present, requests that expand it fail.
Validation on save (RoleDBStore)
Create: reject a role whose nested roles contain it. The check walks the
stored definitions of the nested roles, loading each role once, so it also
catches references that are only written after commit
(createNonExistUserGroupRole, for example within an import).
Update: check only the nested roles the update adds. Reject the update if
one of them is the role itself or one of its ancestors, found by walking
x_role_ref_role ids upward with a visited set. An update that adds no nested
role does no extra work.
Grant: relies on updateRole for this check, including granting a role into
itself. The separate recursive check in addUsersGroupsAndRoles is removed.
Role expansion (RoleREST)
getRoleMemberNames and getRoleMembers are now iterative, with a visited set.
Each nested role is loaded once, and a cycle already present in the data
terminates.
ensureRoleAccess reuses the roles loaded during expansion instead of
fetching them again. The access decision is unchanged.
getUserRoles shares one visited set across all of the user’s roles, so a
nested role common to several of them is loaded once.
A nested role named in a role definition that doesn’t exist (yet) is skipped
instead of failing the request.
Behaviour changes
Saving a role that would contain itself now fails with: “a role can not
contain itself, directly or through nested roles.”
Existing data with cycles can still be read, and those roles can still be
edited.
## How was this patch tested?
TestRoleDBStore:
self-nesting rejected on create and on update;
a create rejected when an existing nested role already contains the new role;
adding an ancestor as a nested role rejected;
an update with unchanged nested roles doing no extra lookups;
an existing cycle above the role terminating and the update succeeding.
TestRoleREST:
GET /roles/{id} on a cyclic role returning a denial, with each role loaded
at most once;
getUserRoles on a cyclic role terminating;
a missing nested role skipped on read.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
