[ https://issues.apache.org/jira/browse/IMPALA-8716?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16877000#comment-16877000 ]
ASF subversion and git services commented on IMPALA-8716: --------------------------------------------------------- Commit aee0abd76b762e57ce9f0a2e40a9a8b4f97dc986 in impala's branch refs/heads/master from Fredy Wijaya [ https://gitbox.apache.org/repos/asf?p=impala.git;h=aee0abd ] IMPALA-8716: Log a group of privileges into a single audit event. This patch updates the audit log handler to group a privilege that consists of multiple privileges into a single audit event. For example if we run "show partitions foo.bar" and we have SELECT privilege on table "foo.bar", before this patch, we would be creating 2 audit events: - Attempt to check if there's INSERT privilege on table "foo.bar" Result: denied, access type: insert, resource: foo.bar - Attempt to check if there's SELECT privilege on table "foo.bar" Result: allowed, access type: select, resource: foo.bar After this patch, we will only create a single audit event, e.g. Result: allowed, access type: view_metadata, resource: foo.bar Testing: - Updated tests in RangerAuditLogTest - Ran FE tests Change-Id: Ib53102bc1ceaf9d62544090dc00f3231fae0efca Reviewed-on: http://gerrit.cloudera.org:8080/13744 Reviewed-by: Impala Public Jenkins <impala-public-jenk...@cloudera.com> Tested-by: Impala Public Jenkins <impala-public-jenk...@cloudera.com> > Log a a group of privileges into a single audit event > ----------------------------------------------------- > > Key: IMPALA-8716 > URL: https://issues.apache.org/jira/browse/IMPALA-8716 > Project: IMPALA > Issue Type: Sub-task > Components: Frontend > Reporter: Fredy Wijaya > Assignee: Fredy Wijaya > Priority: Major > Fix For: Impala 3.3.0 > > > Some privileges, such as VIEW_METADATA consists of multiple privileges > (INSERT, SELECT, REFRESH). For example if we run "show partitions > foo.barfoo.bar" and we have SELECT privilege on table "foo.bar", we will be > creating 2 audit logs: > - Attempt to check if there's INSERT privilege on table "foo.bar" -- denied, > INSERT, foo.bar > - Attempt to check if there's SELECT privilege on table "foo.bar" -- allowed, > SELECT, foo.bar > This can be confusing. A better solution is to log this as a single audit > log, e.g. > - allowed, VIEW_METADATA, foo.bar -- This message was sent by Atlassian JIRA (v7.6.3#76005) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-all-unsubscr...@impala.apache.org For additional commands, e-mail: issues-all-h...@impala.apache.org