[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies When Ranger authorization is enabled, analyzing a LOAD DATA statement may fail when checking access to the source file if the HDFS permissions is more restrict than the Ranger policies. This patch provides a quick fix, when Ranger authz is enabled, we invoke method hadoop.fs.FileSystem.access(Path path, FsAction mode) to check the actual access permission first. Testing: - existing tests - add FsPermissionCheckerTest.java to fe ut Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Reviewed-on: http://gerrit.cloudera.org:8080/18373 Reviewed-by: Impala Public Jenkins Tested-by: Impala Public Jenkins --- M fe/src/main/java/org/apache/impala/analysis/LoadDataStmt.java M fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java A fe/src/test/java/org/apache/impala/util/FsPermissionCheckerTest.java 3 files changed, 121 insertions(+), 6 deletions(-) Approvals: Impala Public Jenkins: Looks good to me, approved; Verified -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 6 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Fang-Yu Rao Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 5: Verified+1 -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 5 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Fang-Yu Rao Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Wed, 06 Apr 2022 10:42:37 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 5: Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/8025/ DRY_RUN=false -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 5 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Fang-Yu Rao Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Wed, 06 Apr 2022 06:13:35 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 5: Code-Review+2 -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 5 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Fang-Yu Rao Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Wed, 06 Apr 2022 06:13:34 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Quanlong Huang has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 4: Code-Review+2 Verified in a real cluster. Thanks for working on this! -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 4 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Fang-Yu Rao Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Wed, 06 Apr 2022 06:13:03 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 4: Build Successful https://jenkins.impala.io/job/gerrit-code-review-checks/10403/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests. -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 4 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Fang-Yu Rao Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Wed, 06 Apr 2022 03:10:44 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
lipeng...@sensorsdata.cn has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 4: (2 comments) done http://gerrit.cloudera.org:8080/#/c/18373/3//COMMIT_MSG Commit Message: http://gerrit.cloudera.org:8080/#/c/18373/3//COMMIT_MSG@10 PS3, Line 10: fail > nit: fail Done http://gerrit.cloudera.org:8080/#/c/18373/3/fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java File fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java: http://gerrit.cloudera.org:8080/#/c/18373/3/fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java@27 PS3, Line 27: import org.slf4j.Logger; > nit: move this to line 41. We try to maintain imports in order. Done -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 4 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Fang-Yu Rao Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Wed, 06 Apr 2022 02:51:12 + Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
lipeng...@sensorsdata.cn has uploaded a new patch set (#4). ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies When Ranger authorization is enabled, analyzing a LOAD DATA statement may fail when checking access to the source file if the HDFS permissions is more restrict than the Ranger policies. This patch provides a quick fix, when Ranger authz is enabled, we invoke method hadoop.fs.FileSystem.access(Path path, FsAction mode) to check the actual access permission first. Testing: - existing tests - add FsPermissionCheckerTest.java to fe ut Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c --- M fe/src/main/java/org/apache/impala/analysis/LoadDataStmt.java M fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java A fe/src/test/java/org/apache/impala/util/FsPermissionCheckerTest.java 3 files changed, 121 insertions(+), 6 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/73/18373/4 -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 4 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Fang-Yu Rao Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Quanlong Huang has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 3: (1 comment) http://gerrit.cloudera.org:8080/#/c/18373/3/fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java File fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java: http://gerrit.cloudera.org:8080/#/c/18373/3/fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java@27 PS3, Line 27: import org.apache.hadoop.security.AccessControlException; nit: move this to line 41. We try to maintain imports in order. -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 3 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Fang-Yu Rao Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Wed, 06 Apr 2022 02:19:49 + Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Qifan Chen has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 3: Code-Review+1 (1 comment) Looks great! Thanks a lot for the rework. http://gerrit.cloudera.org:8080/#/c/18373/3//COMMIT_MSG Commit Message: http://gerrit.cloudera.org:8080/#/c/18373/3//COMMIT_MSG@10 PS3, Line 10: fails nit: fail -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 3 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Mon, 04 Apr 2022 13:12:12 + Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 3: Build Successful https://jenkins.impala.io/job/gerrit-code-review-checks/10386/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests. -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 3 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Sat, 02 Apr 2022 14:00:41 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
lipeng...@sensorsdata.cn has uploaded a new patch set (#3). ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies When Ranger authorization is enabled, analyzing a LOAD DATA statement may fails when checking access to the source file if the HDFS permissions is more restrict than the Ranger policies. This patch provides a quick fix, when Ranger authz is enabled, we invoke method hadoop.fs.FileSystem.access(Path path, FsAction mode) to check the actual access permission first. Testing: - existing tests - add FsPermissionCheckerTest.java to fe ut Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c --- M fe/src/main/java/org/apache/impala/analysis/LoadDataStmt.java M fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java A fe/src/test/java/org/apache/impala/util/FsPermissionCheckerTest.java 3 files changed, 121 insertions(+), 6 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/73/18373/3 -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 3 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Anonymous Coward Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Qifan Chen has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 1: (5 comments) http://gerrit.cloudera.org:8080/#/c/18373/1//COMMIT_MSG Commit Message: http://gerrit.cloudera.org:8080/#/c/18373/1//COMMIT_MSG@10 PS1, Line 10: fails in nit: fail when http://gerrit.cloudera.org:8080/#/c/18373/1//COMMIT_MSG@13 PS1, Line 13: is a quick fix nit. provides a quick fix http://gerrit.cloudera.org:8080/#/c/18373/1//COMMIT_MSG@13 PS1, Line 13: , we can check : the access using FileSystem#access(Path path, FsAction mode) to invoke a : NameNode RPC to respect Ranger-HDFS policies. nit: . We invoke method hadoop.fs.FileSystem.access(Path path, FsAction mode) to check the actual access permission first. http://gerrit.cloudera.org:8080/#/c/18373/1/fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java File fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java: http://gerrit.cloudera.org:8080/#/c/18373/1/fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java@313 PS1, Line 313: access nit: may need to add a comment for the new method. May also use the name checkAccess(). http://gerrit.cloudera.org:8080/#/c/18373/1/fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java@316 PS1, Line 316: fs.access( Should we handle AccessControlException (https://github.com/apache/hadoop/blob/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileSystem.java#L2698) here and return false instead? -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 1 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Fri, 01 Apr 2022 17:40:55 + Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Quanlong Huang has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 1: Code-Review+1 (2 comments) Thanks for fixing this! It'd be nice if we can add an end-to-end test. However, we currently don't have the script to launch HDFS with Ranger authz enabled. I just filed IMPALA-11217 for it. I'm ok to add the end-to-end test in a follow-up JIRA. I can bump my +1 to +2 after I verify the patch in a real cluster. http://gerrit.cloudera.org:8080/#/c/18373/1/fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java File fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java: http://gerrit.cloudera.org:8080/#/c/18373/1/fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java@314 PS1, Line 314: nit: indention needs 2 more spaces http://gerrit.cloudera.org:8080/#/c/18373/1/fe/src/test/java/org/apache/impala/util/FsPermissionCheckerTest.java File fe/src/test/java/org/apache/impala/util/FsPermissionCheckerTest.java: http://gerrit.cloudera.org:8080/#/c/18373/1/fe/src/test/java/org/apache/impala/util/FsPermissionCheckerTest.java@37 PS1, Line 37: Ahthz nit: Authz? The other 3 tests have the same word. -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 1 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Qifan Chen Gerrit-Reviewer: Quanlong Huang Gerrit-Comment-Date: Fri, 01 Apr 2022 13:07:51 + Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/18373 ) Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. Patch Set 1: Build Successful https://jenkins.impala.io/job/gerrit-code-review-checks/10378/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests. -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 1 Gerrit-Owner: Anonymous Coward Gerrit-Reviewer: Impala Public Jenkins Gerrit-Comment-Date: Fri, 01 Apr 2022 03:33:37 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies
lipeng...@sensorsdata.cn has uploaded this change for review. ( http://gerrit.cloudera.org:8080/18373 Change subject: IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies .. IMPALA-10272: LOAD DATA should respect Ranger-HDFS policies When Ranger authorization is enabled, analyzing a LOAD DATA statement may fails in checking access to the source file if the HDFS permissions is more restrict than the Ranger policies. This patch is a quick fix, when Ranger authz is enabled, we can check the access using FileSystem#access(Path path, FsAction mode) to invoke a NameNode RPC to respect Ranger-HDFS policies. Testing: - existing tests - add FsPermissionCheckerTest.java to fe ut Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c --- M fe/src/main/java/org/apache/impala/analysis/LoadDataStmt.java M fe/src/main/java/org/apache/impala/util/FsPermissionChecker.java A fe/src/test/java/org/apache/impala/util/FsPermissionCheckerTest.java 3 files changed, 112 insertions(+), 6 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/73/18373/1 -- To view, visit http://gerrit.cloudera.org:8080/18373 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: Ia0acd83e8e237ea6a1d5fe1e9e440db0dd68b09c Gerrit-Change-Number: 18373 Gerrit-PatchSet: 1 Gerrit-Owner: Anonymous Coward