mirror of
https://github.com/apache/impala.git
synced 2026-02-03 09:00:39 -05:00
a398f7992e
This patch makes Impala produce Ranger audit log for the SHOW DATABASES and the SHOW DATABASES LIKE statements. Moreover, this patch enforces the authorization check for the default database, meaning that the default database will not be shown if the requesting user is not authorized to view this database according to the Ranger policy repository. To support this new type of authorization check, we added the class AuthorizableDbList to represent the object to be accessed by those two statements. Note that this patch generates the same RangerAccessRequestImpl for the SHOW DATABASES statement as Hive does when Ranger is the authorization provider. Specifically, in https://github.com/apache/ranger/blob/668b80b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java#L806-L811 for the operation of SHOWDATABASES, the constructor of RangerHiveResource does not populate any field in RangerAccessResourceImpl with a non-null value. Moreover, when HiveAccessType.USE is passed to the constructor of RangerHiveAccessRequest, under the covers 'accessType' in RangerAccessRequestImpl will be set to "_any" as shown in RangerHiveAccessRequest#setHiveAccessType(). Testing: - Added test cases to make sure the Ranger audit event will be produced. - Added test cases to verify the database 'default' will not be shown if the requesting user is not allowed to discover the database based on the Ranger policy repository. Change-Id: Idb3e54b152e953916d3d7d7ef27c880a8559ed26 Reviewed-on: http://gerrit.cloudera.org:8080/23877 Reviewed-by: Quanlong Huang <huangquanlong@gmail.com> Tested-by: Impala Public Jenkins <impala-public-jenkins@cloudera.com>