Java Code Examples for org.apache.ranger.plugin.policyengine.RangerAccessResult#getIsAccessDetermined()

The following examples show how to use org.apache.ranger.plugin.policyengine.RangerAccessResult#getIsAccessDetermined() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example 1

Source File: RangerHdfsAuthorizer.java From ranger with Apache License 2.0

5 votes

private AuthzStatus isAccessAllowedForTraversal(INode inode, INodeAttributes inodeAttribs, String path, String user, Set<String> groups, RangerHdfsPlugin plugin, RangerHdfsAuditHandler auditHandler, boolean skipAuditOnAllow) {
	final AuthzStatus ret;
	String pathOwner = inodeAttribs != null ? inodeAttribs.getUserName() : null;
	FsAction access = FsAction.EXECUTE;


	if (pathOwner == null) {
		pathOwner = inode.getUserName();
	}

	if (RangerHadoopConstants.HDFS_ROOT_FOLDER_PATH_ALT.equals(path)) {
		path = HDFS_ROOT_FOLDER_PATH;
	}

	if (LOG.isDebugEnabled()) {
		LOG.debug("==> RangerAccessControlEnforcer.isAccessAllowedForTraversal(" + path + ", " + access + ", " + user + ", " + skipAuditOnAllow + ")");
	}

	RangerHdfsAccessRequest request = new RangerHdfsAccessRequest(inode, path, pathOwner, access, EXECUTE_ACCCESS_TYPE, user, groups);

	RangerAccessResult result = plugin.isAccessAllowed(request, null);

	if (result != null && result.getIsAccessDetermined() && !result.getIsAllowed()) {
		ret = AuthzStatus.DENY;
	} else {
		ret = AuthzStatus.ALLOW;
	}

	if (ret == AuthzStatus.DENY || (!skipAuditOnAllow && result != null && result.getIsAccessDetermined())) {
		auditHandler.processResult(result);
	}

	if (LOG.isDebugEnabled()) {
		LOG.debug("<== RangerAccessControlEnforcer.isAccessAllowedForTraversal(" + path + ", " + access + ", " + user + ", " + skipAuditOnAllow + "): " + ret);
	}

	return ret;
}

Example 2

Source File: RangerDefaultPolicyEvaluator.java From ranger with Apache License 2.0

5 votes

protected RangerPolicyItemEvaluator getMatchingPolicyItem(RangerAccessRequest request, RangerAccessResult result) {
	RangerPolicyItemEvaluator ret = null;

	Integer policyType = getPolicy().getPolicyType();
	if (policyType == null) {
		policyType = RangerPolicy.POLICY_TYPE_ACCESS;
	}

	switch (policyType) {
		case RangerPolicy.POLICY_TYPE_ACCESS: {
			ret = getMatchingPolicyItem(request, denyEvaluators, denyExceptionEvaluators);

			if(ret == null && !result.getIsAccessDetermined()) { // a deny policy could have set isAllowed=true, but in such case it wouldn't set isAccessDetermined=true
				ret = getMatchingPolicyItem(request, allowEvaluators, allowExceptionEvaluators);
			}
			break;
		}
		case RangerPolicy.POLICY_TYPE_DATAMASK: {
			ret = getMatchingPolicyItem(request, dataMaskEvaluators);
			break;
		}
		case RangerPolicy.POLICY_TYPE_ROWFILTER: {
			ret = getMatchingPolicyItem(request, rowFilterEvaluators);
			break;
		}
		default:
			break;
	}

	return ret;
}

Example 3

Source File: RangerHdfsAuthorizer.java From ranger with Apache License 2.0

4 votes

private AuthzStatus isAccessAllowed(INode inode, INodeAttributes inodeAttribs, String path, FsAction access, String user, Set<String> groups, RangerHdfsPlugin plugin, RangerHdfsAuditHandler auditHandler) {
	AuthzStatus ret       = null;
	String      pathOwner = inodeAttribs != null ? inodeAttribs.getUserName() : null;

	if(pathOwner == null && inode != null) {
		pathOwner = inode.getUserName();
	}

	if (RangerHadoopConstants.HDFS_ROOT_FOLDER_PATH_ALT.equals(path)) {
		path = HDFS_ROOT_FOLDER_PATH;
	}

	if(LOG.isDebugEnabled()) {
		LOG.debug("==> RangerAccessControlEnforcer.isAccessAllowed(" + path + ", " + access + ", " + user + ")");
	}

	Set<String> accessTypes = access2ActionListMapper.get(access);

	if(accessTypes == null) {
		LOG.warn("RangerAccessControlEnforcer.isAccessAllowed(" + path + ", " + access + ", " + user + "): no Ranger accessType found for " + access);

		accessTypes = access2ActionListMapper.get(FsAction.NONE);
	}

	for(String accessType : accessTypes) {
		RangerHdfsAccessRequest request = new RangerHdfsAccessRequest(inode, path, pathOwner, access, accessType, user, groups);

		RangerAccessResult result = plugin.isAccessAllowed(request, auditHandler);

		if (result == null || !result.getIsAccessDetermined()) {
			ret = AuthzStatus.NOT_DETERMINED;
			// don't break yet; subsequent accessType could be denied
		} else if(! result.getIsAllowed()) { // explicit deny
			ret = AuthzStatus.DENY;
			break;
		} else { // allowed
			if(!AuthzStatus.NOT_DETERMINED.equals(ret)) { // set to ALLOW only if there was no NOT_DETERMINED earlier
				ret = AuthzStatus.ALLOW;
			}
		}
	}

	if(ret == null) {
		ret = AuthzStatus.NOT_DETERMINED;
	}

	if(LOG.isDebugEnabled()) {
		LOG.debug("<== RangerAccessControlEnforcer.isAccessAllowed(" + path + ", " + access + ", " + user + "): " + ret);
	}

	return ret;
}

Example 4

Source File: RangerHdfsAuthorizer.java From ranger with Apache License 2.0

4 votes

private AuthzStatus isAccessAllowedForHierarchy(INode inode, INodeAttributes inodeAttribs, String path, FsAction access, String user, Set<String> groups, RangerHdfsPlugin plugin) {
	AuthzStatus ret   = null;
	String  pathOwner = inodeAttribs != null ? inodeAttribs.getUserName() : null;

	if (pathOwner == null && inode != null) {
		pathOwner = inode.getUserName();
	}

	if (RangerHadoopConstants.HDFS_ROOT_FOLDER_PATH_ALT.equals(path)) {
		path = HDFS_ROOT_FOLDER_PATH;
	}

	if (LOG.isDebugEnabled()) {
		LOG.debug("==> RangerAccessControlEnforcer.isAccessAllowedForHierarchy(" + path + ", " + access + ", " + user + ")");
	}

	if (path != null) {

		Set<String> accessTypes = access2ActionListMapper.get(access);

		if (accessTypes == null) {
			LOG.warn("RangerAccessControlEnforcer.isAccessAllowedForHierarchy(" + path + ", " + access + ", " + user + "): no Ranger accessType found for " + access);

			accessTypes = access2ActionListMapper.get(FsAction.NONE);
		}

		String subDirPath = path;
		if (subDirPath.charAt(subDirPath.length() - 1) != Path.SEPARATOR_CHAR) {
			subDirPath = subDirPath + Character.toString(Path.SEPARATOR_CHAR);
		}
		subDirPath = subDirPath + rangerPlugin.getRandomizedWildcardPathName();

		for (String accessType : accessTypes) {
			RangerHdfsAccessRequest request = new RangerHdfsAccessRequest(null, subDirPath, pathOwner, access, accessType, user, groups);

			RangerAccessResult result = plugin.isAccessAllowed(request, null);

			if (result == null || !result.getIsAccessDetermined()) {
				ret = AuthzStatus.NOT_DETERMINED;
				// don't break yet; subsequent accessType could be denied
			} else if(! result.getIsAllowed()) { // explicit deny
				ret = AuthzStatus.DENY;
				break;
			} else { // allowed
				if(!AuthzStatus.NOT_DETERMINED.equals(ret)) { // set to ALLOW only if there was no NOT_DETERMINED earlier
					ret = AuthzStatus.ALLOW;
				}
			}
		}
	}

	if(ret == null) {
		ret = AuthzStatus.NOT_DETERMINED;
	}

	if (LOG.isDebugEnabled()) {
		LOG.debug("<== RangerAccessControlEnforcer.isAccessAllowedForHierarchy(" + path + ", " + access + ", " + user + "): " + ret);
	}

	return ret;
}

Example 5

Source File: RangerYarnAuthorizer.java From ranger with Apache License 2.0

4 votes

@Override
public boolean checkPermission(AccessRequest accessRequest) {
	AccessType accessType = accessRequest.getAccessType();
    PrivilegedEntity entity = accessRequest.getEntity();
	UserGroupInformation ugi = accessRequest.getUser();
	List<String> forwardedAddresses = accessRequest.getForwardedAddresses();
	String remoteIpAddress = accessRequest.getRemoteAddress();
	if(LOG.isDebugEnabled()) {
		LOG.debug("==> RangerYarnAuthorizer.checkPermission(" + accessType + ", " + toString(entity) + ", " + ugi + ")");
	}

	boolean                ret          = false;
	RangerYarnPlugin       plugin       = yarnPlugin;
	RangerYarnAuditHandler auditHandler = null;
	RangerAccessResult     result       = null;

	RangerPerfTracer perf = null;
	RangerPerfTracer yarnAclPerf = null;

	if(plugin != null) {

		if(RangerPerfTracer.isPerfTraceEnabled(PERF_YARNAUTH_REQUEST_LOG)) {
			perf = RangerPerfTracer.getPerfTracer(PERF_YARNAUTH_REQUEST_LOG, "RangerYarnAuthorizer.checkPermission(entity=" + entity + ")");
		}

		RangerYarnAccessRequest request = new RangerYarnAccessRequest(entity, getRangerAccessType(accessType), accessType.name(), ugi, forwardedAddresses, remoteIpAddress);

		auditHandler = new RangerYarnAuditHandler(yarnModuleName);

		result = plugin.isAccessAllowed(request, auditHandler);
	}

	if(yarnAuthEnabled && (result == null || !result.getIsAccessDetermined())) {

		if(RangerPerfTracer.isPerfTraceEnabled(PERF_YARNAUTH_REQUEST_LOG)) {
			yarnAclPerf = RangerPerfTracer.getPerfTracer(PERF_YARNAUTH_REQUEST_LOG, "RangerYarnNativeAuthorizer.isAllowedByYarnAcl(entity=" + entity + ")");
		}

		ret = isAllowedByYarnAcl(accessType, entity, ugi, auditHandler);
	} else {
		ret = result != null && result.getIsAllowed();
	}

	if(auditHandler != null) {
		auditHandler.flushAudit();
	}

	RangerPerfTracer.log(yarnAclPerf);

	RangerPerfTracer.log(perf);

	if(LOG.isDebugEnabled()) {
		LOG.debug("<== RangerYarnAuthorizer.checkPermission(" + accessType + ", " + toString(entity) + ", " + ugi + "): " + ret);
	}

	return ret;
}

Example 6

Source File: RangerDefaultPolicyEvaluator.java From ranger with Apache License 2.0

4 votes

@Override
  public void evaluate(RangerAccessRequest request, RangerAccessResult result) {
      if (LOG.isDebugEnabled()) {
          LOG.debug("==> RangerDefaultPolicyEvaluator.evaluate(policyId=" + getPolicy().getId() + ", " + request + ", " + result + ")");
      }

RangerPerfTracer perf = null;

if(RangerPerfTracer.isPerfTraceEnabled(PERF_POLICY_REQUEST_LOG)) {
	perf = RangerPerfTracer.getPerfTracer(PERF_POLICY_REQUEST_LOG, "RangerPolicyEvaluator.evaluate(requestHashCode=" + Integer.toHexString(System.identityHashCode(request)) + ","
			+ perfTag + ")");
}

      if (request != null && result != null) {

	if (!result.getIsAccessDetermined() || !result.getIsAuditedDetermined()) {
		RangerPolicyResourceMatcher.MatchType matchType;

		if (RangerTagAccessRequest.class.isInstance(request)) {
			matchType = ((RangerTagAccessRequest) request).getMatchType();
			if (matchType == RangerPolicyResourceMatcher.MatchType.ANCESTOR) {
				matchType = RangerPolicyResourceMatcher.MatchType.SELF;
			}
		} else {
			matchType = resourceMatcher != null ? resourceMatcher.getMatchType(request.getResource(), request.getContext()) : RangerPolicyResourceMatcher.MatchType.NONE;
		}

		final boolean isMatched;

		if (request.isAccessTypeAny()) {
			isMatched = matchType != RangerPolicyResourceMatcher.MatchType.NONE;
		} else if (request.getResourceMatchingScope() == RangerAccessRequest.ResourceMatchingScope.SELF_OR_DESCENDANTS) {
			isMatched = matchType != RangerPolicyResourceMatcher.MatchType.NONE;
		} else {
			isMatched = matchType == RangerPolicyResourceMatcher.MatchType.SELF || matchType == RangerPolicyResourceMatcher.MatchType.SELF_AND_ALL_DESCENDANTS;
		}

		if (isMatched) {
			//Evaluate Policy Level Custom Conditions, if any and allowed then go ahead for policyItem level evaluation
			if(matchPolicyCustomConditions(request)) {
				if (!result.getIsAuditedDetermined()) {
					if (isAuditEnabled()) {
						result.setIsAudited(true);
						result.setAuditPolicyId(getPolicy().getId());
					}
				}
				if (!result.getIsAccessDetermined()) {
					if (hasMatchablePolicyItem(request)) {
						evaluatePolicyItems(request, matchType, result);
					}
				}
			}
		}
	}
      }

RangerPerfTracer.log(perf);

      if(LOG.isDebugEnabled()) {
          LOG.debug("<== RangerDefaultPolicyEvaluator.evaluate(policyId=" + getPolicy().getId() + ", " + request + ", " + result + ")");
      }
  }