[
https://issues.apache.org/jira/browse/IMPALA-15341?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Fang-Yu Rao updated IMPALA-15341:
---------------------------------
Description:
After IMPALA-14956 and IMPALA-15323, Impala produces Ranger audit events for
GRANT/REVOKE ROLE and CREATE/DROP ROLE statements. However, as observed in
RANGER-5594, the fields of accessType and action in Ranger AuthzAuditEvent are
solely determined by the provided accessType.
Take CREATE ROLE for instance, the field of 'accessType' will be "CREATE" and
the field of 'action' will be "create". According to my current understanding,
this is because
- at
[https://github.com/apache/impala/blob/fe5217c/fe/src/main/java/org/apache/impala/authorization/ranger/RangerBufferAuditHandler.java#L132],
when constructing the AuthzAuditEvent, we call
RangerDefaultAuditHandler#getAuthzEvents()
([https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L102])
that switched the values of these 2 fields
([https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L124]
and
[https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L127])
(https://issues.apache.org/jira/browse/RANGER-5594 was created for this), and
then
- at
[https://github.com/apache/impala/blob/fe5217c/fe/src/main/java/org/apache/impala/authorization/ranger/RangerBufferAuditHandler.java#L140],
we uppercase the field of 'accessType' in the AuthzAuditEvent using the value
of 'accessType' in the given RangerAccessResult of the method
createAuditEvent(RangerAccessResult result).
We observed a similar thing (or issue?) as described above in Apache Hive, but
it looks like this was worked around by calling
auditEvent.setAccessType(action) at
[https://github.com/apache/ranger/blob/2ad565f/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuditHandler.java#L210]
in RangerHiveAuditHandler#createAuditEvent().
Before we have a fix for RANGER-5594, it may be good for us to adopt the
workaround as well in Impala.
was:
After IMPALA-14956 and IMPALA-15323, Impala produces Ranger audit events for
GRANT/REVOKE ROLE and CREATE/DROP ROLE statements. However, as observed in
RANGER-5594, the fields of accessType and action in Ranger AuthzAuditEvent are
solely determined by the provided accessType.
Take CREATE ROLE for instance, the field of 'accessType' will be "CREATE" and
the field of 'action' will be "create". According to my current understanding,
this is because
- at
[https://github.com/apache/impala/blob/fe5217c/fe/src/main/java/org/apache/impala/authorization/ranger/RangerBufferAuditHandler.java#L132],
when constructing the AuthzAuditEvent, we call
RangerDefaultAuditHandler#getAuthzEvents()
([https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L102])
that switched the values of these 2 fields
([https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L124]
and
[https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L127])
(https://issues.apache.org/jira/browse/RANGER-5594 was created for this), and
then
- at
[https://github.com/apache/impala/blob/fe5217c/fe/src/main/java/org/apache/impala/authorization/ranger/RangerBufferAuditHandler.java#L140],
we uppercase the field of 'accessType' in the AuthzAuditEvent using the value
of 'accessType' in the given RangerAccessResult of the method
createAuditEvent(RangerAccessResult result).
We observed a similar thing (or issue?) as described above in Apache Hive, but
it looks like this was worked around by calling
auditEvent.setAccessType(action) at
[https://github.com/apache/ranger/blob/2ad565f/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuditHandler.java#L210]
in RangerHiveAuditHandler#createAuditEvent().
Before we have a fix for RANGER-5594, it may be good for us to adopt the
workaround as well in Impala.
> Preserve the fields of accessType and action in Ranger AuthzAuditEvent for
> CREATE/DROP and GRANT/REVOKE ROLE operations
> -----------------------------------------------------------------------------------------------------------------------
>
> Key: IMPALA-15341
> URL: https://issues.apache.org/jira/browse/IMPALA-15341
> Project: IMPALA
> Issue Type: Improvement
> Components: Frontend
> Reporter: Fang-Yu Rao
> Assignee: Fang-Yu Rao
> Priority: Major
>
> After IMPALA-14956 and IMPALA-15323, Impala produces Ranger audit events for
> GRANT/REVOKE ROLE and CREATE/DROP ROLE statements. However, as observed in
> RANGER-5594, the fields of accessType and action in Ranger AuthzAuditEvent
> are solely determined by the provided accessType.
>
> Take CREATE ROLE for instance, the field of 'accessType' will be "CREATE" and
> the field of 'action' will be "create". According to my current
> understanding, this is because
> - at
> [https://github.com/apache/impala/blob/fe5217c/fe/src/main/java/org/apache/impala/authorization/ranger/RangerBufferAuditHandler.java#L132],
> when constructing the AuthzAuditEvent, we call
> RangerDefaultAuditHandler#getAuthzEvents()
> ([https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L102])
> that switched the values of these 2 fields
> ([https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L124]
> and
> [https://github.com/apache/ranger/blob/2ad565f/agents-common/src/main/java/org/apache/ranger/plugin/audit/RangerDefaultAuditHandler.java#L127])
> (https://issues.apache.org/jira/browse/RANGER-5594 was created for this),
> and then
> - at
> [https://github.com/apache/impala/blob/fe5217c/fe/src/main/java/org/apache/impala/authorization/ranger/RangerBufferAuditHandler.java#L140],
> we uppercase the field of 'accessType' in the AuthzAuditEvent using the
> value of 'accessType' in the given RangerAccessResult of the method
> createAuditEvent(RangerAccessResult result).
>
> We observed a similar thing (or issue?) as described above in Apache Hive,
> but it looks like this was worked around by calling
> auditEvent.setAccessType(action) at
> [https://github.com/apache/ranger/blob/2ad565f/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuditHandler.java#L210]
> in RangerHiveAuditHandler#createAuditEvent().
>
> Before we have a fix for RANGER-5594, it may be good for us to adopt the
> workaround as well in Impala.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
