alexandrefimov commented on code in PR #7637:
URL: https://github.com/apache/kyuubi/pull/7637#discussion_r3832298172
##########
extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/rule/config/AuthzConfigurationChecker.scala:
##########
@@ -30,6 +30,9 @@ import
org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils.SKIP_CATALOGLESS_V2_
case class AuthzConfigurationChecker(spark: SparkSession) extends (LogicalPlan
=> Unit) {
final val RESTRICT_LIST_KEY = "spark.kyuubi.conf.restricted.list"
+ final val EXCLUDED_RULES_KEY = "spark.sql.optimizer.excludedRules"
+
+ final private val AUTHZ_RANGER_RULE_PACKAGE =
"org.apache.kyuubi.plugin.spark.authz.ranger"
Review Comment:
Ran it since, and the reading holds. With the real extension and the test
policies, excluding `RuleEliminateMarker` fails planning for both a masked and
a row-filtered query — `No plan for RowFilterMarker +- DataMaskingStage0Marker
…`; `RuleEliminatePermanentViewMarker` fails the same way (`No plan for
PermanentViewMarker …`), and `RuleEliminateTypeOf` fails at runtime with
`UnaryExpressions must override either eval or nullSafeEval`. The masking
projection is still in the failing plan (`md5(cast(cast(value1 as string) as
binary))`), which is the point: masking and row filtering come from resolution
rules that can't be excluded at all, and those three only strip the markers
afterwards. A user with no privilege on the table is denied exactly as before
with all three excluded.
So nothing is reachable through the narrower prefix today, and the wider one
covers rules added under `…authz.rule` later. Glad to carry these as tests in
the follow-up if that's the direction you land on.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
