[
https://issues.apache.org/jira/browse/SENTRY-561?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14236249#comment-14236249
]
Mike Yoder commented on SENTRY-561:
-----------------------------------
A run failed last night and I could at last put the pieces together.
Imagine the following scenario.
# main thread: Priv X is in role Y
# main thread: role Y is deleted
# main thread: create role Y (without adding priv X to it yet)
# cleaning thread kicks in; finds priv X
# cleaning thread opens transaction
# cleaning thread deletes priv X
# main thread: opens xact; "adds back" priv X to role Y, closes xact
# cleaning thread closes xact - priv X now goes away.
Step 6 is perfectly reasonable because priv X is not associated with a role
Step 7 has no effect, essentially, since in the world view of the main thread,
priv X already exists because the cleaning thread hasn't committed its
transaction yet.
Then in step 8 the cleaning thread commits its transaction, and priv X goes
away. Now role Y does not have priv X... even though the main thread just added
it.
Later, the test blows up because role Y does not have priv X.
> Re-Enable Orphan Cleanup Thread
> -------------------------------
>
> Key: SENTRY-561
> URL: https://issues.apache.org/jira/browse/SENTRY-561
> Project: Sentry
> Issue Type: Bug
> Affects Versions: 1.5.0
> Reporter: Mike Yoder
> Assignee: Mike Yoder
> Attachments: SENTRY-561.0.patch, SENTRY-561.1.patch,
> SENTRY-561.1.patch
>
>
> SENTRY-140 created a thread to remove privileges that weren't referenced by
> any role. That hit problems in testing after submittal, and so was turned
> off in SENTRY-545. This issue will (hopefully) turn it back on, once I
> figure out what's going on. I haven't reproduced this locally, so I might be
> submitting a lot of patches so the test ring can reproduce...
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
