mneethiraj commented on code in PR #1214:
URL: https://github.com/apache/ranger/pull/1214#discussion_r3953407133
##########
security-admin/src/main/java/org/apache/ranger/biz/GdsDBStore.java:
##########
@@ -1908,6 +1931,157 @@ private <T> PList<T> getPList(List<T> list, int
startIndex, int maxEntries, Stri
return new PList<>(subList, startIndex, maxEntries, list.size(),
subList.size(), sortType, sortBy);
}
+ private void enforceViewOnSharedResource(RangerSharedResource
sharedResource) {
+ if (!bizUtil.isAuditAdmin()) {
Review Comment:
Shouldn't admin users be allowed as well?
```
if (!bizUtil.isAdmin() && !bizUtil.isAuditAdmin()) {
```
##########
security-admin/src/main/java/org/apache/ranger/biz/GdsDBStore.java:
##########
@@ -1908,6 +1931,157 @@ private <T> PList<T> getPList(List<T> list, int
startIndex, int maxEntries, Stri
return new PList<>(subList, startIndex, maxEntries, list.size(),
subList.size(), sortType, sortBy);
}
+ private void enforceViewOnSharedResource(RangerSharedResource
sharedResource) {
+ if (!bizUtil.isAuditAdmin()) {
+ RangerDataShare dataShare =
getCachedDataShare(sharedResource.getDataShareId(), new HashMap<>());
+
+ if (dataShare == null || !hasViewPermission(dataShare.getAcl())) {
+ throw
restErrorUtil.create403RESTException(NOT_AUTHORIZED_TO_VIEW_SHARED_RESOURCE);
+ }
+ }
+ }
+
+ private boolean hasViewOnDataShare(Long dataShareId, Map<Long,
RangerDataShare> dataShareCache) {
+ boolean ret = bizUtil.isAuditAdmin();
+ RangerDataShare dataShare = null;
+
+ if (!ret) {
+ dataShare = getCachedDataShare(dataShareId, dataShareCache);
+
+ if (dataShare != null) {
+ ret = hasViewPermission(dataShare.getAcl());
+ }
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnDataShareInDataset(RangerDataShareInDataset
dataShareInDataset, Map<Long, RangerDataShare> dataShareCache, Map<Long,
RangerDataset> datasetCache) {
+ boolean ret = hasViewOnDataShare(dataShareInDataset.getDataShareId(),
dataShareCache);
+
+ if (!ret) {
+ ret = hasViewOnDataset(dataShareInDataset.getDatasetId(),
datasetCache);
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnDatasetInProject(RangerDatasetInProject
datasetInProject, Map<Long, RangerDataset> datasetCache, Map<Long,
RangerProject> projectCache) {
+ boolean ret = hasViewOnDataset(datasetInProject.getDatasetId(),
datasetCache);
+
+ if (!ret) {
+ ret = hasViewOnProject(datasetInProject.getProjectId(),
projectCache);
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnDataset(Long datasetId, Map<Long, RangerDataset>
datasetCache) {
+ boolean ret = bizUtil.isAuditAdmin();
+ RangerDataset dataset = null;
+
+ if (!ret) {
+ dataset = getCachedDataset(datasetId, datasetCache);
+
+ if (dataset != null) {
+ ret = hasViewPermission(dataset.getAcl());
+ }
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnProject(Long projectId, Map<Long, RangerProject>
projectCache) {
+ boolean ret = bizUtil.isAuditAdmin();
+ RangerProject project = null;
+
+ if (!ret) {
+ project = getCachedProject(projectId, projectCache);
+
+ if (project != null) {
+ ret = hasViewPermission(project.getAcl());
+ }
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewPermission(RangerGdsObjectACL acl) {
+ boolean ret = bizUtil.isAuditAdmin();
Review Comment:
Shouldn't admin users be allowed as well?
```
boolean ret = bizUtil.isAdmin() || bizUtil.isAuditAdmin();
```
##########
security-admin/src/main/java/org/apache/ranger/biz/GdsDBStore.java:
##########
@@ -1908,6 +1931,157 @@ private <T> PList<T> getPList(List<T> list, int
startIndex, int maxEntries, Stri
return new PList<>(subList, startIndex, maxEntries, list.size(),
subList.size(), sortType, sortBy);
}
+ private void enforceViewOnSharedResource(RangerSharedResource
sharedResource) {
+ if (!bizUtil.isAuditAdmin()) {
+ RangerDataShare dataShare =
getCachedDataShare(sharedResource.getDataShareId(), new HashMap<>());
+
+ if (dataShare == null || !hasViewPermission(dataShare.getAcl())) {
+ throw
restErrorUtil.create403RESTException(NOT_AUTHORIZED_TO_VIEW_SHARED_RESOURCE);
+ }
+ }
+ }
+
+ private boolean hasViewOnDataShare(Long dataShareId, Map<Long,
RangerDataShare> dataShareCache) {
+ boolean ret = bizUtil.isAuditAdmin();
+ RangerDataShare dataShare = null;
+
+ if (!ret) {
+ dataShare = getCachedDataShare(dataShareId, dataShareCache);
+
+ if (dataShare != null) {
+ ret = hasViewPermission(dataShare.getAcl());
+ }
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnDataShareInDataset(RangerDataShareInDataset
dataShareInDataset, Map<Long, RangerDataShare> dataShareCache, Map<Long,
RangerDataset> datasetCache) {
+ boolean ret = hasViewOnDataShare(dataShareInDataset.getDataShareId(),
dataShareCache);
+
+ if (!ret) {
+ ret = hasViewOnDataset(dataShareInDataset.getDatasetId(),
datasetCache);
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnDatasetInProject(RangerDatasetInProject
datasetInProject, Map<Long, RangerDataset> datasetCache, Map<Long,
RangerProject> projectCache) {
+ boolean ret = hasViewOnDataset(datasetInProject.getDatasetId(),
datasetCache);
+
+ if (!ret) {
+ ret = hasViewOnProject(datasetInProject.getProjectId(),
projectCache);
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnDataset(Long datasetId, Map<Long, RangerDataset>
datasetCache) {
+ boolean ret = bizUtil.isAuditAdmin();
+ RangerDataset dataset = null;
+
+ if (!ret) {
+ dataset = getCachedDataset(datasetId, datasetCache);
+
+ if (dataset != null) {
+ ret = hasViewPermission(dataset.getAcl());
+ }
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnProject(Long projectId, Map<Long, RangerProject>
projectCache) {
+ boolean ret = bizUtil.isAuditAdmin();
Review Comment:
Shouldn't admin users be allowed as well?
```
boolean ret = bizUtil.isAdmin() || bizUtil.isAuditAdmin();
```
##########
security-admin/src/main/java/org/apache/ranger/biz/GdsDBStore.java:
##########
@@ -1908,6 +1931,157 @@ private <T> PList<T> getPList(List<T> list, int
startIndex, int maxEntries, Stri
return new PList<>(subList, startIndex, maxEntries, list.size(),
subList.size(), sortType, sortBy);
}
+ private void enforceViewOnSharedResource(RangerSharedResource
sharedResource) {
+ if (!bizUtil.isAuditAdmin()) {
+ RangerDataShare dataShare =
getCachedDataShare(sharedResource.getDataShareId(), new HashMap<>());
+
+ if (dataShare == null || !hasViewPermission(dataShare.getAcl())) {
+ throw
restErrorUtil.create403RESTException(NOT_AUTHORIZED_TO_VIEW_SHARED_RESOURCE);
+ }
+ }
+ }
+
+ private boolean hasViewOnDataShare(Long dataShareId, Map<Long,
RangerDataShare> dataShareCache) {
+ boolean ret = bizUtil.isAuditAdmin();
Review Comment:
Shouldn't admin users be allowed as well?
```
boolean ret = bizUtil.isAdmin() || bizUtil.isAuditAdmin();
```
##########
security-admin/src/main/java/org/apache/ranger/biz/GdsDBStore.java:
##########
@@ -1908,6 +1931,157 @@ private <T> PList<T> getPList(List<T> list, int
startIndex, int maxEntries, Stri
return new PList<>(subList, startIndex, maxEntries, list.size(),
subList.size(), sortType, sortBy);
}
+ private void enforceViewOnSharedResource(RangerSharedResource
sharedResource) {
+ if (!bizUtil.isAuditAdmin()) {
+ RangerDataShare dataShare =
getCachedDataShare(sharedResource.getDataShareId(), new HashMap<>());
+
+ if (dataShare == null || !hasViewPermission(dataShare.getAcl())) {
+ throw
restErrorUtil.create403RESTException(NOT_AUTHORIZED_TO_VIEW_SHARED_RESOURCE);
+ }
+ }
+ }
+
+ private boolean hasViewOnDataShare(Long dataShareId, Map<Long,
RangerDataShare> dataShareCache) {
+ boolean ret = bizUtil.isAuditAdmin();
+ RangerDataShare dataShare = null;
+
+ if (!ret) {
+ dataShare = getCachedDataShare(dataShareId, dataShareCache);
+
+ if (dataShare != null) {
+ ret = hasViewPermission(dataShare.getAcl());
+ }
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnDataShareInDataset(RangerDataShareInDataset
dataShareInDataset, Map<Long, RangerDataShare> dataShareCache, Map<Long,
RangerDataset> datasetCache) {
+ boolean ret = hasViewOnDataShare(dataShareInDataset.getDataShareId(),
dataShareCache);
+
+ if (!ret) {
+ ret = hasViewOnDataset(dataShareInDataset.getDatasetId(),
datasetCache);
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnDatasetInProject(RangerDatasetInProject
datasetInProject, Map<Long, RangerDataset> datasetCache, Map<Long,
RangerProject> projectCache) {
+ boolean ret = hasViewOnDataset(datasetInProject.getDatasetId(),
datasetCache);
+
+ if (!ret) {
+ ret = hasViewOnProject(datasetInProject.getProjectId(),
projectCache);
+ }
+
+ return ret;
+ }
+
+ private boolean hasViewOnDataset(Long datasetId, Map<Long, RangerDataset>
datasetCache) {
+ boolean ret = bizUtil.isAuditAdmin();
Review Comment:
Shouldn't admin users be allowed as well?
```
boolean ret = bizUtil.isAdmin() || bizUtil.isAuditAdmin();
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
