vyommani opened a new pull request, #1223:
URL: https://github.com/apache/ranger/pull/1223
## What changes were proposed in this pull request?
`RangerPolicyAdminImpl.isDelegatedAdminAccessAllowed()` authorizes a modify
on the access-type
delta between the submitted and stored policy. An empty delta was
substituted with `_admin`, which
any `delegateAdmin=true` item satisfies regardless of access-type. The delta
is empty for a DELETE
(stored policy is passed as-is) and for changes to `isEnabled`,
`policyPriority`,
`validitySchedules`, `conditions`, `isDenyAllElse` or the `delegateAdmin`
flag, so a delegated-admin
holding a single access-type on a resource could
delete/disable/re-prioritize a policy whose other
access-types are outside their delegation.
- `getAllModifiedAccessTypes()`: empty delta → full access-type set of the
stored policy, same as
the existing resource-changed branch.
- `isPolicyScopeChanged()`: a change to any of the fields above routes to
the resource-changed
branch (full set on old and new policy), so bundling one with an
otherwise-permitted access-type
change does not bypass the check.
- `collectAccessTypes()`: one `Set` per principal; the shared instance let
`addAll()` for one
principal leak into others and hide real changes.
Behaviour change: a delegated-admin with partial scope on a policy can no
longer delete, toggle,
re-prioritize, re-scope or grant `delegateAdmin` on it (they could not read
it before either).
Access-type add/remove is still authorized on the delta only. All changes
are deny-only.
## How was this patch tested?
- `TestRangerPolicyAdminImpl`:
delete/disable/re-prioritize/delegateAdmin-toggle/combined-change
denied for partial scope and allowed for full scope; delta-only regression
guard;
`isPolicyScopeChanged` per field; per-principal set isolation; recursive
flip (RANGER-1718).
- `TestServiceREST`: `deletePolicy(id)` → 403 when the modify check fails,
store not called.
- Manual on ranger-in-docker: partial-scope delegated-admin gets 403 on
DELETE, disable, priority
change and the combined PUT (previously 204/200); full-scope user still
succeeds.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
