Mahesh Bandal created RANGER-5825:
-------------------------------------
Summary: Fix HDFS authz optimization bypass on directory rename
Key: RANGER-5825
URL: https://issues.apache.org/jira/browse/RANGER-5825
Project: Ranger
Issue Type: Bug
Components: Ranger
Affects Versions: 3.0.0
Reporter: Mahesh Bandal
Assignee: Mahesh Bandal
When ranger.hdfs.authz.enable.optimization is enabled (default), rename of a
directory inode could be short-circuited to allow without Ranger policy
evaluation on the source path. That could permit moving or trashing
directories the user is not authorized to modify on the source, while checks
on the destination (e.g. the user's .Trash) still succeed.
Align directory rename handling with the existing optimized delete path so
substantive rename checks are evaluated. File renames and other optimized
operations are unchanged.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
