acruise commented on code in PR #7594: URL: https://github.com/apache/kyuubi/pull/7594#discussion_r3797816580
########## extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ParanoidMode.scala: ########## @@ -0,0 +1,155 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.kyuubi.plugin.spark.authz + +import java.util.concurrent.ConcurrentHashMap +import java.util.concurrent.atomic.LongAdder + +import org.apache.spark.sql.SparkSession +import org.apache.spark.sql.catalyst.plans.logical.LogicalPlan +import org.slf4j.LoggerFactory + +/** + * Handling for plan nodes that fall outside the plugin's recognition machinery + * ("paranoid mode"). + * + * The privilege builder classifies plan nodes by pattern-matching against the command, + * scan and function spec files. Historically a node that fell through every match was + * silently treated as not-authz-relevant, i.e. the plugin failed open. This object + * centralizes the policy applied when such a node is encountered: + * + * - `allow`: legacy behavior, log at DEBUG only + * - `warn`: log at WARN once per (class name, violation kind) per JVM (default) + * - `deny`: throw [[AccessControlException]], failing the query closed + * + * configured via `spark.kyuubi.authz.unclassifiedNode.behavior`. + * + * Nodes that are genuinely not authz-relevant are declared in + * `known_harmless_spec.json`, each with a human-reviewed reason. + */ +object ParanoidMode { + + final private val LOG = LoggerFactory.getLogger(getClass) + + final val UNCLASSIFIED_NODE_BEHAVIOR_KEY = "spark.kyuubi.authz.unclassifiedNode.behavior" + + object Behavior extends Enumeration { + type Behavior = Value + val ALLOW: Value = Value("allow") + val WARN: Value = Value("warn") + val DENY: Value = Value("deny") + } + + /** The kinds of classification violations, used in log/error messages and dedup keys. */ + object ViolationKind extends Enumeration { + type ViolationKind = Value + + /** A `Command` with no entry in any command spec file (fail-open layer 1). */ + val UNCLASSIFIED_COMMAND: Value = Value("unclassified command") + + /** A leaf plan node not matched by any scan spec (fail-open layer 2). */ + val UNCLASSIFIED_LEAF: Value = Value("unclassified leaf node") + + /** A node matched by a scan spec but not resolved, so no privileges were extracted. */ + val UNRESOLVED_SCAN: Value = Value("unresolved scan node") + + /** + * A node whose class name has a command spec entry, encountered on the query path: + * the spec exists but the dispatch never reaches it (the CALL-on-Spark-4 shape). + */ + val UNREACHABLE_SPEC: Value = Value("command spec not reachable from dispatch") + + /** + * A node that executes during analysis (e.g. Spark 4's `ExecutableDuringAnalysis`): + * by the time authorization rules run it may already have produced side effects. + */ + val ANALYSIS_TIME_EXECUTION: Value = Value("node executes during analysis") + + /** + * A matched spec whose extractors all failed against the current plan shape + * (fail-open layer 3, typically Spark version drift). + */ + val EXTRACTION_FAILURE: Value = Value("spec matched but extraction failed") + } + + import Behavior._ + import ViolationKind.ViolationKind + + def behavior(spark: SparkSession): Behavior = { + val raw = spark.conf.getOption(UNCLASSIFIED_NODE_BEHAVIOR_KEY).getOrElse(WARN.toString) Review Comment: thanks, 32a79a9625e1e7350621d663ea29435e47e70eeb :) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
