[KYUUBI #7671][AUTHZ] Cover all injected authz rules in the excludedRules check - #7672
Open
alexandrefimov wants to merge 1 commit into
Open
[KYUUBI #7671][AUTHZ] Cover all injected authz rules in the excludedRules check#7672alexandrefimov wants to merge 1 commit into
alexandrefimov wants to merge 1 commit into
Conversation
…ludedRules check AuthzConfigurationChecker rejects a spark.sql.optimizer.excludedRules value that names org.apache.kyuubi.plugin.spark.authz.ranger, which was the whole extension when the check was written. Most rules live under org.apache.kyuubi.plugin.spark.authz.rule now, so a rule added there is outside the denylist. Match the extension's own package instead. Of the four optimizer rules the extension injects, the three in …authz.rule only strip markers after the check has run, so excluding one of them breaks the query rather than lifting a check - this is future-proofing rather than a live bypass, and it rejects configurations that are accepted today.
Contributor
Author
|
The one red check, Could someone re-run that job? The |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why are the changes needed?
Closes #7671, the follow-up @wForget asked for while reviewing #7637.
AuthzConfigurationCheckermatchesorg.apache.kyuubi.plugin.spark.authz.rangerin the effectivespark.sql.optimizer.excludedRules, which was the whole extension when the check was written. Most rules live underorg.apache.kyuubi.plugin.spark.authz.rulenow, so a rule added there is outside the denylist. This matches the extension's own package instead.It is future-proofing rather than a fix for a live bypass, and worth saying why.
spark.sql.optimizer.excludedRulesfilters optimizer batches only and Spark has no analyzer counterpart, so the resolution rules that apply masking and row filtering cannot be excluded at all. Of the four optimizer rulesRangerSparkExtensioninjects,RuleAuthorizationis in…authz.rangerand already covered; the other three —RuleEliminateMarker,RuleEliminatePermanentViewMarker,RuleEliminateTypeOf— only strip markers after the check has run, and excluding one of them breaks the query instead of lifting a check.The change does reject configurations that are accepted today, which is why it is separate from #7637 rather than part of it.
How was this patch tested?
A new case in
AuthzConfigurationCheckerSuitecovers the three…authz.rulerules by theirruleName, through both paths the checker guards: the value in effect, and theSETsyntax.30 tests green across
AuthzConfigurationCheckerSuite,DataMaskingForInMemoryParquetSuiteand the row filtering suite. With the constant reverted to the ranger package the new case fails, so it tests the change rather than the code around it.Was this patch authored or co-authored using generative AI tooling?
Assisted-by: Claude Opus 5