[KYUUBI #7186] Introduce RuleFunctionAuthorization for persistent function calls authorization #7187
Conversation
...thz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/FunctionPrivilegesBuilderSuite.scala
Outdated
Show resolved
Hide resolved
|
Kindly ping @pan3793 , I’ve added a Ranger policy to cover the RuleFunctionAuthorization tests. Ready for review~ |
|
Kindly ping @pan3793 @bowenliang123 @packyan |
|
Kindly ping @pan3793 |
|
cc @bowenliang123 and @wForget, do you have time to take a look? |
|
|
||
| override def apply(v1: SparkSessionExtensions): Unit = { | ||
| v1.injectCheckRule(AuthzConfigurationChecker) | ||
| v1.injectCheckRule(RuleFunctionAuthorization) |
There was a problem hiding this comment.
Why not use injectOptimizerRule like RuleAuthorization? We should apply this rule after RuleApplyPermanentViewMarker to avoid checking functions in the view.
There was a problem hiding this comment.
During the injectOptimizerRule stage, some UDFs may be optimized away, which can prevent permission control. For example, in the SQL:
SELECT my_to_upper("AaaAe") AS col_upper, my_constant() AS col_constant;
Here, my_to_upper converts a string to uppercase, and my_constant returns a constant value. Using injectCheckRule, these two UDFs can be detected,
Project [HiveSimpleUDF#xxx.xxx.hive.custom.ToUpperCaseUDF(AaaAe) AS col_upper#4, HiveSimpleUDF#xxx.xxx.hive.custom.ConstantUDF() AS col_constant#5]
+- OneRowRelation
but during the injectOptimizerRule stage, they will be optimized to their resulting values.
Project [AAAAE AS col_upper#4, 10086 AS col_constant#5]
+- OneRowRelation
| import org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils._ | ||
|
|
||
| case class RuleFunctionAuthorization(spark: SparkSession) extends (LogicalPlan => Unit) { | ||
| override def apply(plan: LogicalPlan): Unit = { |
There was a problem hiding this comment.
Can we make this rule configurable? It might not always be necessary.
There was a problem hiding this comment.
Sure, let me add a config to make this rule configurable.
3 participants
Why are the changes needed?
Close #7186
How was this patch tested?
Add new UTs and verified in a cluster with ranger hive spark service.
Was this patch authored or co-authored using generative AI tooling?
No