From 369ed9c8bb4e2304067780a46c98fba9c4109b76 Mon Sep 17 00:00:00 2001 From: "e.tregubov" Date: Wed, 24 Jun 2026 07:05:25 -0700 Subject: [PATCH 1/2] ADH-8121 Add migration --- .../current/ranger_core_db_mysql.sql | 1 + .../current/ranger_core_db_oracle.sql | 1 + .../current/ranger_core_db_postgres.sql | 1 + .../current/ranger_core_db_sqlanywhere.sql | 2 + .../current/ranger_core_db_sqlserver.sql | 1 + .../PatchForTrinoSvcDefUpdate_J10064.java | 322 ++++++++++++++++++ 6 files changed, 328 insertions(+) create mode 100644 security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10064.java diff --git a/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql b/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql index 21bfe0a6c3b..d06d7879775 100644 --- a/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql +++ b/security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql @@ -1903,4 +1903,5 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10061',UTC_TIMESTAMP(),'Ranger 2.5.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10062',UTC_TIMESTAMP(),'Ranger 2.5.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10063',UTC_TIMESTAMP(),'Ranger 2.5.0',UTC_TIMESTAMP(),'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10064',UTC_TIMESTAMP(),'Ranger 2.6.0',UTC_TIMESTAMP(),'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('JAVA_PATCHES',UTC_TIMESTAMP(),'Ranger 1.0.0',UTC_TIMESTAMP(),'localhost','Y'); diff --git a/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql b/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql index 7c655b17ed4..4ec797d5548 100644 --- a/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql +++ b/security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql @@ -2097,5 +2097,6 @@ INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,act INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'J10061',sys_extract_utc(systimestamp),'Ranger 2.5.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'J10062',sys_extract_utc(systimestamp),'Ranger 2.5.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'J10063',sys_extract_utc(systimestamp),'Ranger 2.5.0',sys_extract_utc(systimestamp),'localhost','Y'); +INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'J10064',sys_extract_utc(systimestamp),'Ranger 2.6.0',sys_extract_utc(systimestamp),'localhost','Y'); INSERT INTO x_db_version_h (id,version,inst_at,inst_by,updated_at,updated_by,active) VALUES (X_DB_VERSION_H_SEQ.nextval,'JAVA_PATCHES',sys_extract_utc(systimestamp),'Ranger 1.0.0',sys_extract_utc(systimestamp),'localhost','Y'); commit; diff --git a/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql b/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql index 262f6b13668..ce1ebe53992 100644 --- a/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql +++ b/security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql @@ -2046,4 +2046,5 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10061',current_timestamp,'Ranger 2.5.0',current_timestamp,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10062',current_timestamp,'Ranger 2.5.0',current_timestamp,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10063',current_timestamp,'Ranger 2.5.0',current_timestamp,'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10064',current_timestamp,'Ranger 2.6.0',current_timestamp,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('JAVA_PATCHES',current_timestamp,'Ranger 1.0.0',current_timestamp,'localhost','Y'); diff --git a/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql b/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql index 4ad99b037c1..f06a230eae6 100644 --- a/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql +++ b/security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql @@ -2472,6 +2472,8 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active GO INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10063',CURRENT_TIMESTAMP,'Ranger 2.5.0',CURRENT_TIMESTAMP,'localhost','Y'); GO +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10064',CURRENT_TIMESTAMP,'Ranger 2.6.0',CURRENT_TIMESTAMP,'localhost','Y'); +GO INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('JAVA_PATCHES',CURRENT_TIMESTAMP,'Ranger 1.0.0',CURRENT_TIMESTAMP,'localhost','Y'); GO exit diff --git a/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql b/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql index 38902610ef8..9a2f0d655c1 100644 --- a/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql +++ b/security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql @@ -4265,5 +4265,6 @@ INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10061',CURRENT_TIMESTAMP,'Ranger 2.5.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10062',CURRENT_TIMESTAMP,'Ranger 2.5.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10063',CURRENT_TIMESTAMP,'Ranger 2.5.0',CURRENT_TIMESTAMP,'localhost','Y'); +INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('J10064',CURRENT_TIMESTAMP,'Ranger 2.6.0',CURRENT_TIMESTAMP,'localhost','Y'); INSERT INTO x_db_version_h (version,inst_at,inst_by,updated_at,updated_by,active) VALUES ('JAVA_PATCHES',CURRENT_TIMESTAMP,'Ranger 1.0.0',CURRENT_TIMESTAMP,'localhost','Y'); GO diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10064.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10064.java new file mode 100644 index 00000000000..397a01b2d7b --- /dev/null +++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10064.java @@ -0,0 +1,322 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.ranger.patch; + +import org.apache.commons.collections4.CollectionUtils; +import org.apache.log4j.Logger; +import org.apache.ranger.biz.ServiceDBStore; +import org.apache.ranger.common.GUIDUtil; +import org.apache.ranger.common.RangerValidatorFactory; +import org.apache.ranger.db.RangerDaoManager; +import org.apache.ranger.entity.XXService; +import org.apache.ranger.plugin.model.RangerPolicy; +import org.apache.ranger.plugin.model.RangerPolicyResourceSignature; +import org.apache.ranger.plugin.model.RangerServiceDef; +import org.apache.ranger.plugin.model.validation.RangerServiceDefValidator; +import org.apache.ranger.plugin.model.validation.RangerValidator.Action; +import org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil; +import org.apache.ranger.util.CLIUtil; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.beans.factory.annotation.Qualifier; +import org.springframework.stereotype.Component; +import org.springframework.transaction.PlatformTransactionManager; +import org.springframework.transaction.TransactionDefinition; +import org.springframework.transaction.TransactionStatus; +import org.springframework.transaction.support.TransactionCallback; +import org.springframework.transaction.support.TransactionTemplate; + +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +/** + * Re-applies the embedded Trino service-definition so that already-installed + * clusters pick up the "execute" and "grant" access types that ADH-8121 added + * to the schemafunction resource (accessTypeRestrictions). The previous Trino + * service-def patch (J10062) does not re-run on clusters where it is already + * marked applied in x_db_version_h, hence this new versioned patch. + */ +@Component +public class PatchForTrinoSvcDefUpdate_J10064 extends BaseLoader { + public static final String LOGIN_ID_ADMIN = "admin"; + public static final String WILDCARD_ASTERISK = "*"; + public static final String POlICY_NAME_FOR_ALL_SYSINFO = "all - sysinfo"; + public static final String POlICY_NAME_FOR_ALL_CATALOG_SCHEMA_FUNCTION = "all - catalog, schema, schemafunction"; + public static final String POlICY_NAME_FOR_ALL_QUERY = "all - queryid"; + public static final String POlICY_NAME_FOR_ALL_ROLE = "all - role"; + public static final String RESOURCE_SYSINFO = "sysinfo"; + public static final String RESOURCE_CATALOG = "catalog"; + public static final String RESOURCE_SCHEMA = "schema"; + public static final String RESOURCE_QUERYID = "queryid"; + public static final String RESOURCE_ROLE = "role"; + public static final String RESOURCE_SCHEMAFUNCTION = "schemafunction"; + public static final String ACCESS_TYPE_READ_SYSINFO = "read_sysinfo"; + public static final String ACCESS_TYPE_WRITE_SYSINFO = "write_sysinfo"; + public static final String ACCESS_TYPE_CREATE = "create"; + public static final String ACCESS_TYPE_DROP = "drop"; + public static final String ACCESS_TYPE_SHOW = "show"; + public static final String ACCESS_TYPE_GRANT = "grant"; + public static final String ACCESS_TYPE_REVOKE = "revoke"; + public static final String ACCESS_TYPE_EXECUTE = "execute"; + public static final String ACCESS_TYPE_SELECT = "select"; + private static final Logger logger = Logger.getLogger(PatchForTrinoSvcDefUpdate_J10064.class); + private static final String TRINO_SVC_DEF_NAME = EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TRINO_NAME; + @Autowired + GUIDUtil guidUtil; + @Autowired + ServiceDBStore svcDBStore; + @Autowired + @Qualifier(value = "transactionManager") + PlatformTransactionManager txManager; + @Autowired + private RangerDaoManager daoMgr; + @Autowired + private RangerValidatorFactory validatorFactory; + + public static void main(String[] args) { + logger.info("main()"); + try { + PatchForTrinoSvcDefUpdate_J10064 loader = (PatchForTrinoSvcDefUpdate_J10064) CLIUtil.getBean(PatchForTrinoSvcDefUpdate_J10064.class); + loader.init(); + while (loader.isMoreToProcess()) { + loader.load(); + } + logger.info("Load complete. Exiting!!!"); + System.exit(0); + } catch (Exception e) { + logger.error("Error loading", e); + System.exit(1); + } + } + + @Override + public void init() throws Exception { + // DO NOTHING + } + + @Override + public void printStats() { + logger.info("PatchForTrinoSvcDefUpdate_J10064 logs "); + } + + @Override + public void execLoad() { + logger.info("==> PatchForTrinoSvcDefUpdate_J10064.execLoad()"); + try { + TransactionTemplate txTemplate = new TransactionTemplate(txManager); + txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW); + try { + txTemplate.execute(new TransactionCallback() { + @Override + public Object doInTransaction(TransactionStatus status) { + RangerServiceDef dbRangerServiceDef = null; + RangerServiceDef embeddedTrinoServiceDef = null; + try { + embeddedTrinoServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(TRINO_SVC_DEF_NAME); + } catch (Exception ex) { + logger.error("Error while loading service-def: " + TRINO_SVC_DEF_NAME, ex); + } + if (embeddedTrinoServiceDef == null) { + logger.error("The embedded Trino service-definition does not exist."); + throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); + } + if (embeddedTrinoServiceDef != null) { + try { + dbRangerServiceDef = svcDBStore.getServiceDefByName(TRINO_SVC_DEF_NAME); + } catch (Exception e) { + logger.error("The Trino service-definition does not exist in ranger db."); + } finally { + if (dbRangerServiceDef == null) { + logger.error("The Trino service-definition does not exist."); + throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); + } + } + } + dbRangerServiceDef = updateTrinoSvcDef(embeddedTrinoServiceDef, dbRangerServiceDef); + if (dbRangerServiceDef != null) { + try { + createDefaultPolicies(dbRangerServiceDef); + } catch (Exception e) { + logger.error("Error while creating default ranger policies for " + TRINO_SVC_DEF_NAME + " service-def"); + throw new RuntimeException("Error while creating default ranger policies for " + TRINO_SVC_DEF_NAME + " service-def"); + } + } else { + logger.error("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); + throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); + } + return null; + } + }); + } catch (Throwable ex) { + logger.error("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); + throw new RuntimeException(ex.getMessage()); + } + } catch (Exception e) { + logger.error("Error while executing PatchForTrinoSvcDefUpdate_J10064, Error - ", e); + throw new RuntimeException(e.getMessage()); + } + logger.info("<== PatchForTrinoSvcDefUpdate_J10064.execLoad()"); + } + + private RangerServiceDef updateTrinoSvcDef(RangerServiceDef embeddedTrinoServiceDef, RangerServiceDef dbRangerServiceDef) { + logger.info("==> PatchForTrinoSvcDefUpdate_J10064.updateTrinoSvcDef()"); + RangerServiceDef ret = null; + try { + dbRangerServiceDef.setResources(embeddedTrinoServiceDef.getResources()); + dbRangerServiceDef.setAccessTypes(embeddedTrinoServiceDef.getAccessTypes()); + dbRangerServiceDef.setConfigs(embeddedTrinoServiceDef.getConfigs()); + RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(this.svcDBStore); + validator.validate(dbRangerServiceDef, Action.UPDATE); + ret = this.svcDBStore.updateServiceDef(dbRangerServiceDef); + logger.info(TRINO_SVC_DEF_NAME + " service-def has been updated"); + } catch (Exception e) { + logger.error("Error while updating" + TRINO_SVC_DEF_NAME + " service-def", e); + throw new RuntimeException(e); + } + logger.info("<== PatchForTrinoSvcDefUpdate_J10064.updateTrinoSvcDef()"); + return ret; + } + + private void createDefaultPolicies(RangerServiceDef dbRangerServiceDef) throws Exception { + List dbServices = daoMgr.getXXService().findByServiceDefId(dbRangerServiceDef.getId()); + if (CollectionUtils.isNotEmpty(dbServices)) { + for (XXService dbService : dbServices) { + addDefaultPolicies(dbService.getName(), null); + } + } + } + + private void addDefaultPolicies(String serviceName, String zoneName) throws Exception { + logger.info("===> addDefaultPolicies ServiceName : " + serviceName + " ZoneName : " + zoneName); + List resources = new ArrayList<>(); + resources.add(RESOURCE_SYSINFO); + RangerPolicy allSysInfoPolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_SYSINFO, resources); + List policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allSysInfoPolicy.getResourceSignature(), true); + if (CollectionUtils.isEmpty(policies)) { + logger.info("No policy found with resource sysinfo = * creating new policy"); + svcDBStore.createPolicy(allSysInfoPolicy); + } + + resources.clear(); + policies.clear(); + resources.add(RESOURCE_CATALOG); + resources.add(RESOURCE_SCHEMA); + resources.add(RESOURCE_SCHEMAFUNCTION); + RangerPolicy allCatalogSchemaFunctionPolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_CATALOG_SCHEMA_FUNCTION, resources); + policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allCatalogSchemaFunctionPolicy.getResourceSignature(), true); + if (CollectionUtils.isEmpty(policies)) { + logger.info("No policy found with resource catalog, schema, schemafunction = *; creating new policy"); + svcDBStore.createPolicy(allCatalogSchemaFunctionPolicy); + } + + resources.clear(); + policies.clear(); + resources.add(RESOURCE_QUERYID); + RangerPolicy allQueryIdPolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_QUERY, resources); + policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allQueryIdPolicy.getResourceSignature(), true); + if (CollectionUtils.isEmpty(policies)) { + logger.info("No policy found with resource queryId = *; creating new policy"); + svcDBStore.createPolicy(allQueryIdPolicy); + } + + resources.clear(); + policies.clear(); + resources.add(RESOURCE_ROLE); + RangerPolicy allRolePolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_ROLE, resources); + policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allRolePolicy.getResourceSignature(), true); + if (CollectionUtils.isEmpty(policies)) { + logger.info("No policy found with resource role = *; creating new policy"); + svcDBStore.createPolicy(allRolePolicy); + } + logger.info("<=== addDefaultPolicies"); + } + + private RangerPolicy getPolicy(String serviceName, String zoneName, String policyName, List resources) { + logger.info("===> getPolicy "); + RangerPolicy policy; + Map policyResources = new HashMap<>(); + for (String resource : resources) { + policyResources.put(resource, new RangerPolicy.RangerPolicyResource(WILDCARD_ASTERISK)); + } + policy = new RangerPolicy(); + policy.setService(serviceName); + policy.setName(policyName); + policy.setDescription("Policy for " + policyName); + policy.setIsAuditEnabled(true); + policy.setCreatedBy(LOGIN_ID_ADMIN); + policy.setResources(policyResources); + policy.setPolicyType(RangerPolicy.POLICY_TYPE_ACCESS); + policy.setGuid(guidUtil.genGUID()); + policy.setZoneName(zoneName); + List policyItems = new ArrayList<>(); + policyItems.add(getPolicyItem(policyName, "trino", true)); + policyItems.add(getPolicyItem("select", "rangerlookup", false)); + policy.setPolicyItems(policyItems); + policy.setResourceSignature(new RangerPolicyResourceSignature(policy).getSignature()); + if (logger.isDebugEnabled()) { + logger.debug("===> getPolicy policy ResourceSignature " + policy.getResourceSignature()); + logger.debug("===> getPolicy policy : " + policy); + } + logger.info("<=== getPolicy "); + return policy; + } + + private RangerPolicy.RangerPolicyItem getPolicyItem(String policyName, String user, boolean delegateAdmin) { + RangerPolicy.RangerPolicyItem policyItem = new RangerPolicy.RangerPolicyItem(); + policyItem.setUsers(new ArrayList() {{ + add(user); + }}); + policyItem.setAccesses(getAccessList(policyName)); + policyItem.setDelegateAdmin(delegateAdmin); + return policyItem; + } + + private List getAccessList(String policyName) { + List accessList = new ArrayList(); + switch (policyName) { + case POlICY_NAME_FOR_ALL_SYSINFO: + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_READ_SYSINFO)); + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_WRITE_SYSINFO)); + break; + case POlICY_NAME_FOR_ALL_CATALOG_SCHEMA_FUNCTION: + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_CREATE)); + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_DROP)); + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_SHOW)); + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_GRANT)); + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_EXECUTE)); + break; + case POlICY_NAME_FOR_ALL_ROLE: + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_CREATE)); + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_DROP)); + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_SHOW)); + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_GRANT)); + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_REVOKE)); + break; + case POlICY_NAME_FOR_ALL_QUERY: + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_EXECUTE)); + break; + default: + accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_SELECT)); + break; + } + return accessList; + } + +} From af8ec818b0cd5efe3a60d3b969ddf170f1587bcb Mon Sep 17 00:00:00 2001 From: "e.tregubov" Date: Fri, 26 Jun 2026 07:36:12 -0700 Subject: [PATCH 2/2] ADH-8121 Refactor --- security-admin/pom.xml | 11 + .../PatchForTrinoSvcDefUpdate_J10064.java | 266 +++++------------- 2 files changed, 84 insertions(+), 193 deletions(-) diff --git a/security-admin/pom.xml b/security-admin/pom.xml index bab23ae6dea..009f50712ec 100644 --- a/security-admin/pom.xml +++ b/security-admin/pom.xml @@ -31,6 +31,17 @@ 1.8 false + + + + org.apache.logging.log4j + log4j-bom + ${log4j2.version} + pom + import + + + aopalliance diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10064.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10064.java index 397a01b2d7b..6285887dc50 100644 --- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10064.java +++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10064.java @@ -21,12 +21,7 @@ import org.apache.commons.collections4.CollectionUtils; import org.apache.log4j.Logger; import org.apache.ranger.biz.ServiceDBStore; -import org.apache.ranger.common.GUIDUtil; import org.apache.ranger.common.RangerValidatorFactory; -import org.apache.ranger.db.RangerDaoManager; -import org.apache.ranger.entity.XXService; -import org.apache.ranger.plugin.model.RangerPolicy; -import org.apache.ranger.plugin.model.RangerPolicyResourceSignature; import org.apache.ranger.plugin.model.RangerServiceDef; import org.apache.ranger.plugin.model.validation.RangerServiceDefValidator; import org.apache.ranger.plugin.model.validation.RangerValidator.Action; @@ -41,53 +36,26 @@ import org.springframework.transaction.support.TransactionCallback; import org.springframework.transaction.support.TransactionTemplate; -import java.util.ArrayList; -import java.util.HashMap; -import java.util.List; -import java.util.Map; +import java.util.Set; /** - * Re-applies the embedded Trino service-definition so that already-installed - * clusters pick up the "execute" and "grant" access types that ADH-8121 added - * to the schemafunction resource (accessTypeRestrictions). The previous Trino - * service-def patch (J10062) does not re-run on clusters where it is already - * marked applied in x_db_version_h, hence this new versioned patch. + * Adds the "execute" and "grant" access types to the Trino "schemafunction" resource + * by augmenting only its accessTypeRestrictions in the DB-stored service-def, leaving the + * rest of the service-def and any existing policies untouched. Skips when there is nothing to do. */ @Component public class PatchForTrinoSvcDefUpdate_J10064 extends BaseLoader { - public static final String LOGIN_ID_ADMIN = "admin"; - public static final String WILDCARD_ASTERISK = "*"; - public static final String POlICY_NAME_FOR_ALL_SYSINFO = "all - sysinfo"; - public static final String POlICY_NAME_FOR_ALL_CATALOG_SCHEMA_FUNCTION = "all - catalog, schema, schemafunction"; - public static final String POlICY_NAME_FOR_ALL_QUERY = "all - queryid"; - public static final String POlICY_NAME_FOR_ALL_ROLE = "all - role"; - public static final String RESOURCE_SYSINFO = "sysinfo"; - public static final String RESOURCE_CATALOG = "catalog"; - public static final String RESOURCE_SCHEMA = "schema"; - public static final String RESOURCE_QUERYID = "queryid"; - public static final String RESOURCE_ROLE = "role"; public static final String RESOURCE_SCHEMAFUNCTION = "schemafunction"; - public static final String ACCESS_TYPE_READ_SYSINFO = "read_sysinfo"; - public static final String ACCESS_TYPE_WRITE_SYSINFO = "write_sysinfo"; - public static final String ACCESS_TYPE_CREATE = "create"; - public static final String ACCESS_TYPE_DROP = "drop"; - public static final String ACCESS_TYPE_SHOW = "show"; public static final String ACCESS_TYPE_GRANT = "grant"; - public static final String ACCESS_TYPE_REVOKE = "revoke"; public static final String ACCESS_TYPE_EXECUTE = "execute"; - public static final String ACCESS_TYPE_SELECT = "select"; private static final Logger logger = Logger.getLogger(PatchForTrinoSvcDefUpdate_J10064.class); private static final String TRINO_SVC_DEF_NAME = EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TRINO_NAME; @Autowired - GUIDUtil guidUtil; - @Autowired ServiceDBStore svcDBStore; @Autowired @Qualifier(value = "transactionManager") PlatformTransactionManager txManager; @Autowired - private RangerDaoManager daoMgr; - @Autowired private RangerValidatorFactory validatorFactory; public static void main(String[] args) { @@ -126,41 +94,7 @@ public void execLoad() { txTemplate.execute(new TransactionCallback() { @Override public Object doInTransaction(TransactionStatus status) { - RangerServiceDef dbRangerServiceDef = null; - RangerServiceDef embeddedTrinoServiceDef = null; - try { - embeddedTrinoServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(TRINO_SVC_DEF_NAME); - } catch (Exception ex) { - logger.error("Error while loading service-def: " + TRINO_SVC_DEF_NAME, ex); - } - if (embeddedTrinoServiceDef == null) { - logger.error("The embedded Trino service-definition does not exist."); - throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); - } - if (embeddedTrinoServiceDef != null) { - try { - dbRangerServiceDef = svcDBStore.getServiceDefByName(TRINO_SVC_DEF_NAME); - } catch (Exception e) { - logger.error("The Trino service-definition does not exist in ranger db."); - } finally { - if (dbRangerServiceDef == null) { - logger.error("The Trino service-definition does not exist."); - throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); - } - } - } - dbRangerServiceDef = updateTrinoSvcDef(embeddedTrinoServiceDef, dbRangerServiceDef); - if (dbRangerServiceDef != null) { - try { - createDefaultPolicies(dbRangerServiceDef); - } catch (Exception e) { - logger.error("Error while creating default ranger policies for " + TRINO_SVC_DEF_NAME + " service-def"); - throw new RuntimeException("Error while creating default ranger policies for " + TRINO_SVC_DEF_NAME + " service-def"); - } - } else { - logger.error("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); - throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); - } + loadTrinoServiceDef(); return null; } }); @@ -175,148 +109,94 @@ public Object doInTransaction(TransactionStatus status) { logger.info("<== PatchForTrinoSvcDefUpdate_J10064.execLoad()"); } - private RangerServiceDef updateTrinoSvcDef(RangerServiceDef embeddedTrinoServiceDef, RangerServiceDef dbRangerServiceDef) { + private void loadTrinoServiceDef() { + RangerServiceDef dbRangerServiceDef = null; + try { + dbRangerServiceDef = svcDBStore.getServiceDefByName(TRINO_SVC_DEF_NAME); + } catch (Exception e) { + logger.error("Error while reading the " + TRINO_SVC_DEF_NAME + " service-def from ranger db.", e); + } + if (dbRangerServiceDef == null) { + // Not every cluster has Trino enabled (e.g. via ranger.supportedcomponents), + // so the service-def may legitimately be absent. Skip instead of failing the upgrade. + logger.warn("The " + TRINO_SVC_DEF_NAME + " service-def does not exist in ranger db; nothing to update. Skipping patch."); + return; + } + updateTrinoSvcDef(dbRangerServiceDef); + } + + private void updateTrinoSvcDef(RangerServiceDef dbRangerServiceDef) { logger.info("==> PatchForTrinoSvcDefUpdate_J10064.updateTrinoSvcDef()"); - RangerServiceDef ret = null; try { - dbRangerServiceDef.setResources(embeddedTrinoServiceDef.getResources()); - dbRangerServiceDef.setAccessTypes(embeddedTrinoServiceDef.getAccessTypes()); - dbRangerServiceDef.setConfigs(embeddedTrinoServiceDef.getConfigs()); + RangerServiceDef.RangerResourceDef schemaFunctionResource = findSchemaFunctionResource(dbRangerServiceDef); + if (!validate(schemaFunctionResource)) { + // validate() already logged why there is nothing to do; skip without failing the upgrade. + logger.info("<== PatchForTrinoSvcDefUpdate_J10064.updateTrinoSvcDef()"); + return; + } + + Set accessTypeRestrictions = schemaFunctionResource.getAccessTypeRestrictions(); + accessTypeRestrictions.add(ACCESS_TYPE_EXECUTE); + accessTypeRestrictions.add(ACCESS_TYPE_GRANT); + schemaFunctionResource.setAccessTypeRestrictions(accessTypeRestrictions); + RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(this.svcDBStore); validator.validate(dbRangerServiceDef, Action.UPDATE); - ret = this.svcDBStore.updateServiceDef(dbRangerServiceDef); - logger.info(TRINO_SVC_DEF_NAME + " service-def has been updated"); + RangerServiceDef updatedSvcDef = this.svcDBStore.updateServiceDef(dbRangerServiceDef); + if (updatedSvcDef == null) { + logger.error("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); + throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def"); + } + logger.info(TRINO_SVC_DEF_NAME + " service-def has been updated: '" + RESOURCE_SCHEMAFUNCTION + "' now allows '" + ACCESS_TYPE_EXECUTE + "' and '" + ACCESS_TYPE_GRANT + "'"); } catch (Exception e) { - logger.error("Error while updating" + TRINO_SVC_DEF_NAME + " service-def", e); + logger.error("Error while updating " + TRINO_SVC_DEF_NAME + " service-def", e); throw new RuntimeException(e); } logger.info("<== PatchForTrinoSvcDefUpdate_J10064.updateTrinoSvcDef()"); - return ret; } - private void createDefaultPolicies(RangerServiceDef dbRangerServiceDef) throws Exception { - List dbServices = daoMgr.getXXService().findByServiceDefId(dbRangerServiceDef.getId()); - if (CollectionUtils.isNotEmpty(dbServices)) { - for (XXService dbService : dbServices) { - addDefaultPolicies(dbService.getName(), null); - } - } - } - - private void addDefaultPolicies(String serviceName, String zoneName) throws Exception { - logger.info("===> addDefaultPolicies ServiceName : " + serviceName + " ZoneName : " + zoneName); - List resources = new ArrayList<>(); - resources.add(RESOURCE_SYSINFO); - RangerPolicy allSysInfoPolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_SYSINFO, resources); - List policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allSysInfoPolicy.getResourceSignature(), true); - if (CollectionUtils.isEmpty(policies)) { - logger.info("No policy found with resource sysinfo = * creating new policy"); - svcDBStore.createPolicy(allSysInfoPolicy); - } - - resources.clear(); - policies.clear(); - resources.add(RESOURCE_CATALOG); - resources.add(RESOURCE_SCHEMA); - resources.add(RESOURCE_SCHEMAFUNCTION); - RangerPolicy allCatalogSchemaFunctionPolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_CATALOG_SCHEMA_FUNCTION, resources); - policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allCatalogSchemaFunctionPolicy.getResourceSignature(), true); - if (CollectionUtils.isEmpty(policies)) { - logger.info("No policy found with resource catalog, schema, schemafunction = *; creating new policy"); - svcDBStore.createPolicy(allCatalogSchemaFunctionPolicy); + /** + * Decides whether the 'schemafunction' resource needs (and can take) the 'execute'/'grant' update. + * Logs the reason and returns {@code false} when there is nothing to do, so the patch skips + * gracefully instead of failing the upgrade. + */ + private boolean validate(RangerServiceDef.RangerResourceDef schemaFunctionResource) { + if (!isResourcePresent(schemaFunctionResource)) { + logger.warn("The '" + RESOURCE_SCHEMAFUNCTION + "' resource does not exist in the " + TRINO_SVC_DEF_NAME + " service-def; nothing to update. Skipping patch."); + return false; } - - resources.clear(); - policies.clear(); - resources.add(RESOURCE_QUERYID); - RangerPolicy allQueryIdPolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_QUERY, resources); - policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allQueryIdPolicy.getResourceSignature(), true); - if (CollectionUtils.isEmpty(policies)) { - logger.info("No policy found with resource queryId = *; creating new policy"); - svcDBStore.createPolicy(allQueryIdPolicy); + if (!hasAccessTypeRestrictions(schemaFunctionResource)) { + // An empty/absent restriction set means every access type (including 'execute' and 'grant') + // is already allowed on this resource. Adding entries here would instead RESTRICT it, so skip. + logger.info("The '" + RESOURCE_SCHEMAFUNCTION + "' resource has no access-type restrictions; all access types are already allowed; nothing to update"); + return false; } - - resources.clear(); - policies.clear(); - resources.add(RESOURCE_ROLE); - RangerPolicy allRolePolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_ROLE, resources); - policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allRolePolicy.getResourceSignature(), true); - if (CollectionUtils.isEmpty(policies)) { - logger.info("No policy found with resource role = *; creating new policy"); - svcDBStore.createPolicy(allRolePolicy); + if (allowsExecuteAndGrant(schemaFunctionResource)) { + logger.info("The '" + RESOURCE_SCHEMAFUNCTION + "' resource already allows '" + ACCESS_TYPE_EXECUTE + "' and '" + ACCESS_TYPE_GRANT + "'; nothing to update"); + return false; } - logger.info("<=== addDefaultPolicies"); + return true; } - private RangerPolicy getPolicy(String serviceName, String zoneName, String policyName, List resources) { - logger.info("===> getPolicy "); - RangerPolicy policy; - Map policyResources = new HashMap<>(); - for (String resource : resources) { - policyResources.put(resource, new RangerPolicy.RangerPolicyResource(WILDCARD_ASTERISK)); - } - policy = new RangerPolicy(); - policy.setService(serviceName); - policy.setName(policyName); - policy.setDescription("Policy for " + policyName); - policy.setIsAuditEnabled(true); - policy.setCreatedBy(LOGIN_ID_ADMIN); - policy.setResources(policyResources); - policy.setPolicyType(RangerPolicy.POLICY_TYPE_ACCESS); - policy.setGuid(guidUtil.genGUID()); - policy.setZoneName(zoneName); - List policyItems = new ArrayList<>(); - policyItems.add(getPolicyItem(policyName, "trino", true)); - policyItems.add(getPolicyItem("select", "rangerlookup", false)); - policy.setPolicyItems(policyItems); - policy.setResourceSignature(new RangerPolicyResourceSignature(policy).getSignature()); - if (logger.isDebugEnabled()) { - logger.debug("===> getPolicy policy ResourceSignature " + policy.getResourceSignature()); - logger.debug("===> getPolicy policy : " + policy); + private RangerServiceDef.RangerResourceDef findSchemaFunctionResource(RangerServiceDef serviceDef) { + for (RangerServiceDef.RangerResourceDef resourceDef : serviceDef.getResources()) { + if (RESOURCE_SCHEMAFUNCTION.equals(resourceDef.getName())) { + return resourceDef; + } } - logger.info("<=== getPolicy "); - return policy; + return null; } - private RangerPolicy.RangerPolicyItem getPolicyItem(String policyName, String user, boolean delegateAdmin) { - RangerPolicy.RangerPolicyItem policyItem = new RangerPolicy.RangerPolicyItem(); - policyItem.setUsers(new ArrayList() {{ - add(user); - }}); - policyItem.setAccesses(getAccessList(policyName)); - policyItem.setDelegateAdmin(delegateAdmin); - return policyItem; + private boolean isResourcePresent(RangerServiceDef.RangerResourceDef resourceDef) { + return resourceDef != null; } - private List getAccessList(String policyName) { - List accessList = new ArrayList(); - switch (policyName) { - case POlICY_NAME_FOR_ALL_SYSINFO: - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_READ_SYSINFO)); - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_WRITE_SYSINFO)); - break; - case POlICY_NAME_FOR_ALL_CATALOG_SCHEMA_FUNCTION: - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_CREATE)); - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_DROP)); - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_SHOW)); - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_GRANT)); - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_EXECUTE)); - break; - case POlICY_NAME_FOR_ALL_ROLE: - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_CREATE)); - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_DROP)); - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_SHOW)); - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_GRANT)); - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_REVOKE)); - break; - case POlICY_NAME_FOR_ALL_QUERY: - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_EXECUTE)); - break; - default: - accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_SELECT)); - break; - } - return accessList; + private boolean hasAccessTypeRestrictions(RangerServiceDef.RangerResourceDef resourceDef) { + return CollectionUtils.isNotEmpty(resourceDef.getAccessTypeRestrictions()); } + private boolean allowsExecuteAndGrant(RangerServiceDef.RangerResourceDef resourceDef) { + Set accessTypeRestrictions = resourceDef.getAccessTypeRestrictions(); + return accessTypeRestrictions.contains(ACCESS_TYPE_EXECUTE) && accessTypeRestrictions.contains(ACCESS_TYPE_GRANT); + } }