Examples with RangerPolicyResourceMatcher org.apache.ranger.plugin.policyresourcematcher.RangerPolicyResourceMatcher used on opensource projects

Example 1 with RangerPolicyResourceMatcher

use of org.apache.ranger.plugin.policyresourcematcher.RangerPolicyResourceMatcher in project ranger by apache.

the class ServiceDBStore method getMatchers.

List<RangerPolicyResourceMatcher> getMatchers(RangerServiceDef serviceDef, Map<String, String> filterResources, SearchFilter filter) {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> ServiceDBStore.getMatchers(filterResources=" + filterResources + ")");
    }
    List<RangerPolicyResourceMatcher> ret = new ArrayList<RangerPolicyResourceMatcher>();
    RangerServiceDefHelper serviceDefHelper = new RangerServiceDefHelper(serviceDef);
    String policyTypeStr = filter.getParam(SearchFilter.POLICY_TYPE);
    int[] policyTypes = RangerPolicy.POLICY_TYPES;
    if (StringUtils.isNotBlank(policyTypeStr)) {
        policyTypes = new int[1];
        policyTypes[0] = Integer.parseInt(policyTypeStr);
    }
    for (Integer policyType : policyTypes) {
        Set<List<RangerResourceDef>> validResourceHierarchies = serviceDefHelper.getResourceHierarchies(policyType, filterResources.keySet());
        if (LOG.isDebugEnabled()) {
            LOG.debug("Found " + validResourceHierarchies.size() + " valid resource hierarchies for key-set " + filterResources.keySet());
        }
        List<List<RangerResourceDef>> resourceHierarchies = new ArrayList<List<RangerResourceDef>>(validResourceHierarchies);
        for (List<RangerResourceDef> validResourceHierarchy : resourceHierarchies) {
            if (LOG.isDebugEnabled()) {
                LOG.debug("validResourceHierarchy:[" + validResourceHierarchy + "]");
            }
            Map<String, RangerPolicyResource> policyResources = new HashMap<String, RangerPolicyResource>();
            for (RangerResourceDef resourceDef : validResourceHierarchy) {
                policyResources.put(resourceDef.getName(), new RangerPolicyResource(filterResources.get(resourceDef.getName()), false, resourceDef.getRecursiveSupported()));
            }
            RangerDefaultPolicyResourceMatcher matcher = new RangerDefaultPolicyResourceMatcher();
            matcher.setServiceDef(serviceDef);
            matcher.setPolicyResources(policyResources, policyType);
            matcher.init();
            ret.add(matcher);
            if (LOG.isDebugEnabled()) {
                LOG.debug("Added matcher:[" + matcher + "]");
            }
        }
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== ServiceDBStore.getMatchers(filterResources=" + filterResources + ", " + ", count=" + ret.size() + ")");
    }
    return ret;
}

Example 2 with RangerPolicyResourceMatcher

use of org.apache.ranger.plugin.policyresourcematcher.RangerPolicyResourceMatcher in project ranger by apache.

the class RangerRequestedResources method isMutuallyExcluded.

public boolean isMutuallyExcluded(final List<RangerPolicyResourceMatcher> matchers, final Map<String, Object> evalContext) {
    boolean ret = true;
    int matchedCount = 0;
    if (!CollectionUtils.isEmpty(matchers) && !CollectionUtils.isEmpty(requestedResources) && requestedResources.size() > 1) {
        for (RangerAccessResource resource : requestedResources) {
            for (RangerPolicyResourceMatcher matcher : matchers) {
                if (matcher.isMatch(resource, evalContext) && matchedCount++ > 0) {
                    ret = false;
                    break;
                }
            }
        }
    }
    return ret;
}

Example 3 with RangerPolicyResourceMatcher

use of org.apache.ranger.plugin.policyresourcematcher.RangerPolicyResourceMatcher in project ranger by apache.

the class RangerHiveResourcesAccessedTogetherCondition method initializeMatchers.

private void initializeMatchers(List<String> mutuallyExclusiveResources) {
    for (String s : mutuallyExclusiveResources) {
        String policyResourceSpec = s.trim();
        RangerPolicyResourceMatcher matcher = buildMatcher(policyResourceSpec);
        if (matcher != null) {
            matchers.add(matcher);
        }
    }
}

Example 4 with RangerPolicyResourceMatcher

use of org.apache.ranger.plugin.policyresourcematcher.RangerPolicyResourceMatcher in project ranger by apache.

the class RangerHiveResourcesNotAccessedTogetherCondition method initializeMatchers.

private void initializeMatchers(List<String> mutuallyExclusiveResources) {
    for (String s : mutuallyExclusiveResources) {
        String policyResourceSpec = s.trim();
        RangerPolicyResourceMatcher matcher = buildMatcher(policyResourceSpec);
        if (matcher != null) {
            matchers.add(matcher);
        }
    }
}

Example 5 with RangerPolicyResourceMatcher

use of org.apache.ranger.plugin.policyresourcematcher.RangerPolicyResourceMatcher in project ranger by apache.

the class RangerHiveResourcesNotAccessedTogetherCondition method buildMatcher.

private RangerPolicyResourceMatcher buildMatcher(String policyResourceSpec) {
    RangerPolicyResourceMatcher matcher = null;
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerHiveResourcesNotAccessedTogetherCondition.buildMatcher(" + policyResourceSpec + ")");
    }
    // Works only for Hive serviceDef for now
    if (serviceDef != null && EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_HIVE_NAME.equals(serviceDef.getName())) {
        // Parse policyResourceSpec
        char separator = '.';
        String any = "*";
        Map<String, RangerPolicy.RangerPolicyResource> policyResources = new HashMap<>();
        String[] elements = StringUtils.split(policyResourceSpec, separator);
        RangerPolicy.RangerPolicyResource policyResource;
        if (elements.length > 0 && elements.length < 4) {
            if (elements.length == 3) {
                policyResource = new RangerPolicy.RangerPolicyResource(elements[2]);
            } else {
                policyResource = new RangerPolicy.RangerPolicyResource(any);
            }
            policyResources.put("column", policyResource);
            if (elements.length >= 2) {
                policyResource = new RangerPolicy.RangerPolicyResource(elements[1]);
            } else {
                policyResource = new RangerPolicy.RangerPolicyResource(any);
            }
            policyResources.put("table", policyResource);
            policyResource = new RangerPolicy.RangerPolicyResource(elements[0]);
            policyResources.put("database", policyResource);
            matcher = new RangerDefaultPolicyResourceMatcher();
            matcher.setPolicyResources(policyResources);
            matcher.setServiceDef(serviceDef);
            matcher.init();
        } else {
            LOG.error("RangerHiveResourcesNotAccessedTogetherCondition.buildMatcher() - Incorrect elements in the hierarchy specified (" + elements.length + ")");
        }
    } else {
        LOG.error("RangerHiveResourcesNotAccessedTogetherCondition.buildMatcher() - ServiceDef not set or ServiceDef is not for Hive");
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerHiveResourcesNotAccessedTogetherCondition.buildMatcher(" + policyResourceSpec + ")" + ", matcher=" + matcher);
    }
    return matcher;
}