RANGER-5745 - Ranger: Support for wildcard in table name on SQL row f… - #1220
Open
rgupta94 wants to merge 2 commits into
Open
RANGER-5745 - Ranger: Support for wildcard in table name on SQL row f…#1220rgupta94 wants to merge 2 commits into
rgupta94 wants to merge 2 commits into
Conversation
…ilter policy # Conflicts: # dev-support/checkstyle-suppressions.xml # security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql # security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql # security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql # security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql # security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql
rgupta94
force-pushed
the
RANGER-5745
branch
from
September 9, 2026 12:24
1c172a6 to
1777545
Compare
rameeshm
reviewed
Sep 9, 2026
| "resources": [ | ||
| { "name": "database", "matcherOptions": { "wildCard": "false" }, "lookupSupported": true, "mandatory": true, "uiHint": "{ \"singleValue\":true }" }, | ||
| { "name": "table", "matcherOptions": { "wildCard": "false" }, "lookupSupported": true, "mandatory": true, "uiHint": "{ \"singleValue\":true }" } | ||
| { "name": "table", "matcherOptions": { "wildCard": "true" }, "lookupSupported": true, "mandatory": true, "uiHint": "" } |
Contributor
There was a problem hiding this comment.
@rgupta94 Ranger has a functionality of not to allow insert/update of table which has rowfilter / column masking in it and this will present the users from insert / update of the table in the database. Please check it out. There is a check in isBlockAccessIfRowfilterColumnMaskSpecified in RangerHiveAuthorizer which cause this issue. May be we should document this say that "applying a wildcard row filter will trigger RangerHivePlugin.blockUpdateIfRowfilterColumnMaskSpecified, effectively blocking all UPDATE/ALTER commands for that user across the entire database. Users should be advised to apply these wildcard policies strictly to Read-Only roles or disable the property in ranger-hive-security.xml." Also add some test cases for this in Hive Plugin. CC @mneethiraj
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Adds a Ranger admin patch (J10068) to enable wildcard matching for Hive row-filter policies at the table resource level, allowing a single policy to target all tables in a DB.
Changes:
- Update the embedded Hive service-def so the row-filter
tableresource supports wildcards (wildCard: true). - Add a Java patch (
PatchForHiveServiceDefUpdate_J10068) to apply the embedded row-filtertableresource settings to the DB service-def (with defOptions preservation logic). - Add unit tests and register DB version entries for multiple DB vendors.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10068.java | Implements patch logic to copy row-filter table matcher options (and uiHint) from embedded Hive service-def into DB. |
| security-admin/src/test/java/org/apache/ranger/patch/TestPatchForHiveServiceDefUpdate_J10068.java | Adds unit tests covering patch success/failure paths and option-preservation behavior. |
| agents-common/src/main/resources/service-defs/ranger-servicedef-hive.json | Enables wildcard matching for the Hive table resource in row filters (and changes uiHint). |
| agents-common/src/test/resources/test_servicedef-normalize.json | Updates expected normalized service-def to reflect wildcard-enabled Hive table row-filter resource. |
| security-admin/db//optimized/current/ranger_core_db_.sql | Adds J10068 to x_db_version_h seed data. |
| dev-support/checkstyle-suppressions.xml | Suppresses checkstyle TypeName for the new patch class. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "resources": [ | ||
| { "name": "database", "matcherOptions": { "wildCard": "false" }, "lookupSupported": true, "mandatory": true, "uiHint": "{ \"singleValue\":true }" }, | ||
| { "name": "table", "matcherOptions": { "wildCard": "false" }, "lookupSupported": true, "mandatory": true, "uiHint": "{ \"singleValue\":true }" } | ||
| { "name": "table", "matcherOptions": { "wildCard": "true" }, "lookupSupported": true, "mandatory": true, "uiHint": "" } |
Comment on lines
+226
to
+245
| // fallback to earlier format: "name1=value1;name2=value2" | ||
| for (String optionString : jsonStr.split(";")) { | ||
| if (StringUtils.isEmpty(optionString)) { | ||
| continue; | ||
| } | ||
|
|
||
| String[] nvArr = optionString.split("="); | ||
| String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null; | ||
| String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null; | ||
|
|
||
| if (StringUtils.isEmpty(name)) { | ||
| continue; | ||
| } | ||
|
|
||
| if (ret == null) { | ||
| ret = new HashMap<>(); | ||
| } | ||
|
|
||
| ret.put(name, value); | ||
| } |
Comment on lines
+280
to
+300
| private void assertExecLoadFailsAndExits(PatchForHiveServiceDefUpdate_J10068 patch) { | ||
| SecurityManager original = System.getSecurityManager(); | ||
|
|
||
| try { | ||
| System.setSecurityManager(new SecurityManager() { | ||
| @Override | ||
| public void checkPermission(Permission perm) { | ||
| } | ||
|
|
||
| @Override | ||
| public void checkExit(int status) { | ||
| throw new SecurityException("Intercepted System.exit"); | ||
| } | ||
| }); | ||
| patch.execLoad(); | ||
| Assertions.fail("Expected SecurityException"); | ||
| } catch (SecurityException ignored) { | ||
| } finally { | ||
| System.setSecurityManager(original); | ||
| } | ||
| } |
Comment on lines
+413
to
+432
| private void invokeUpdateHiveServiceDef(PatchForHiveServiceDefUpdate_J10068 patch) throws Exception { | ||
| Method method = PatchForHiveServiceDefUpdate_J10068.class.getDeclaredMethod("updateHiveServiceDef"); | ||
| method.setAccessible(true); | ||
|
|
||
| try { | ||
| method.invoke(patch); | ||
| } catch (InvocationTargetException e) { | ||
| Throwable cause = e.getCause(); | ||
|
|
||
| if (cause instanceof Exception) { | ||
| throw (Exception) cause; | ||
| } | ||
|
|
||
| if (cause instanceof Error) { | ||
| throw (Error) cause; | ||
| } | ||
|
|
||
| throw e; | ||
| } | ||
| } |
…ilter policy - Incorporated review comments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We need a wildcard support for table names in Hive Row Level Filter policies (e.g. *), so one policy can cover multiple tables in a database instead of one policy per table. An upgrade patch updates the Hive service definition on existing Ranger installations to allow this in the Admin UI and enforce it at query time.