question Re: Ranger stacked policy evaluation with EXCLUDE switch in Archives of Support Questions (Read Only)

Ranger stacked policy evaluation with EXCLUDE switch

jknulst — Mon, 19 Aug 2019 08:54:06 GMT

Hi,

I have read the manual but I don't understand the behaviour of 2 policies I have regarding the same Hive table.

Policy 15 is a global allow policy on all Hive tables, all columns:

then I have policy 31 like this:

But whatever I try, user raj_ops still can run 'select * from employee' and get results.

Policy 31 is not evaluated as a 'deny' on the resource. I know you can add explicit Deny Conditons to the hive service, and I will try that. But the question is what the EXCLUDE switch (after the Hive column* box ) is good for when it is not picked up.

Re: Ranger stacked policy evaluation with EXCLUDE switch

dsharma — Tue, 18 Oct 2016 12:56:41 GMT

you mentioned there is a global allow policy , can you please attach screenshot of that too

Re: Ranger stacked policy evaluation with EXCLUDE switch

jknulst — Tue, 18 Oct 2016 13:28:14 GMT

@Deepak Sharma added in main question

Re: Ranger stacked policy evaluation with EXCLUDE switch

dsharma — Tue, 18 Oct 2016 13:48:43 GMT

@Jasper in policy 15 i can see you have added * resources for all and raj_ops is part of the user , so he is able to access all

Re: Ranger stacked policy evaluation with EXCLUDE switch

jknulst — Tue, 18 Oct 2016 13:57:26 GMT

@Deepak Sharma Yes, but I would expect that if 1 policy (15) says 'yes' and the other (31) says 'no', then it should be 'no' . As is stated in the schema in the manual

Re: Ranger stacked policy evaluation with EXCLUDE switch

dsharma — Tue, 18 Oct 2016 15:11:42 GMT

No @Jasper this will be the case when there is deny condition for raj_ops , then raj_ops will be denied from performing operation, but in current scenario you can see both are allow condition , in such case if any of the condtion match then it will be allowed , and even manual also says same !

Re: Ranger stacked policy evaluation with EXCLUDE switch

jknulst — Tue, 18 Oct 2016 17:37:05 GMT

For the moment I will not use this exclude switch because it behaves not as I (and my client) would expect. I will go for the Deny Conditions extension for the Hive service.

The exclude switch is confusing in that it seems to swap an allow into a deny, but it doesn't. It only excludes the resources from the policy

Re: Ranger stacked policy evaluation with EXCLUDE switch

jknulst — Tue, 18 Oct 2016 17:37:08 GMT

For the moment I will not use this exclude switch because it behaves not as I (and my client) would expect. I will go for the Deny Conditions extension for the Hive service.

The exclude switch is confusing in that it seems to swap an allow into a deny, but it doesn't. It only excludes the resources from the policy