Community Articles

Find and share helpful community-sourced technical articles.
Announcements
Celebrating as our community reaches 100,000 members! Thank you!
Labels (1)
avatar
Master Mentor

NiFi Restricted components are those processors, controller services, or reporting tasks that have the ability to run user-defined code or access/alter localhost filesystem data.

-

The NiFi User guide explains this as follows:

-----------------------------------------

Restricted components will be marked with a Screen Shot 2020-09-18 at 2.28.10 PM.png icon next to their name. These are components that can be used to execute arbitrary unsanitized code provided by the operator through the NiFi REST API/UI or can be used to obtain or alter data on the NiFi host system using the NiFi OS credentials. These components could be used by an otherwise authorized NiFi user to go beyond the intended use of the application, escalate privilege, or could expose data about the internals of the NiFi process or the host system. All of these capabilities should be considered privileged, and admins should be aware of these capabilities and explicitly enable them for a subset of trusted users. Before a user is allowed to create and modify restricted components they must be granted access.

------------------------------------------

Users can only be restricted from adding such components in NiFi if NiFi has to be secured. Users of an unsecured NiFi will always have access to all components.

-

Prior to HDF 3.2 or Apache NiFi 1.6, all restricted components were covered by a single authorization policy:

Ranger Policy (Base policies):NiFi Policies (Hamburger menu)Ranger permissions description:
/restricted-componentsAccess restricted componentsRead/View - N/A

Write/Modify - Gives granted users the ability to add components to the canvas that are tagged as “restricted”

-

It was decided that lumping all components into one policy was not ideal. So NIFI-4885 was created to address this so that users' access to restricted components would be based on the level of restricted access they are being granted.

  • read-filesystem
  • read-distributed-filesystem
  • write-filesystem
  • write-distributed-filesystem
  • execute=code
  • access-keytab
  • export-nifi-details

-

In order to avoid backward compatibility issues when users upgrade to a HDF 3.2+ or Apache NiFi 1.6.0+, the “Access restricted components” base policy still exists and defaults to "regardless of restrictions". In the NiFi global “Access Policies” UI, this is the default policy and is depicted as follows:

MattWho_0-1644348900340.png

 

In Ranger, this is still associated with just the “/restricted-components” policy. The four new policies are depicted as follows in Ranger and NiFi UIs:

-

Ranger Policy (Base policies):NiFi Policies (Hamburger menu)Ranger permissions description:
/restricted-components/read-filesystemAccess restricted componentsSub policy:Requiring ‘read filesystem’Read/View - N/A

Write/Modify - Allows users to create/modify restricted components requiring read filesystem.

/restricted-components/read-distributed-filesystemAccess restricted componentsSub policy:Requiring ‘read distributed filesystem’ Read/View - N/A

Write/Modify - Allows users to create/modify restricted components requiring read distributed filesystem.

/restricted-components/write-filesystemAccess restricted componentsSub policy:Requiring ‘write filesystem’Read/View - N/A
Write/Modify - Allows users to create/modify restricted components requiring write filesystem.
/restricted-components/write-distributed-filesystem Access restricted componentsSub policy:Requiring ‘write distributed filesystem’Read/View - N/A
Write/Modify - Allows users to create/modify restricted components requiring write distributed filesystem.
/restricted-components/execute-codeAccess restricted componentsSub policy:Requiring ‘execute code’Read/View - N/A
Write/Modify - Allows users to create/modify restricted components requiring read filesystem.
/restricted-components/access-keytabAccess restricted components

Sub policy:Requiring ‘access keytab’

Read/View - N/A
Write/Modify - Allows users to create/modify restricted components requiring read filesystem.
/restricted-components/export-nifi-detailsAccess restricted components

Sub policy:Requiring ‘export nifi details’

Read/View - N/A
Write/Modify - Allows users to create/modify restricted components requiring read filesystem.

-

Below is a list of restricted components for each of the above sub-policies (current as of CFM 2.1.1 and Apache NiFi 1.13):

Read-filesystem:

NiFi component:Component type:Access provisions:
FetchFileProcessorProvides operator the ability to read from any file that NiFi has access to.
TailFile Processor Provides operator the ability to read from any file that NiFi has access to.
 GetFile Processor Provides operator the ability to read from any file that NiFi has access to.

-

Read-Distributed-Filesystem: (Added NiFi 1.13)

NiFi component:Component type:Access provisions:
FetchHDFSProcessorProvides operator the ability to retrieve any file that NiFi has access to in HDFS or the local filesystem.
FetchParquetProcessorProvides operator the ability to retrieve any file that NiFi has access to in HDFS or the local filesystem.
GetHDFSProcessorProvides operator the ability to retrieve any file that NiFi has access to in HDFS or the local filesystem.
GetHDFSSequenceFileProcessorProvides operator the ability to retrieve any file that NiFi has access to in HDFS or the local filesystem.
MoveHDFSProcessorProvides operator the ability to retrieve any file that NiFi has access to in HDFS or the local filesystem.

-

Write-filesystem:

NiFi component:Component type:Access provisions:
FetchFileProcessorProvides operator the ability to delete any file that NiFi has access to.
GetFileProcessorProvides operator the ability to delete any file that NiFi has access to.
PutFileProcessorProvides operator the ability to write to any file that NiFi has access to.

-

Write-Distributed-Filesystem: (Added NiFi 1.13)

NiFi component:Component type:Access provisions:
DeleteHDFSProcessorProvides operator the ability to delete any file that NiFi has access to in HDFS or the local filesystem.
GetHDFSProcessorProvides operator the ability to delete any file that NiFi has access to in HDFS or the local filesystem.
GetHDFSSequenceFileProcessorProvides operator the ability to delete any file that NiFi has access to in HDFS or the local filesystem.
MoveHDFSProcessorProvides operator the ability to delete any file that NiFi has access to in HDFS or the local filesystem.
PutHDFSProcessorProvides operator the ability to delete any file that NiFi has access to in HDFS or the local filesystem.
PutParquetProcessorProvides operator the ability to write any file that NiFi has access to in HDFS or the local filesystem.

-

Execute-code:

NiFi component:Component type:Access provisions:
ScriptedReportingTaskReporting TaskProvides operator the ability to execute arbitrary code assuming all permissions that NiFi has.
ScriptedLookupServiceController ServiceProvides operator the ability to execute arbitrary code assuming all permissions that NiFi has.
ScriptedReaderController ServiceProvides operator the ability to execute arbitrary code assuming all permissions that NiFi has.
ScriptedRecordSetWriterController ServiceProvides operator the ability to execute arbitrary code assuming all permissions that NiFi has.
ExecuteFlumeSinkProcessorProvides operator the ability to execute arbitrary Flume configurations assuming all permissions that NiFi has.
ExecuteFlumeSourceProcessorProvides operator the ability to execute arbitrary Flume configurations assuming all permissions that NiFi has.
ExecuteGroovyScriptProcessorProvides operator the ability to execute arbitrary code assuming all permissions that NiFi has.
ExecuteProcessProcessorProvides operator the ability to execute arbitrary code assuming all permissions that NiFi has.
ExecuteScriptProcessorProvides operator the ability to execute arbitrary code assuming all permissions that NiFi has.
ExecuteStreamCommandProcessorProvides operator the ability to execute arbitrary code assuming all permissions that NiFi has.
invokeScriptedProcessorProcessorProvides operator the ability to execute arbitrary code assuming all permissions that NiFi has.

-

access-keytab:

NiFi component:Component type:Access provisions:
KeytabCredentialsServiceController ServiceAllows user to define a Keytab and principal that can then be used by other components.

-

Export-nifi-details:

NiFi component:Component type:Access provisions:
SiteToSiteBulletinReportingTaskReporting TaskProvides operator the ability to send sensitive details contained in bulletin events to any external system.
SiteToSiteProvenanceReportingTaskReporting TaskProvides operator the ability to send sensitive details contained in Provenance events to any external system.

-

***Note: Some components may be found under multiple sub-policies above. In order for a user to utilize that component, they must be granted access to every sub policy required by that component.

-

Exceptions in HDF 3.2 and Apache 1.7 and 1.8:

In order to use the following components, users must have full access to all restricted components policies:

NiFi component:Component type:Access provisions:
PutORCProcessorThis component requires access to restricted components regardless of restriction. Apache Jira: NIFI-5815

-

A full breakdown of all other NiFi Policies can be found here:

NiFi Ranger based policy descriptions - Cloudera Community

6,569 Views
Version history
Last update:
‎02-08-2022 11:47 AM
Updated by:
Contributors