add missing stub and use insert/delete permission on update column pe…

…rmission check
aakashnand · Apr 5, 2024 · e8926e7 · e8926e7
1 parent d60ba09
commit e8926e7
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 1 deletion.
diff --git a/...main/java/org/apache/ranger/authorization/trino/authorizer/RangerSystemAccessControl.java b/...main/java/org/apache/ranger/authorization/trino/authorizer/RangerSystemAccessControl.java
@@ -676,9 +676,19 @@ public void checkCanKillQueryOwnedBy(Identity identity, Identity queryOwner) {
     }
   }
 
+  /**
+   * This is evaluated on table column level
+   */
   @Override
   public void checkCanUpdateTableColumns(SystemSecurityContext securityContext, CatalogSchemaTableName table, Set<String> updatedColumnNames) {
-    SystemAccessControl.super.checkCanUpdateTableColumns(securityContext, table, updatedColumnNames);
+    // SystemAccessControl.super.checkCanUpdateTableColumns(securityContext, table, updatedColumnNames); // ALWAYS DENY
+    try {
+      // USE INSERT AND DELETE PERMISSIONS INSTEAD
+      checkCanInsertIntoTable(securityContext, table);
+      checkCanDeleteFromTable(securityContext, table);
+    } catch (AccessDeniedException ade) {
+      AccessDeniedException.denyUpdateTableColumns(table.toString(), updatedColumnNames);
+    }
   }
 
   /** FUNCTIONS **/

diff --git a/...main/java/org/apache/ranger/authorization/trino/authorizer/RangerSystemAccessControl.java b/...main/java/org/apache/ranger/authorization/trino/authorizer/RangerSystemAccessControl.java
@@ -396,6 +396,26 @@ public void checkCanKillQueryOwnedBy(Identity identity, Identity queryOwner) {
     }
   }
 
+  @Override
+  public void checkCanUpdateTableColumns(SystemSecurityContext securityContext, CatalogSchemaTableName table, Set<String> updatedColumnNames) {
+    try {
+      activatePluginClassLoader();
+      systemAccessControlImpl.checkCanUpdateTableColumns(securityContext, table, updatedColumnNames);
+    } finally {
+      deactivatePluginClassLoader();
+    }
+  }
+
+  @Override
+  public void checkCanAlterColumn(SystemSecurityContext context, CatalogSchemaTableName table) {
+    try {
+      activatePluginClassLoader();
+      systemAccessControlImpl.checkCanAlterColumn(context, table);
+    } finally {
+      deactivatePluginClassLoader();
+    }
+  }
+
   @Override
   public void checkCanShowCreateTable(SystemSecurityContext context, CatalogSchemaTableName table) {
     try {