Functional adjustments and behavioral updates for Ranger are introduced in Cloudera
Runtime 7.1.9 SP2.
- READ permission now required for Ozone key create/delete operations
- Summary:
READ permission is now required for Ozone key
create/delete operations
- Previous behavior:
Earlier, while performing file creation
on Ozone, only create and write permissions were
checked on the Ozone key resource. Similarly, for file deletion, only the
delete permission was checked. No read
permission was required for either operation.
With Ranger RMS enabled, Ozone
filesystem’s create/write access was correctly translated to Hive
create/update permissions, and Ozone
delete access was correctly translated to Hive
Drop permissions; without needing any
read/select grant.
- New behavior:
Ozone now calls
getFileStatus before executing create,
write, or delete operations on keys. This
getFileStatus call performs a READ permission
check. If the user lacks read access to the Ozone key resource, the
request is denied with a READ permission error, even if the user has the correct
create, write, or delete
permissions.
When Ranger RMS is enabled, users now additionally need
select permission (the Hive equivalent of read)
in their Hive policy to perform create or delete operations on the underlying Ozone
filesystem.
