ranger-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Colm O hEigeartaigh <cohei...@apache.org>
Subject Feedback request for https://reviews.apache.org/r/56094/
Date Wed, 08 Nov 2017 12:52:00 GMT
Hi,

A user logged an issue with Yarn that I finally got around to looking at.
The proposed patch submitted by the user is here:

https://reviews.apache.org/r/56094/

The problem is that a user "alice" can have the "submit-app" permission,
but be denied the "admin-queue" permission. This should work in theory, but
it doesn't. "admin-queue" implies "submit-app", but the Ranger policy logic
seems to interpret this implication incorrectly, in that a "negative"
admin-queue policy overrides a "positive" submit-app policy.

As the change is in the core policy logic I'd like an experienced reviewer
to take a look.

Colm.


-- 
Colm O hEigeartaigh

Talend Community Coder
http://coders.talend.com

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message