[RANGER-3472] The createPolicy() method is not thread safe. In another word, we can create policies with same resources when creating policies concurrently

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.0
• Fix Version/s: 3.0.0
• Component/s: Ranger
• Assignee: Pradeep Agrawal
• Reporter: Xuze Yang
• Created: 09/Oct/21 02:07
• Updated: 29/Nov/21 09:54
• Resolved: 29/Nov/21 09:54

Description

In our production environment, we happen to find that two policies exist with the same resources.In this case, when we want to modify either policy, ranger doesn't allow this operation and throws message like "Error Code : 3010 Another policy already exists for matching resource: policy-name=[hhh9], service=[default-Hdfs]". 

I go through the source code about create policy, find that the createPolicy() in class ServiceREST is not thread safe. When we create policies concurrently, we may create several policies with the same resources.

Issue Links

• is fixed by: RANGER-3493 Add unique index on service and resource_signature column of x_policy table
• is fixed by: RANGER-3511 Create Java patch to update policy resource-signature to unique value.
• is fixed by: RANGER-3490 Make policy resource signature is unique in a service