[SENTRY-1474] createSentryRole() isn't thread-safe

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 1.7.0, 2.0.0
• Component/s: Core
• Assignee: Alex Leblang
• Reporter: Alex Kolbasov
• Created: 18/Sep/16 20:56
• Updated: 24/Jul/17 15:36
• Resolved: 26/Sep/16 20:26

Description

Here is the function createSentryRole():

  public CommitContext createSentryRole(String roleName)
      throws SentryAlreadyExistsException, SentryStandbyException {
    boolean rollbackTransaction = true;
    PersistenceManager pm = null;
    try {
      pm = openTransaction();
      createSentryRoleCore(pm, roleName);
      CommitContext commit = commitUpdateTransaction(pm);
      rollbackTransaction = false;
      return commit;
    } finally {
       ...
    }
  }

And here is createSentryRoleCore():

  private void createSentryRoleCore(PersistenceManager pm, String roleName)
      throws SentryAlreadyExistsException {
    String trimmedRoleName = trimAndLower(roleName);
    MSentryRole mSentryRole = getMSentryRole(pm, trimmedRoleName);
    if (mSentryRole == null) {
      MSentryRole mRole = new MSentryRole(trimmedRoleName, System.currentTimeMillis());
      pm.makePersistent(mRole);
    } else {
      throw new SentryAlreadyExistsException("Role: " + trimmedRoleName);
    }
  }

The problem is that after the call to getMSentryRole() the role can be added by another thread. So we will successfully add two instances of a role with the same name. After that calls to getMSentryRole() with this name will fail because we have two instances with the same name.

Issue Links

• blocks: SENTRY-872 Uber jira for HMS HA + Sentry HA redesign