Uploaded image for project: 'Sentry'
  1. Sentry
  2. SENTRY-2372

SentryStore should not implement grantOptionCheck



    • Type: Improvement
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.1.0
    • Fix Version/s: 2.2.0
    • Component/s: Sentry, sentrystore
    • Labels:


      During functional testing it was found that SentryStore implementation contains logic that enforces sentry rights and depends on cluster-specific context. Specifically grantOptionCheck needs to be able to resolve hadoop user's groups and sentry admin groups configured on the cluster. 

      There are two problems with this:

      1. Some backends use SentryStore in a multi-tenant way and does have the context that SentryStore expects when it is used in cluster.
      2. Security enforcement logic shouldn't be in SentryStore if it is to be trusted. Since the backends Sentry API may be stateless the caller has to pass request context to such implementation backend together with the explicit SentryStore arguments. If the context (e.g. groups) is passed with the request the checks become unenforceable since caller controls variables on both sides of the comparison.

      The recommendation is to remove grantOptionCheck and SentryStore and to implement equivalent logic in SentryPolicyStoreProcessor.


        1. SENTRY-2372.1.patch
          121 kB
          Sergio Peña
        2. SENTRY-2372.2.patch
          159 kB
          Sergio Peña
        3. SENTRY-2372.3.patch
          157 kB
          Sergio Peña
        4. SENTRY-2372.4.patch
          51 kB
          Sergio Peña
        5. SENTRY-2372.5.patch
          47 kB
          Sergio Peña
        6. SENTRY-2372.6.patch
          143 kB
          Sergio Peña
        7. SENTRY-2372.7.patch
          149 kB
          Sergio Peña

          Issue Links



              • Assignee:
                spena Sergio Peña
                spena Sergio Peña
              • Votes:
                0 Vote for this issue
                1 Start watching this issue


                • Created: