feat(Ranger): refactor the logic when ranger performs ACL #1518

WHBANG · 2023-06-07T03:58:11Z

This patch fixes the judgment logic when ranger matches policies:

Traverse all resource policies
1. If the current policy matches deny_condition
  1. does not match any deny_exclude, returns kDenied, and the traversal ends
  2. A deny_exclude is matched, return kPending, and continue to the next policy judgment
2. No policy is matched or the return value is kPending, enter 2
Traverse all resource policies again
1. If the current policy matches allow_condition
  1. does not match any allow_exclude, returns kAllowed, and the traversal ends
  2. An allow_exclude is matched, return kPending, and continue to the next policy judgment
2. If the return value is kPending, it will return kDenied
dose not match any policy, return kDenied

As shown below:

                *** Ranger Policy Evaluation Flow ***
                    +-----------------+
                     \ Resource access \
                      \    request      \
                       +-------+---------+
                               |
                         +-----v-------+
                        /               \
                       /     Has a       \
         +-----N------+  resource policy  <----------------N-----------------+
         |             \  been matched ? /                                   |
         |              \               /                                    |
         |               +-----+-------+                                     |
         |                     |                                             |
         |                     Y                                             |
         |                     |                                             |
         |               +-----v-------+                  +-------------+    |
         |              /               \                /               \   |
         |             /    Has more     \              /   Has more      \  |
         |      +----->   policies with   +---N--+---->+  policies with    +-+
         |      |      \ Deny Condition? /       |      \ Allow Condition?/
         |      |       \               /        |       \               /
         |      |        +------+------+         |        +------+------+
         |      |               |                |               |
         |      |               Y                |               Y
         |      |               |                |               |
         |      |        +------v------+         |        +------v------+
         |      |       /    Request    \        |       /    Request    \
         |      |      / matches a deny  \       |      /matches an allow \
         |      +--N--+ condition in the  +      +--N--+ condition in the  +
         |      |      \     policy?     /       |      \    policy?      /
         |      |       \               /        |       \               /
         |      |        +------+------+         |        +------+------+
         |      |               |                |               |
         |      |               Y                |               Y
         |      |               |                |               |
         |      |        +------v------+         |        +------v------+
         |      |       /    Request    \        |       /    Request    \
         |      |      /  matches a deny \       |      / matches an allow\
         |      +--Y--+   exclude in the  +      +--Y--+   exclude in the  +
         |             \      policy?    /              \      policy?    /
         |              \               /                \               /
         |               +------+------+                  +------+------+
         |                      |                                |
         |                      N                                N
         |                      |                                |
   +-----v-----+         +------v------+                  +------v------+
   |    DENY   |         |    DENY     |                  |    ALLOW    |
   +-----------+         +-------------+                  +-------------+

src/runtime/ranger/ranger_resource_policy.cpp

src/runtime/ranger/ranger_resource_policy_manager.cpp

src/runtime/ranger/ranger_resource_policy.cpp

src/runtime/ranger/ranger_resource_policy_manager.cpp

src/runtime/ranger/ranger_resource_policy.cpp

src/runtime/ranger/ranger_resource_policy_manager.cpp

src/runtime/ranger/ranger_resource_policy_manager.h

src/runtime/test/ranger_resource_policy_manager_test.cpp

cr-gpt · 2023-06-14T11:30:29Z