HDFS-17980. Propagate Rename.TO_TRASH in authorization context for external enforcers. - #8741
Open
sadanand48 wants to merge 3 commits into
Open
sadanand48 wants to merge 3 commits into
sadanand48 wants to merge 3 commits into
Conversation
…ternal enforcers.
|
🎊 +1 overall
This message was automatically generated. |
jojochuang
reviewed
Sep 17, 2026
jojochuang
left a comment
jojochuang
left a comment
Contributor
There was a problem hiding this comment.
looks good just some nits
| operationType.set(opType); | ||
| } | ||
|
|
||
| public static void setRenameToTrash(boolean value) { |
Contributor
There was a problem hiding this comment.
please add javadoc to explain what this flag mean.
Comment on lines
+3391
to
+3392
| } finally { | ||
| FSPermissionChecker.setRenameToTrash(false); |
Contributor
Sorry, didn't get this point. For the external authorization plugins, is it enough to use operation name and src/dest path? How will Ranger use this rename options. Thanks. |
Contributor
Author
This is mainly for compliance tracking in Ranger Audits as when trash is enabled rm and mv operations look identical . |
jojochuang
approved these changes
Sep 18, 2026
|
💔 -1 overall
This message was automatically generated. |
Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of PR
When HDFS Trash is enabled, rm is executed as an internal rename to .Trash using Options.Rename.TO_TRASH.
Today, external authorization plugins (for example Ranger via checkPermissionWithContext) receive operationName=rename, but do not get an explicit trash-intent signal. As a result, rm (to trash) and mv appear identical from authorization/audit context.
This JIRA proposes adding and propagating a dedicated context flag (for example renameToTrash) in INodeAttributeProvider.AuthorizationContext so external enforcers can distinguish:
rm with trash enabled -> operationName=rename, renameToTrash=true
mv -> operationName=rename, renameToTrash=false
rm skipTrash > operationName=delete
Scope (HDFS side)
Add renameToTrash field to AuthorizationContext and its builder/accessors.
Propagate the flag through FSPermissionChecker when building context for checkPermissionWithContext.
In FSNamesystem.renameTo(..., Options.Rename... options), set the flag based on presence of Options.Rename.TO_TRASH, and clear it in finally to avoid ThreadLocal leakage.
How was this patch tested?
Unit tests
For code changes:
declared according to the connector-specific documentation? Note: Automated CI
testing doesn't cover all cases so manual testing with cloud storage is still
required.
LICENSE,LICENSE-binary,NOTICE-binaryfiles?AI Tooling
If an AI tool was used:
where is the name of the AI tool used.
https://www.apache.org/legal/generative-tooling.html