hdfs.rego

package hdfs

import rego.v1

default allow := false
default matches_identity(identity) := false

# HDFS authorizer
allow if {
    some acl in acls
    matches_identity(acl.identity)
    matches_resource(input.path, acl.resource)
    action_sufficient_for_operation(acl.action, input.operationName)
}

# Identity mentions the (long) userName or shortUsername explicitly
matches_identity(identity) if {
    identity in {
        concat("", ["user:", input.callerUgi.userName]),
        concat("", ["shortUser:", input.callerUgi.shortUserName])
    }
}

# Identity regex matches the (long) userName
matches_identity(identity) if {
    match_entire(identity, concat("", ["userRegex:", input.callerUgi.userName]))
}

# Identity regex matches the shortUsername
matches_identity(identity) if {
    match_entire(identity, concat("", ["shortUserRegex:", input.callerUgi.shortUserName]))
}

# Identity mentions group the user is part of (by looking up using the (long) userName)
matches_identity(identity) if {
    some group in groups_for_user[input.callerUgi.userName]
    identity == concat("", ["group:", group])
}

# Identity regex matches group the user is part of (by looking up using the (long) userName)
matches_identity(identity) if {
    some group in groups_for_user[input.callerUgi.userName]
    match_entire(identity, concat("", ["groupRegex:", group]))
}

# Identity mentions group the user is part of (by looking up using the shortUserName)
matches_identity(identity) if {
    some group in groups_for_short_user_name[input.callerUgi.shortUserName]
    identity == concat("", ["group:", group])
}

# Identity regex matches group the user is part of (by looking up using the shortUserName)
matches_identity(identity) if {
    some group in groups_for_short_user_name[input.callerUgi.shortUserName]
    match_entire(identity, concat("", ["groupRegex:", group]))
}

# Resource mentions the file explicitly
matches_resource(file, resource) if {
    resource == concat("", ["hdfs:file:", file])
}

# Resource mentions the directory explicitly
matches_resource(file, resource) if {
    trim_suffix(resource, "/") == concat("", ["hdfs:dir:", file])
}

# Resource mentions a folder higher up the tree, which will will grant access recursively
matches_resource(file, resource) if {
    startswith(resource, "hdfs:dir:/")
    # directories need to have a trailing slash
    endswith(resource, "/")
    startswith(file, trim_prefix(resource, "hdfs:dir:"))
}

action_sufficient_for_operation(action, operation) if {
    action_hierarchy[action][_] == action_for_operation[operation]
}

action_hierarchy := {
    "full": ["full", "rw", "ro"],
    "rw": ["rw", "ro"],
    "ro": ["ro"],
}

match_entire(pattern, value) if {
	# Add the anchors ^ and $
	pattern_with_anchors := concat("", ["^", pattern, "$"])

	regex.match(pattern_with_anchors, value)
}

# To get a (hopefully complete) list of actions run "ack 'String operationName = '" in the hadoop source code
action_for_operation := {
    # The "rename" operation will be actually called on both - the source and the target location.
    # Because of this you need to have rw permissions on the source and target file - which is desired

    "abandonBlock": "rw",
    "addCacheDirective": "rw",
    "addCachePool": "full",
    "addErasureCodingPolicies": "full",
    "allowSnapshot": "full",
    "append": "rw",
    "cancelDelegationToken": "ro",
    "checkAccess": "ro",
    "clearQuota": "full",
    "clearSpaceQuota": "full",
    "completeFile": "rw",
    "computeSnapshotDiff": "full",
    "concat": "rw",
    "contentSummary": "ro",
    "create": "rw",
    "createEncryptionZone": "full",
    "createSnapshot": "full",
    "createSymlink": "rw",
    "delete": "rw",
    "deleteSnapshot": "full",
    "disableErasureCodingPolicy": "full",
    "disallowSnapshot": "full",
    "enableErasureCodingPolicy": "full",
    "finalizeRollingUpgrade": "full",
    "fsck": "full",
    "fsckGetBlockLocations": "full",
    "fsync": "rw",
    "gcDeletedSnapshot": "full",
    "getAclStatus": "ro",
    "getAdditionalBlock": "ro",
    "getAdditionalDatanode": "ro",
    "getDelegationToken": "ro",
    "getECTopologyResultForPolicies": "ro",
    "getErasureCodingCodecs": "ro",
    "getErasureCodingPolicies": "ro",
    "getErasureCodingPolicy": "ro",
    "getEZForPath": "ro",
    "getfileinfo": "ro",
    "getPreferredBlockSize": "ro",
    "getStoragePolicy": "ro",
    "getXAttrs": "ro",
    "isFileClosed": "ro",
    "listCacheDirectives": "ro",
    "listCachePools": "ro",
    "listCorruptFileBlocks": "ro",
    "listEncryptionZones": "ro",
    "listOpenFiles": "ro",
    "listReencryptionStatus": "ro",
    "ListSnapshot": "ro", # Yeah, this really starts with a capital letter
    "listSnapshottableDirectory": "ro",
    "listStatus": "ro",
    "listXAttrs": "ro",
    "mkdirs": "rw",
    "modifyAclEntries": "full",
    "modifyCacheDirective": "rw",
    "modifyCachePool": "full",
    "open": "ro",
    "queryRollingUpgrade": "ro",
    "quotaUsage": "ro",
    "recoverLease": "full",
    "reencryptEncryptionZone": "full",
    "removeAcl": "full",
    "removeAclEntries": "full",
    "removeCacheDirective": "rw",
    "removeCachePool": "full",
    "removeDefaultAcl": "full",
    "removeErasureCodingPolicy": "full",
    "removeXAttr": "rw",
    "rename": "rw",
    "renameSnapshot": "full",
    "renewDelegationToken": "ro",
    "satisfyStoragePolicy": "full",
    "setAcl": "full",
    "setErasureCodingPolicy": "full",
    "setOwner": "full",
    "setPermission": "full",
    "setQuota": "full",
    "setReplication": "full",
    "setSpaceQuota": "full",
    "setStoragePolicy": "full",
    "setTimes": "rw",
    "setXAttr": "rw",
    "startRollingUpgrade": "full",
    "truncate": "rw",
    "unsetErasureCodingPolicy": "full",
    "unsetStoragePolicy": "full",
}

# Actions I think are only relevant for the whole filesystem, and not specific to a file or directory
admin_actions := {
    "checkRestoreFailedStorage": "ro",
    "datanodeReport": "ro",
    "disableRestoreFailedStorage": "full",
    "enableRestoreFailedStorage": "full",
    "finalizeUpgrade": "rw",
    "getDatanodeStorageReport": "ro",
    "metaSave": "ro",
    "monitorHealth": "ro",
    "refreshNodes": "rw",
    "rollEditLog": "rw",
    "saveNamespace": "full",
    "setBalancerBandwidth": "rw",
    "slowDataNodesReport": "ro",
    "transitionToActive": "full",
    "transitionToObserver": "full",
    "transitionToStandby": "full",
}

groups_for_user := {
    "admin/test-hdfs-permissions.default.svc.cluster.local@CLUSTER.LOCAL": ["admins"],
    "alice/test-hdfs-permissions.default.svc.cluster.local@CLUSTER.LOCAL": ["developers"],
    "bob/test-hdfs-permissions.default.svc.cluster.local@CLUSTER.LOCAL": []
}

groups_for_short_user_name := {}

acls := [
    {
        "identity": "group:admins",
        "action": "full",
        "resource": "hdfs:dir:/",
    },
    {
        "identity": "groupRegex:(developers)",
        "action": "rw",
        "resource": "hdfs:dir:/developers/",
    },
    {
        "identity": "group:developers",
        "action": "ro",
        "resource": "hdfs:dir:/developers-ro/",
    },
    {
        "identity": "user:alice/test-hdfs-permissions.default.svc.cluster.local@CLUSTER.LOCAL",
        "action": "rw",
        "resource": "hdfs:dir:/alice/",
    },
    {
        "identity": `userRegex:bob/.+\.default\.svc\.cluster\.local@CLUSTER\.LOCAL`,
        "action": "rw",
        "resource": "hdfs:dir:/bob/",
    },
    {
        "identity": "user:bob/test-hdfs-permissions.default.svc.cluster.local@CLUSTER.LOCAL",
        "action": "ro",
        "resource": "hdfs:dir:/developers/",
    },
    {
        "identity": "user:bob/test-hdfs-permissions.default.svc.cluster.local@CLUSTER.LOCAL",
        "action": "rw",
        "resource": "hdfs:file:/developers/file-from-bob-via-user",
    },
    {
        "identity": "shortUser:bob",
        "action": "rw",
        "resource": "hdfs:file:/developers/file-from-bob-via-short-user",
    },
    {
        "identity": "shortUserRegex:(bob|bobby)",
        "action": "rw",
        "resource": "hdfs:file:/developers/file-from-bob-via-short-user-regex",
    },
]