RANGER-4722: HDFS authorization logic for directory hierarchy rooted …

…at '/' is incorrect
apache · Feb 21, 2024 · c4f6cc3 · c4f6cc3
1 parent 4280c51
commit c4f6cc3
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java b/hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java
@@ -453,7 +453,11 @@ private void checkRangerPermission(String fsOwner, String superGroup, UserGroupI
 								if (subDirAuthStatus != AuthzStatus.ALLOW) {
 									for(INode child : cList) {
 										if (child.isDirectory()) {
-											directories.push(new SubAccessData(child.asDirectory(), resourcePath + Path.SEPARATOR_CHAR + child.getLocalName()));
+											if (data.resourcePath.endsWith(Path.SEPARATOR)) {
+												directories.push(new SubAccessData(child.asDirectory(), data.resourcePath + child.getLocalName()));
+											} else {
+												directories.push(new SubAccessData(child.asDirectory(), data.resourcePath + Path.SEPARATOR_CHAR + child.getLocalName()));
+											}
 										}
 									}
 								}