Skip to content

RANGER-5762: Add execute access type to Trino service definition - #1181

Merged
mneethiraj merged 1 commit into
apache:masterfrom
gertjanal:RANGER-5762
Aug 28, 2026
Merged

RANGER-5762: Add execute access type to Trino service definition#1181
mneethiraj merged 1 commit into
apache:masterfrom
gertjanal:RANGER-5762

Conversation

@gertjanal

Copy link
Copy Markdown
Contributor

What changes were proposed in this pull request?

In Trino, the EXECUTE access type is checked when validating the permission for Schema Function, but that permission is not available via the service definition.

@Override
public boolean canExecuteFunction(SystemSecurityContext context, CatalogSchemaRoutineName functionName)
{
    return hasPermission(
        RangerTrinoResource.forSchemaFunction(
            functionName.getCatalogName(),
            functionName.getSchemaRoutineName().getSchemaName(),
            functionName.getSchemaRoutineName().getRoutineName()),
        context,
        EXECUTE,
        "ExecuteFunction");
}

Source: https://github.com/trinodb/trino/blob/master/plugin/trino-ranger/src/main/java/io/trino/plugin/ranger/RangerSystemAccessControl.java#L791

This PR adds the execute access type to fix this.

How was this patch tested?

  • Running Trino, executing a schema function (in my case any ai function: https://trino.io/docs/current/functions/ai.html)
  • The function invocation in Trino throws a PERMISSION DENIED
  • Delete the service definition for Trino in Ranger
  • Upload the new service definition in Ranger
  • Restart Ranger
  • Add new Trino service to Ranger
  • Add new policy for Catalog, Schema, Schema Function with execute permission
  • The function invocation in Trino returns the right result

@vyommani vyommani left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mneethiraj
mneethiraj merged commit 3e82ad6 into apache:master Aug 28, 2026
4 checks passed
mneethiraj pushed a commit that referenced this pull request Aug 28, 2026
…esource schemafunction (#1181)

(cherry picked from commit 3e82ad6)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants