payload: {"push_id":3699498805,"size":3,"distinct_size":3,"ref":"refs/heads/master","head":"ec1a1f301b6f8b5ca8428d755e7658ec1c3d22a7","before":"71b094000cb3569d49f0fdf016ae5d17ff1f119e","commits":[{"sha":"3c4635fc51da932b8a6f8c779a1c4f3c09e5b7ca","author":{"name":"Andrew Wong","email":"b68e4fdc6430321a6b47400732ff97d7ae91234e@apache.org"},"message":"authz: refactor authorization for ListTables\n\nAuthorization for ListTables isn't very performant because it requires\nauthorizing each table while holding its table lock. This invariant is\nheld to guarantee that the authorization applies to the correct table in\nKudu (e.g. even amidst a concurrent rename).\n\nIf we authorize multiple tables at once, we can improve performance, but\nkeeping the guarantee is less straightforward. This patch takes a stab\nat this by refactoring ListTables to prepare for the following\nauthorization sequence:\n\n1. With table locks held, put together a map from\n   { table_name => TableInfo }.\n2. Authorize the tables (potentially in bulk in the future), keeping\n   track of the authorized table names.\n3. Iterate through the authorized table names and, using the maps from\n   Step 1, with table locks held, check that the table name hasn't\n   changed. If it has, this implies there was a concurrent rename (or\n   equivalent) and the authorization call was not actually made for this\n   table, and it shouldn't be returned.\n4. With confirmation that the tables that were authorized have the IDs\n   we expect, return the authorized tables.\n\nIf the catalog manager isn't set up to authorize tables (e.g.\nauthorization isn't enabled), steps 2 and 3 are skipped. This patch\nrefactors ListTables to match this sequence of events without bulk\nauthorization.\n\nWhile this is mainly a refactor, the user-facing change is that if there\nis a concurrent rename during a ListTables operation, there is a chance\nthat neither the old nor new table will show up in the listed tables.\nThis isn't ideal UX, but is conservative w.r.t security. A test is added\nexercising this scenario.\n\nChange-Id: I568e1be7b909768a99f0f4f13775e34a01ccd160\nReviewed-on: http://gerrit.cloudera.org:8080/13566\nReviewed-by: Adar Dembo <adar@cloudera.com>\nTested-by: Kudu Jenkins\nReviewed-by: Hao Hao <hao.hao@cloudera.com>","distinct":true,"url":"https://api.github.com/repos/apache/kudu/commits/3c4635fc51da932b8a6f8c779a1c4f3c09e5b7ca"},{"sha":"d3820b3c4458abe768ced6ee683470dc2cc39b50","author":{"name":"Andrew Wong","email":"b68e4fdc6430321a6b47400732ff97d7ae91234e@apache.org"},"message":"sentry: allow caching of COLUMN/TABLE privileges when checking higher scopes\n\nCurrently, Kudu will not cache COLUMN/TABLE when checking for\nDATABASE/SERVER Sentry privileges. This is because, when written, Kudu\nwould send requests that would yield significantly more privileges than\nrequired. Commit 0040a731e4741bde6d8c9d81e796cb000cd24817 changed this\nbehavior, and as such, this patch gates the optimization behind an\nenum in the Sentry provider's Authorize() signature.\n\nThe effect of this is that when checking for DATABASE/SERVER privileges,\ntwo entries will be added to the privilege cache instead of one: one for\nthe DATABASE/SERVER privileges, and one for the TABLE/COLUMN privileges.\n\nThis is optional because in some cases, it isn't necessarily desirable\nto cache table-level privileges. E.g. when creating a table, we\nshouldn't cache table-level privileges because Sentry may create OWNER\nprivileges for the new table that caching may miss out on when first\nauthorizing the create request.\n\nThis improves the worst case performance of ListTables when there are\nmany databases on which the user has no privileges, and a single table\nper database. In this scenario, without this patch, there would be\n2 * (# tables) calls to Sentry, and with this patch, there would be\n1 * (# tables) calls.\n\nWith this patch:\n./bin/sentry_authz_provider-test --gtest_filter=*ListTablesBench* --num_databases=300 --num_tables_per_db=1 --has-db-privileges=false\nsentry_authz_provider-test.cc:418] Time spent Listing tables: real 24.735s  user 0.033s     sys 0.009s\n\nWithout this patch:\n./bin/sentry_authz_provider-test --gtest_filter=*ListTablesBench* --num_databases=300 --num_tables_per_db=1 --has-db-privileges=false\nsentry_authz_provider-test.cc:418] Time spent Listing tables: real 47.543s  user 0.040s     sys 0.013s\n\nChange-Id: Icec75ae9e5626c887af37568a6f64a8361d888b7\nReviewed-on: http://gerrit.cloudera.org:8080/13552\nReviewed-by: Adar Dembo <adar@cloudera.com>\nReviewed-by: Alexey Serbin <aserbin@cloudera.com>\nTested-by: Kudu Jenkins","distinct":true,"url":"https://api.github.com/repos/apache/kudu/commits/d3820b3c4458abe768ced6ee683470dc2cc39b50"},{"sha":"ec1a1f301b6f8b5ca8428d755e7658ec1c3d22a7","author":{"name":"Adar Dembo","email":"866ca730bfc7f544e3ebce604ceeba4879f23df0@cloudera.com"},"message":"thirdparty: fix build_curl with unusual krb5-config location\n\nThe curl build system runs krb5-config to determine which GSSAPI headers\nand libraries are needed at build time. It expects to find krb5-config in\n/usr/bin and if it's not found, it'll default to linking with -lgssapi.\n\nOn SLES12, krb5-config is in /usr/lib/mit/bin, so it isn't found and the\ncurl build generally fails because -lgssapi isn't a Kudu requirement. By\nsetting KRB5CONFIG we can redirect curl's build towards the correct location\nof krb5-config and get the correct libraries as a result (-lkrb5,\n-lk5crypto, and -lcom_err, if you're curious).\n\nChange-Id: Ief5816d561545945089108e34bd59c8e5dae9dc4\nReviewed-on: http://gerrit.cloudera.org:8080/13577\nReviewed-by: Todd Lipcon <todd@apache.org>\nTested-by: Kudu Jenkins","distinct":true,"url":"https://api.github.com/repos/apache/kudu/commits/ec1a1f301b6f8b5ca8428d755e7658ec1c3d22a7"}]}
other: {"actor":{"display_login":"asfgit"}}