Policy enforcement for compute nodes
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for maintaining, by a policy enforcement system in a first compute node, a plurality of policies and data associating a plurality of user credentials with the plurality of policies. A request is received from a compute process for data from a file system in the first compute node. The request includes user credentials. The request for data is sent to the file system, and the data is received from the file system. Based on the received user credentials and the data associating the plurality of user credentials with the plurality of policies, one or more policies that correspond to the received user credentials is selected from the plurality of policies. The policy enforcement system filters the data from the file system based on the one or more policies, and sends the filtered data to the compute process.
1. A method in a policy enforcement system, the method comprising:
receiving from a process that performs a task on a compute node including one or more processors, a request for data, the request being associated with user credentials provided to the process by an application executing on a client device, wherein the compute node comprises a node of a distributed computing system that includes a plurality of nodes configured to handle a workload of the application, the workload divided into a plurality of tasks distributed among the plurality of nodes, the plurality of the tasks including the task;
obtaining from a policy store storing a plurality of policies, one or more policies associated with the user credentials, the one or more policies specifying data masking rules that are specific to the user;
intercepting data submitted to the process by a file driver that executes on the compute node, the intercepting including:
forwarding the request for the data to the file driver that fetches the data from a file system in response to the request; and
receiving the data submitted by the file driver to the process;
masking according to the data masking rules of the one or more policies, at least a portion of the data submitted by the file driver; and
sending the data having the portion masked to the process and wherein the policy enforcement system is logically positioned between the file driver and the process.
2. The method of claim 1 , wherein the user credentials are different from credentials of the user for accessing the application or for accessing the file system.
3. The method of claim 1 , wherein the file system is an internal file system within the compute node or an external file system.
4. The method of claim 1 , wherein the one or more policies include a predicate that determines whether the data is masked based on evaluation of the predicate.
5. The method of claim 1 , wherein the policy enforcement system enforces file level operations based on the user credentials that are different from credentials of the user for accessing the file system, the file level operations includes at least one of read, write, create or delete.
6. The method of claim 1 , wherein the masking including redacting a column of data, redacting a row of data, or both.
7. The method of claim 6 , wherein the masking a row of data comprises:
removing the row of data from the data submitted by the file driver to the process, the data having the portion masked thereby not including the masked row of data.
8. The method of claim 1 , wherein the data masking rules preserve format of the data and replaces value of the data with one or more masks.
9. The method of claim 1 , wherein the data from the file driver is already masked, and the masking includes decrypting the masked data according to the user credentials.
10. A non-transitory computer-readable medium having instructions stored thereon, which, when executed by a processor, cause the processor to perform operations in a policy enforcement system comprising:
receiving from a process that performs a task on a compute node including one or more processors, a request for data, the request being associated with user credentials provided to the process by an application executing on a client device wherein the compute node is a node of a distributed computing system that includes a plurality of nodes configured to handle a workload of the application, the workload being divided into a plurality of tasks distributed among the plurality of nodes, the plurality of the tasks including the task;
obtaining from a policy store storing a plurality of policies, one or more policies associated with the user credentials, the one or more policies specifying data masking rules that are specific to the user;
intercepting data submitted to the process by a file driver that executes on the compute node, the intercepting including:
forwarding the request for the data to the file driver that fetches the data from a file system in response to the request; and
receiving the data submitted by the file driver to the process;
masking according to the data masking rules of the one or more policies, at least a portion of the data submitted by the file driver; and
sending the data having the portion masked to the process,
wherein the policy enforcement system is logically positioned between the file driver and the process.
11. The non-transitory computer-readable medium of claim 10 , wherein the one or more policies include a predicate that determines whether the data is masked based on evaluation of the predicate.
12. The non-transitory computer-readable medium of claim 10 , wherein the policy enforcement system enforces file level operations based on the user credentials that are different from credentials of the user for accessing the file system, the file level operations includes at least one of read, write, create or delete.
13. The non-transitory computer-readable medium of claim 10 , wherein the data masking rules preserve format of the data and replaces value of the data with one or more masks.
14. The non-transitory computer-readable medium of claim 10 , wherein the data from the file driver is already masked, and the masking includes decrypting the masked data according to the user credentials.
15. The non-transitory computer-readable medium of claim 10 , wherein the masking includes redacting at least one of a column of data or a row of data.
16. A policy enforcement system comprising:
a processor; and
a non-transitory computer-readable medium having instructions stored thereon, which, when executed by the processor, cause the processor to perform operations comprising:
receiving from a process that performs a task on a compute node including one or more processors, a request for data, the request being associated with user credentials provided to the process by an application executing on a client device, wherein the compute node is a node of a distributed computing system that includes a plurality of nodes configured to handle a workload of the application, the workload being divided into a plurality of tasks distributed among the plurality of nodes, the plurality of the tasks including the task;
obtaining from a policy store storing a plurality of policies, one or more policies associated with the user credentials, the one or more policies specifying data masking rules that are specific to the user;
intercepting data submitted to the process by a file driver that executes on the compute node, the intercepting including:
forwarding the request for the data to the file driver that fetches the data from a file system in response to the request; and
receiving the data submitted by the file driver to the process;
masking according to the data masking rules of the one or more policies, at least a portion of the data submitted by the file driver; and
sending the data having the portion masked to the process,
wherein the policy enforcement system is logically positioned between the file driver and the process.
17. The policy enforcement system of claim 16 , wherein the one or more policies include a predicate that determines whether the data is masked based on evaluation of the predicate.
18. The policy enforcement system of claim 16 , wherein the policy enforcement system enforces file level operations based on the user credentials that are different from credentials of the user for accessing the file system, the file level operations includes at least one of read, write, create or delete.
19. The policy enforcement system of claim 16 , wherein the data masking rules preserve format of the data and replaces value of the data with one or more masks.
20. The policy enforcement system of claim 16 , wherein the masking includes redacting at least one of a column of data or a row of data.