Granular access control of packages
Methods, systems, and computer programs are presented for a packages policy object to enable customers to create and apply packages policies provided by third-party package managers. A user-defined function (UDF) is received by a cloud data platform. The UDF includes code related to at least one operation to be performed. The cloud data platform receives a package policy including at least one allowlist and at least one blocklist and compares the at least one allowlist and the at least one blocklist to the at least one package specification. The cloud data platform computes a difference set based on the comparison. The difference set includes metadata associated with one or more packages to remove. The cloud data platform determines whether the UDF is permitted based at least in part on the difference set.
1. A method comprising:
receiving, by at least one hardware processor, a user-defined function (UDF), the UDF including code related to at least one operation to be performed;
receiving a package policy, the package policy including at least one allowlist and at least one blocklist;
comparing the at least one allowlist and the at least one blocklist to at least one package specification;
computing a difference set based on the comparison, the difference set including metadata associated with one or more packages to remove; and
determining whether the UDF is permitted based at least in part on the difference set.
2. The method of claim 1 , further comprising:
generating a notification based on a determination that the one or more packages are within one of the at least one allowlist or the at least one blocklist.
3. The method of claim 2 , wherein determining whether executing the UDF is permitted based on the difference set further comprises:
determining one or more dependencies required by the UDF;
comparing the one or more dependencies required by the UDF to the at least one package specification; and
generating a dependency list based on the comparison.
4. The method of claim 1 , further comprising:
creating one or more user roles for the package policy based on a schema of the package policy; and granting one or more usages to the one or more user roles base at least in part on the schema, the one or more usages including use privileges to access an object of the package policy.
5. The method of claim 4 , wherein the object includes a property specific to the object, the property is that the object executes in a sandbox environment.
6. The method of claim 1 , further comprising:
executing the package policy any time a user creates the UDF or executes the UDF.
7. The method of claim 1 , further comprising:
filtering the metadata according to the package policy.
8. The method of claim 1 , wherein the package policy includes:
an allowlist of packages among the at least one allowlist, the packages in the allowlist being associated with an allowed package category; and
a blocklist of packages among the at least one blocklist, the packages in the blocklist being associated with a blocked package category.
9. The method of claim 1 , further comprising:
instantiating a user code runtime to execute the code of the UDF, the user code runtime including an access control process including an access control list.
10. The method of claim 9 , further comprising:
instantiating a sandbox process as a child process of a solver manager, the solver manager configured to perform the determining of whether the UDF is permitted; and instantiating the user code runtime as a child process of the sandbox process, the sandbox process configured to execute the at least one operation in a sandbox environment.
11. A system comprising:
one or more hardware processors of a machine; and
at least one memory storing instructions that, when executed by the one or more hardware processors, cause the system to perform operations comprising:
receiving, by at least one hardware processor, a user-defined function (UDF), the UDF including code related to at least one operation to be performed;
receiving a package policy, the package policy including at least one allowlist and at least one blocklist;
comparing the at least one allowlist and the at least one blocklist to at least one package specification;
computing a difference set based on the comparison, the difference set including metadata associated with one or more packages to remove; and
determining whether the UDF is permitted based at least in part on the difference set.
12. The system of claim 11 , the operations further comprising:
generating a notification based on a determination that the one or more packages are within one of the at least one allowlist or the at least one blocklist.
13. The system of claim 12 , wherein determining whether executing the UDF is permitted based on the difference set further comprises:
determining one or more dependencies required by the UDF;
comparing the one or more dependencies required by the UDF to the at least one package specification; and
generating a dependency list based on the comparison.
14. The system of claim 11 , the operations further comprising:
creating one or more user roles for the package policy based on a schema of the package policy; and
granting one or more usages to the one or more user roles base at least in part on the schema, the one or more usages including use privileges to access an object of the package policy.
15. The system of claim 14 , wherein the object includes a property specific to the object, the property is that the object executes in a sandbox environment.
16. The system of claim 11 , the operations further comprising:
executing the package policy any time a user creates the UDF or executes the UDF.
17. The system of claim 11 , the operations further comprising:
filtering the metadata according to the package policy.
18. The system of claim 11 , wherein the package policy further comprises:
an allowlist of packages among the at least one allowlist, the packages in the allowlist being associated with an allowed package category; and
a blocklist of packages among the at least one blocklist, the packages in the blocklist being associated with a blocked package category.
19. The system of claim 11 , the operations further comprising:
instantiating a user code runtime to execute the code of the UDF, the user code runtime including an access control process including an access control list.
20. The system of claim 19 , the operations further comprising:
instantiating a sandbox process as a child process of a solver manager, the solver manager configured to perform the determining of whether the UDF is permitted; and
instantiating the user code runtime as a child process of the sandbox process, the sandbox process configured to execute the at least one operation in a sandbox environment.
21. A machine-readable storage device embodying instructions that, when executed by a machine, cause the machine to perform operations comprising:
receiving, by at least one hardware processor, a user-defined function (UDF), the UDF including code related to at least one operation to be performed;
receiving a package policy, the package policy including at least one allowlist and at least one blocklist;
comparing the at least one allowlist and the at least one blocklist to at least one package specification;
computing a difference set based on the comparison, the difference set including metadata associated with one or more packages to remove; and
determining whether the UDF is permitted based at least in part on the difference set.
22. The machine-readable storage device of claim 21 , further comprising:
generating a notification based on a determination that the one or more packages are within one of the at least one allowlist or the at least one blocklist.
23. The machine-readable storage device of claim 22 , wherein determining whether executing the UDF is permitted based on the difference set further comprises:
determining one or more dependencies required by the UDF;
comparing the one or more dependencies required by the UDF to the at least one package specification; and generating a dependency list based on the comparison.
24. The machine-readable storage device of claim 21 , further comprising:
creating one or more user roles for the package policy based on a schema of the package policy; and
granting one or more usages to the one or more user roles base at least in part on the schema, the one or more usages including use privileges to access an object of the package policy.
25. The machine-readable storage device of claim 24 , wherein the object includes a property specific to the object, the property is that the object executes in a sandbox environment.
26. The machine-readable storage device of claim 21 , further comprising:
executing the package policy any time a user creates the UDF or executes the UDF.
27. The machine-readable storage device of claim 21 , further comprising:
filtering the metadata according to the package policy.
28. The machine-readable storage device of claim 21 , wherein the package policy further comprises:
an allowlist of packages among the at least one allowlist, the packages in the allowlist being associated with an allowed package category; and
a blocklist of packages among the at least one blocklist, the packages in the blocklist being associated with a blocked package category.
29. The machine-readable storage device of claim 21 , further comprising:
instantiating a user code runtime to execute the code of the UDF, the user code runtime including an access control process including an access control list.
30. The machine-readable storage device of claim 29 , further comprising:
instantiating a sandbox process as a child process of a solver manager, the solver manager configured to perform the determining of whether the UDF is permitted; and
instantiating the user code runtime as a child process of the sandbox process, the sandbox process configured to execute the at least one operation in a sandbox environment.