@Override
    public boolean preRead(Class<?> type) {
      // 1) Don't call postRead - we will have checked everything here.
      // 2) Ignore GenericUDFBridge, it's checked separately in LlapUdfBridgeChecker.
      if (GenericUDFBridge.class == type) return true; // Run post-hook.
      if (!(GenericUDF.class.isAssignableFrom(type) || UDF.class.isAssignableFrom(type))
          || fnCheckerImpl.isUdfAllowed(type)) return false;
      throw new SecurityException("UDF " + type.getCanonicalName() + " is not allowed");
    }
A global hook that checks all subclasses of GenericUDF against the whitelist. It also injects
us into GenericUDFBridge-s, to check with the whitelist before instantiating a UDF.
llap-server/src/java/org/apache/hadoop/hive/llap/daemon/impl/LlapDaemon.java