Return-Path: X-Original-To: apmail-hive-commits-archive@www.apache.org Delivered-To: apmail-hive-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 8CC26109D3 for ; Fri, 14 Mar 2014 04:53:38 +0000 (UTC) Received: (qmail 56754 invoked by uid 500); 14 Mar 2014 04:53:37 -0000 Delivered-To: apmail-hive-commits-archive@hive.apache.org Received: (qmail 56717 invoked by uid 500); 14 Mar 2014 04:53:36 -0000 Mailing-List: contact commits-help@hive.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: hive-dev@hive.apache.org Delivered-To: mailing list commits@hive.apache.org Received: (qmail 56708 invoked by uid 99); 14 Mar 2014 04:53:35 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 14 Mar 2014 04:53:35 +0000 X-ASF-Spam-Status: No, hits=-2000.0 required=5.0 tests=ALL_TRUSTED X-Spam-Check-By: apache.org Received: from [140.211.11.4] (HELO eris.apache.org) (140.211.11.4) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 14 Mar 2014 04:53:31 +0000 Received: from eris.apache.org (localhost [127.0.0.1]) by eris.apache.org (Postfix) with ESMTP id C160D2388906; Fri, 14 Mar 2014 04:53:08 +0000 (UTC) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: svn commit: r1577428 - in /hive/trunk/ql/src: java/org/apache/hadoop/hive/ql/exec/ java/org/apache/hadoop/hive/ql/security/authorization/ java/org/apache/hadoop/hive/ql/security/authorization/plugin/ java/org/apache/hadoop/hive/ql/security/authorizatio... Date: Fri, 14 Mar 2014 04:53:08 -0000 To: commits@hive.apache.org From: thejas@apache.org X-Mailer: svnmailer-1.0.9 Message-Id: <20140314045308.C160D2388906@eris.apache.org> X-Virus-Checked: Checked by ClamAV on apache.org Author: thejas Date: Fri Mar 14 04:53:07 2014 New Revision: 1577428 URL: http://svn.apache.org/r1577428 Log: HIVE-6567 : "show grant ... on all" fails with NPE (Thejas Nair, reviewed by Ashutosh Chauhan) Modified: hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/DDLTask.java hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/Utilities.java hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationUtils.java hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilegeInfo.java hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLAuthorizationUtils.java hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAccessController.java hive/trunk/ql/src/test/queries/clientpositive/authorization_revoke_table_priv.q hive/trunk/ql/src/test/queries/clientpositive/authorization_view_sqlstd.q hive/trunk/ql/src/test/results/clientpositive/authorization_revoke_table_priv.q.out hive/trunk/ql/src/test/results/clientpositive/authorization_view_sqlstd.q.out Modified: hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/DDLTask.java URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/DDLTask.java?rev=1577428&r1=1577427&r2=1577428&view=diff ============================================================================== --- hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/DDLTask.java (original) +++ hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/DDLTask.java Fri Mar 14 04:53:07 2014 @@ -657,7 +657,7 @@ public class DDLTask extends Task privileges) { - Collections.sort(privileges, new Comparator() { - - @Override - public int compare(HiveObjectPrivilege one, HiveObjectPrivilege other) { - return one.getGrantInfo().getPrivilege().compareTo(other.getGrantInfo().getPrivilege()); - } - - }); - - } - private int grantOrRevokePrivileges(List principals, List privileges, PrivilegeObjectDesc privSubjectDesc, String grantor, PrincipalType grantorType, boolean grantOption, boolean isGrant) @@ -854,6 +842,7 @@ public class DDLTask extends Task(hivePrivSet); } - /** - * Create thrift privileges bag - * - * @param hivePrincipals - * @param hivePrivileges - * @param hivePrivObject - * @param grantorPrincipal - * @param grantOption - * @return - * @throws HiveAuthzPluginException - */ - private PrivilegeBag getThriftPrivilegesBag(List hivePrincipals, - List hivePrivileges, HivePrivilegeObject hivePrivObject, - HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException { - - HiveObjectRef privObj = SQLAuthorizationUtils.getThriftHiveObjectRef(hivePrivObject); - PrivilegeBag privBag = new PrivilegeBag(); - for (HivePrivilege privilege : hivePrivileges) { - if (privilege.getColumns() != null && privilege.getColumns().size() > 0) { - throw new HiveAuthzPluginException("Privileges on columns not supported currently" - + " in sql standard authorization mode"); - } - - PrivilegeGrantInfo grantInfo = getThriftPrivilegeGrantInfo(privilege, grantorPrincipal, - grantOption); - for (HivePrincipal principal : hivePrincipals) { - HiveObjectPrivilege objPriv = new HiveObjectPrivilege(privObj, principal.getName(), - AuthorizationUtils.getThriftPrincipalType(principal.getType()), grantInfo); - privBag.addToPrivileges(objPriv); - } - } - return privBag; - } - - private PrivilegeGrantInfo getThriftPrivilegeGrantInfo(HivePrivilege privilege, - HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException { - try { - return AuthorizationUtils.getThriftPrivilegeGrantInfo(privilege, grantorPrincipal, - grantOption); - } catch (HiveException e) { - throw new HiveAuthzPluginException(e); - } - } @Override public void revokePrivileges(List hivePrincipals, @@ -430,7 +386,7 @@ public class SQLStdHiveAccessController AuthorizationUtils.getHivePrincipalType(msGrantInfo.getGrantorType())); HivePrivilegeInfo resPrivInfo = new HivePrivilegeInfo(resPrincipal, resPrivilege, - resPrivObj, grantorPrincipal, msGrantInfo.isGrantOption()); + resPrivObj, grantorPrincipal, msGrantInfo.isGrantOption(), msGrantInfo.getCreateTime()); resPrivInfos.add(resPrivInfo); } return resPrivInfos; Modified: hive/trunk/ql/src/test/queries/clientpositive/authorization_revoke_table_priv.q URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/test/queries/clientpositive/authorization_revoke_table_priv.q?rev=1577428&r1=1577427&r2=1577428&view=diff ============================================================================== --- hive/trunk/ql/src/test/queries/clientpositive/authorization_revoke_table_priv.q (original) +++ hive/trunk/ql/src/test/queries/clientpositive/authorization_revoke_table_priv.q Fri Mar 14 04:53:07 2014 @@ -9,6 +9,7 @@ CREATE TABLE table_priv_rev(i int); -- grant insert privilege to user2 GRANT INSERT ON table_priv_rev TO USER user2; SHOW GRANT USER user2 ON TABLE table_priv_rev; +SHOW GRANT USER user2 ON ALL; -- revoke insert privilege from user2 REVOKE INSERT ON TABLE table_priv_rev FROM USER user2; @@ -18,6 +19,7 @@ SHOW GRANT USER user2 ON TABLE table_pri -- grant insert privilege to user2 GRANT INSERT ON table_priv_rev TO USER user2; SHOW GRANT USER user2 ON TABLE table_priv_rev; +SHOW GRANT USER user2 ON ALL; -- grant select privilege to user2, with grant option GRANT SELECT ON table_priv_rev TO USER user2 WITH GRANT OPTION; @@ -31,10 +33,12 @@ SHOW GRANT USER user2 ON TABLE table_pri GRANT DELETE ON table_priv_rev TO USER user2; SHOW GRANT USER user2 ON TABLE table_priv_rev; + -- start revoking -- -- revoke update privilege from user2 REVOKE UPDATE ON TABLE table_priv_rev FROM USER user2; SHOW GRANT USER user2 ON TABLE table_priv_rev; +SHOW GRANT USER user2 ON ALL; -- revoke DELETE privilege from user2 REVOKE DELETE ON TABLE table_priv_rev FROM USER user2; @@ -47,7 +51,7 @@ SHOW GRANT USER user2 ON TABLE table_pri -- revoke select privilege from user2 REVOKE SELECT ON TABLE table_priv_rev FROM USER user2; SHOW GRANT USER user2 ON TABLE table_priv_rev; - +SHOW GRANT USER user2 ON ALL; -- grant all followed by revoke all GRANT ALL ON table_priv_rev TO USER user2; Modified: hive/trunk/ql/src/test/queries/clientpositive/authorization_view_sqlstd.q URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/test/queries/clientpositive/authorization_view_sqlstd.q?rev=1577428&r1=1577427&r2=1577428&view=diff ============================================================================== --- hive/trunk/ql/src/test/queries/clientpositive/authorization_view_sqlstd.q (original) +++ hive/trunk/ql/src/test/queries/clientpositive/authorization_view_sqlstd.q Fri Mar 14 04:53:07 2014 @@ -12,6 +12,8 @@ create view vt1 as select i,k from t1; -- protecting certain rows create view vt2 as select * from t1 where i > 1; +show grant user user1 on all; + --view grant to user -- try with and without table keyword @@ -21,6 +23,7 @@ grant insert on table vt1 to user user3; show grant user user2 on table vt1; show grant user user3 on table vt1; + set user.name=user2; select * from vt1; @@ -28,6 +31,7 @@ set user.name=user1; grant all on table vt2 to user user2; show grant user user2 on table vt2; +show grant user user2 on all; revoke all on vt2 from user user2; show grant user user2 on table vt2; @@ -35,6 +39,8 @@ show grant user user2 on table vt2; revoke select on table vt1 from user user2; show grant user user2 on table vt1; +show grant user user2 on all; + -- grant privileges on roles for view, after next statement show grant user user3 on table vt1; Modified: hive/trunk/ql/src/test/results/clientpositive/authorization_revoke_table_priv.q.out URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/test/results/clientpositive/authorization_revoke_table_priv.q.out?rev=1577428&r1=1577427&r2=1577428&view=diff ============================================================================== --- hive/trunk/ql/src/test/results/clientpositive/authorization_revoke_table_priv.q.out (original) +++ hive/trunk/ql/src/test/results/clientpositive/authorization_revoke_table_priv.q.out Fri Mar 14 04:53:07 2014 @@ -22,6 +22,11 @@ PREHOOK: type: SHOW_GRANT POSTHOOK: query: SHOW GRANT USER user2 ON TABLE table_priv_rev POSTHOOK: type: SHOW_GRANT default table_priv_rev user2 USER INSERT false -1 user1 +PREHOOK: query: SHOW GRANT USER user2 ON ALL +PREHOOK: type: SHOW_GRANT +POSTHOOK: query: SHOW GRANT USER user2 ON ALL +POSTHOOK: type: SHOW_GRANT +default table_priv_rev user2 USER INSERT false -1 user1 PREHOOK: query: -- revoke insert privilege from user2 REVOKE INSERT ON TABLE table_priv_rev FROM USER user2 PREHOOK: type: REVOKE_PRIVILEGE @@ -49,6 +54,11 @@ PREHOOK: type: SHOW_GRANT POSTHOOK: query: SHOW GRANT USER user2 ON TABLE table_priv_rev POSTHOOK: type: SHOW_GRANT default table_priv_rev user2 USER INSERT false -1 user1 +PREHOOK: query: SHOW GRANT USER user2 ON ALL +PREHOOK: type: SHOW_GRANT +POSTHOOK: query: SHOW GRANT USER user2 ON ALL +POSTHOOK: type: SHOW_GRANT +default table_priv_rev user2 USER INSERT false -1 user1 PREHOOK: query: -- grant select privilege to user2, with grant option GRANT SELECT ON table_priv_rev TO USER user2 WITH GRANT OPTION PREHOOK: type: GRANT_PRIVILEGE @@ -111,6 +121,13 @@ POSTHOOK: type: SHOW_GRANT default table_priv_rev user2 USER DELETE false -1 user1 default table_priv_rev user2 USER INSERT false -1 user1 default table_priv_rev user2 USER SELECT true -1 user1 +PREHOOK: query: SHOW GRANT USER user2 ON ALL +PREHOOK: type: SHOW_GRANT +POSTHOOK: query: SHOW GRANT USER user2 ON ALL +POSTHOOK: type: SHOW_GRANT +default table_priv_rev user2 USER DELETE false -1 user1 +default table_priv_rev user2 USER INSERT false -1 user1 +default table_priv_rev user2 USER SELECT true -1 user1 PREHOOK: query: -- revoke DELETE privilege from user2 REVOKE DELETE ON TABLE table_priv_rev FROM USER user2 PREHOOK: type: REVOKE_PRIVILEGE @@ -150,6 +167,10 @@ PREHOOK: query: SHOW GRANT USER user2 ON PREHOOK: type: SHOW_GRANT POSTHOOK: query: SHOW GRANT USER user2 ON TABLE table_priv_rev POSTHOOK: type: SHOW_GRANT +PREHOOK: query: SHOW GRANT USER user2 ON ALL +PREHOOK: type: SHOW_GRANT +POSTHOOK: query: SHOW GRANT USER user2 ON ALL +POSTHOOK: type: SHOW_GRANT PREHOOK: query: -- grant all followed by revoke all GRANT ALL ON table_priv_rev TO USER user2 PREHOOK: type: GRANT_PRIVILEGE Modified: hive/trunk/ql/src/test/results/clientpositive/authorization_view_sqlstd.q.out URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/test/results/clientpositive/authorization_view_sqlstd.q.out?rev=1577428&r1=1577427&r2=1577428&view=diff ============================================================================== --- hive/trunk/ql/src/test/results/clientpositive/authorization_view_sqlstd.q.out (original) +++ hive/trunk/ql/src/test/results/clientpositive/authorization_view_sqlstd.q.out Fri Mar 14 04:53:07 2014 @@ -23,6 +23,22 @@ create view vt2 as select * from t1 wher POSTHOOK: type: CREATEVIEW POSTHOOK: Input: default@t1 POSTHOOK: Output: default@vt2 +PREHOOK: query: show grant user user1 on all +PREHOOK: type: SHOW_GRANT +POSTHOOK: query: show grant user user1 on all +POSTHOOK: type: SHOW_GRANT +default t1 user1 USER DELETE true -1 user1 +default t1 user1 USER INSERT true -1 user1 +default t1 user1 USER SELECT true -1 user1 +default t1 user1 USER UPDATE true -1 user1 +default vt1 user1 USER DELETE true -1 user1 +default vt1 user1 USER INSERT true -1 user1 +default vt1 user1 USER SELECT true -1 user1 +default vt1 user1 USER UPDATE true -1 user1 +default vt2 user1 USER DELETE true -1 user1 +default vt2 user1 USER INSERT true -1 user1 +default vt2 user1 USER SELECT true -1 user1 +default vt2 user1 USER UPDATE true -1 user1 PREHOOK: query: --view grant to user -- try with and without table keyword @@ -75,6 +91,15 @@ default vt2 user2 USER DELETE false -1 default vt2 user2 USER INSERT false -1 user1 default vt2 user2 USER SELECT false -1 user1 default vt2 user2 USER UPDATE false -1 user1 +PREHOOK: query: show grant user user2 on all +PREHOOK: type: SHOW_GRANT +POSTHOOK: query: show grant user user2 on all +POSTHOOK: type: SHOW_GRANT +default vt1 user2 USER SELECT false -1 user1 +default vt2 user2 USER DELETE false -1 user1 +default vt2 user2 USER INSERT false -1 user1 +default vt2 user2 USER SELECT false -1 user1 +default vt2 user2 USER UPDATE false -1 user1 PREHOOK: query: revoke all on vt2 from user user2 PREHOOK: type: REVOKE_PRIVILEGE PREHOOK: Output: default@vt2 @@ -95,6 +120,10 @@ PREHOOK: query: show grant user user2 on PREHOOK: type: SHOW_GRANT POSTHOOK: query: show grant user user2 on table vt1 POSTHOOK: type: SHOW_GRANT +PREHOOK: query: show grant user user2 on all +PREHOOK: type: SHOW_GRANT +POSTHOOK: query: show grant user user2 on all +POSTHOOK: type: SHOW_GRANT PREHOOK: query: -- grant privileges on roles for view, after next statement show grant user user3 on table vt1 PREHOOK: type: SHOW_GRANT