Return-Path: 
 <dev-return-100792-apmail-hive-dev-archive=hive.apache.org@hive.apache.org>
X-Original-To: apmail-hive-dev-archive@www.apache.org
Delivered-To: apmail-hive-dev-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 5DC8B1175A
	for <apmail-hive-dev-archive@www.apache.org>;
 Wed,  3 Sep 2014 15:54:55 +0000 (UTC)
Received: (qmail 36396 invoked by uid 500); 3 Sep 2014 15:54:52 -0000
Delivered-To: apmail-hive-dev-archive@hive.apache.org
Received: (qmail 36324 invoked by uid 500); 3 Sep 2014 15:54:52 -0000
Mailing-List: contact dev-help@hive.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:dev-help@hive.apache.org>
List-Unsubscribe: <mailto:dev-unsubscribe@hive.apache.org>
List-Post: <mailto:dev@hive.apache.org>
List-Id: <dev.hive.apache.org>
Reply-To: dev@hive.apache.org
Delivered-To: mailing list dev@hive.apache.org
Received: (qmail 36149 invoked by uid 500); 3 Sep 2014 15:54:51 -0000
Delivered-To: apmail-hadoop-hive-dev@hadoop.apache.org
Received: (qmail 36127 invoked by uid 99); 3 Sep 2014 15:54:51 -0000
Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 03 Sep 2014 15:54:51 +0000
Date: Wed, 3 Sep 2014 15:54:51 +0000 (UTC)
From: "Brock Noland (JIRA)" <jira@apache.org>
To: hive-dev@hadoop.apache.org
Message-ID: <JIRA.12737013.1409116992000.7003.1409759691902@Atlassian.JIRA>
In-Reply-To: <JIRA.12737013.1409116992000@Atlassian.JIRA>
References: <JIRA.12737013.1409116992000@Atlassian.JIRA>
 <JIRA.12737013.1409116992032@arcas>
Subject: [jira] [Updated] (HIVE-7890) SessionState creates HMS Client while
 not impersonating
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


     [ https://issues.apache.org/jira/browse/HIVE-7890?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Brock Noland updated HIVE-7890:
-------------------------------
       Resolution: Fixed
    Fix Version/s: 0.14.0
           Status: Resolved  (was: Patch Available)

> SessionState creates HMS Client while not impersonating
> -------------------------------------------------------
>
>                 Key: HIVE-7890
>                 URL: https://issues.apache.org/jira/browse/HIVE-7890
>             Project: Hive
>          Issue Type: Bug
>            Reporter: Brock Noland
>            Assignee: Brock Noland
>             Fix For: 0.14.0
>
>         Attachments: HIVE-7890.2.patch
>
>
> In SessionState.start [an instance of the the HMSClient is created|https://github.com/apache/hive/blob/trunk/ql/src/java/org/apache/hadoop/hive/ql/session/SessionState.java#L367]. When impersonation is enabled, this call does not occur within a "doas" call and thus the HMSClient is created as the server user, not the impersonated user.
> Thus calls to the HMS are made by the "hive" user as opposed to the end user. This causes file ownership such as a database directory owner to be incorrect. While debugging this, I got stack trace below. As you can see we are calling getMSC without a doas.
> {noformat}
> 	at org.apache.hadoop.hive.ql.metadata.Hive.getMSC(Hive.java:2474)
> 	at org.apache.hadoop.hive.ql.session.SessionState.start(SessionState.java:367)
> 	at org.apache.hive.service.cli.session.HiveSessionImpl.<init>(HiveSessionImpl.java:121)
> 	at org.apache.hive.service.cli.session.HiveSessionImplwithUGI.<init>(HiveSessionImplwithUGI.java:49)
> 	at org.apache.hive.service.cli.session.SessionManager.openSession(SessionManager.java:130)
> 	at org.apache.hive.service.cli.CLIService.openSessionWithImpersonation(CLIService.java:163)
> 	at org.apache.hive.service.cli.thrift.ThriftCLIService.getSessionHandle(ThriftCLIService.java:290)
> 	at org.apache.hive.service.cli.thrift.ThriftCLIService.OpenSession(ThriftCLIService.java:208)
> 	at org.apache.hive.service.cli.thrift.TCLIService$Processor$OpenSession.getResult(TCLIService.java:1313)
> 	at org.apache.hive.service.cli.thrift.TCLIService$Processor$OpenSession.getResult(TCLIService.java:1298)
> 	at org.apache.thrift.ProcessFunction.process(ProcessFunction.java:39)
> 	at org.apache.thrift.TBaseProcessor.process(TBaseProcessor.java:39)
> 	at org.apache.hive.service.auth.TSetIpAddressProcessor.process(TSetIpAddressProcessor.java:55)
> 	at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:244)
> 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> 	at java.lang.Thread.run(Thread.java:744)
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)