Mailing-List: contact issues-help@hive.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@hive.apache.org
Date: Thu, 28 Jan 2016 21:01:39 +0000 (UTC)
From: "Sushanth Sowmyan (JIRA)" <jira@apache.org>
To: issues@hive.apache.org
Message-ID: <JIRA.12781462.1426156041000.242353.1454014899795@Atlassian.JIRA>
In-Reply-To: <JIRA.12781462.1426156041000@Atlassian.JIRA>
References: <JIRA.12781462.1426156041000@Atlassian.JIRA>
 <JIRA.12781462.1426156041275@arcas>
Subject: [jira] [Commented] (HIVE-9941) sql std authorization on partitioned
 table: truncate and insert
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/HIVE-9941?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15122303#comment-15122303 ] 

Sushanth Sowmyan commented on HIVE-9941:
----------------------------------------

Thanks for the report, Olaf! This issue is fixed as part of HIVE-12875.

We can close this issue as a duplicate of the other, but I think this is also a good jira to add in a testcase for the base issue. Attaching patch so that precommit tests pick this up.

> sql std authorization on partitioned table: truncate and insert
> ---------------------------------------------------------------
>
>                 Key: HIVE-9941
>                 URL: https://issues.apache.org/jira/browse/HIVE-9941
>             Project: Hive
>          Issue Type: Bug
>          Components: Authorization
>    Affects Versions: 1.0.0, 1.2.0
>            Reporter: Olaf Flebbe
>
> sql std authorization works as expected.
> However if a table is partitioned any user can truncate it
> User foo:
> {code}
> create table bla (a string) partitioned by (b string);
> #.. loading values ...
> {code}
> Admin:
> {code}
> 0: jdbc:hive2://localhost:10000/default> set role admin;
> No rows affected (0,074 seconds)
> 0: jdbc:hive2://localhost:10000/default> show grant on bla;
> +-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+----------------+----------+--+
> | database  | table  | partition  | column  | principal_name  | principal_type  | privilege  | grant_option  |   grant_time   | grantor  |
> +-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+----------------+----------+--+
> | default   | bla    |            |         | foo             | USER            | DELETE     | true          | 1426158997000  | foo      |
> | default   | bla    |            |         | foo             | USER            | INSERT     | true          | 1426158997000  | foo      |
> | default   | bla    |            |         | foo             | USER            | SELECT     | true          | 1426158997000  | foo      |
> | default   | bla    |            |         | foo             | USER            | UPDATE     | true          | 1426158997000  | foo      |
> +-----------+--------+------------+---------+-----------------+-----------------+------------+---------------+----------------+----------+--+
> {code}
> now user olaf
> {code}
> 0: jdbc:hive2://localhost:10000/default> select * from bla;
> Error: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: Principal [name=olaf, type=USER] does not have following privileges for operation QUERY [[SELECT] on Object [type=TABLE_OR_VIEW, name=default.bla]] (state=42000,code=40000)
> {code}
> works as expected.
> _BUT_
> {code}
> 0: jdbc:hive2://localhost:10000/default> truncate table bla;
> No rows affected (0,18 seconds)
> {code}
> _And table is empty afterwards_.
> Similarily: {{insert into table}} works, too.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)