Mailing-List: contact issues-help@hive.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@hive.apache.org
Date: Thu, 2 Jun 2016 00:26:59 +0000 (UTC)
From: "Tom Zeng (JIRA)" <jira@apache.org>
To: issues@hive.apache.org
Message-ID: <JIRA.12912882.1447431717000.9385.1464827219156@Atlassian.JIRA>
In-Reply-To: <JIRA.12912882.1447431717000@Atlassian.JIRA>
References: <JIRA.12912882.1447431717000@Atlassian.JIRA> <JIRA.12912882.1447431717352@arcas>
Subject: [jira] [Commented] (HIVE-12408) SQLStdAuthorizer expects external
 table creator to be owner of directory, does not respect rwx group
 permission. Only one user could ever create an external table definition to
 dir!
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 02 Jun 2016 00:27:01 -0000


    [ https://issues.apache.org/jira/browse/HIVE-12408?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15311467#comment-15311467 ] 

Tom Zeng commented on HIVE-12408:
---------------------------------

When the database/schema location is on s3, create schema/database will fail since the owner is '' and isOwnerOfFileHierarchy will always be false.  Changing CREATETABLE [[INSERT, DELETE, UPDATE, OBJECT OWNERSHIP] to CREATETABLE [[INSERT, DELETE, UPDATE] works and I tested on Amazon EMR with Hive 1.2 and 2.x. If this is an okay solution I can create a patch for it.

> SQLStdAuthorizer expects external table creator to be owner of directory, does not respect rwx group permission. Only one user could ever create an external table definition to dir!
> -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: HIVE-12408
>                 URL: https://issues.apache.org/jira/browse/HIVE-12408
>             Project: Hive
>          Issue Type: Bug
>          Components: Authorization, Security, SQLStandardAuthorization
>    Affects Versions: 0.14.0
>         Environment: HDP 2.2 + Kerberos
>            Reporter: Hari Sekhon
>            Assignee: Thejas M Nair
>            Priority: Critical
>
> When trying to create an external table via beeline in Hive using the SQLStdAuthorizer it expects the table creator to be the owner of the directory path and ignores the group rwx permission that is granted to the user.
> {code}Error: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: Principal [name=hari, type=USER] does not have following privileges for operation CREATETABLE [[INSERT, DELETE, OBJECT OWNERSHIP] on Object [type=DFS_URI, name=/etl/path/to/hdfs/dir]] (state=42000,code=40000){code}
> All it should be checking is read access to that directory.
> The directory owner requirement breaks the ability of more than one user to create external table definitions to a given location. For example this is a flume landing directory with json data, and the /etl tree is owned by the flume user. Even chowning the tree to another user would still break access to other users who are able to read the directory in hdfs but would still unable to create external tables on top of it.
> This looks like a remnant of the owner only access model in SQLStdAuth and is a separate issue to HIVE-11864 / HIVE-12324.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)