[SENTRY-2268] Review the required privileges for DDL commands

• Type: Task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Assignee: Unassigned
• Reporter: Na Li
• Created: 12/Jun/18 19:42
• Updated: 14/Jun/19 18:39

Description

The privileges required for DDL commands are listed in HiveAuthzPrivilegesMap.

addOutputObjectPriviledge(AuthorizableType.Table, EnumSet.of(DBModelAction.INSERT, DBModelAction.ALTER))

means the required output privileges is table level insert OR alter.

addOutputObjectPriviledge(AuthorizableType.Table, EnumSet.of(DBModelAction.INSERT)).
addOutputObjectPriviledge(AuthorizableType.Table, EnumSet.of(DBModelAction.ALTER))

means the required output privileges is table level insert AND alter.

We need to review the privileges to see if they are defined correctly. I suspect multiple definitions want to have privileges with AND, but end up getting privileges with OR.
We should also check if the privilege level is correct. for example, "insert" is table level privilege. It does not make sense to require database level "insert".