Uploaded image for project: 'Hive'
  1. Hive
  2. HIVE-11988

[hive] security issue with hive & ranger for import table command

Log workAgile BoardRank to TopRank to BottomBulk Copy AttachmentsBulk Move AttachmentsVotersWatch issueWatchersCreate sub-taskConvert to sub-taskMoveLinkCloneLabelsUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Critical
    • Resolution: Fixed
    • 0.14.0, 1.2.1
    • 1.2.2, 1.3.0, 2.0.0
    • Hive
    • None

    Description

      if a user does not have permission to create table in hive , then if the same user import data for a table using following command then , it will have to create table also and that is working successfully , ideally it should not work
      STR:
      ====
      1. put some raw data in hdfs path /user/user1/tempdata
      2. in ranger check policy , user1 should not have any permission on any table
      3. login through user1 into beeline ( obviously it will fail since user doesnt have permission to create table)
      create table tt1(id INT,ff String);
      FAILED: HiveAccessControlException Permission denied: user user1 does not have CREATE privilege on default/tt1 (state=42000,code=40000)
      4. now try following command to import data into a table ( table should not exist already)
      import table tt1 from '/user/user1/tempdata';
      ER:
      since user1 doesnt have permission to create table so this operation should fail
      AR:
      table is created successfully and data is also imported !!

      Attachments

        1. authorization_uri_import_q_hive.log
          3.95 MB
          Sushanth Sowmyan
        2. authorization_uri_import_q_output.txt
          147 kB
          Sushanth Sowmyan
        3. HIVE-11988.2.patch
          31 kB
          Sushanth Sowmyan
        4. HIVE-11988.3.patch
          31 kB
          Sushanth Sowmyan
        5. HIVE-11988.4.patch
          33 kB
          Sushanth Sowmyan
        6. HIVE-11988.5.patch
          32 kB
          Sushanth Sowmyan
        7. HIVE-11988.patch
          10 kB
          Sushanth Sowmyan

        Issue Links

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            sushanth Sushanth Sowmyan Assign to me
            deepakhuawei Deepak Sharma
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment