Uploaded image for project: 'Hive'
  1. Hive
  2. HIVE-11988

[hive] security issue with hive & ranger for import table command

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Critical
    • Resolution: Fixed
    • 0.14.0, 1.2.1
    • 1.2.2, 1.3.0, 2.0.0
    • Hive
    • None

    Description

      if a user does not have permission to create table in hive , then if the same user import data for a table using following command then , it will have to create table also and that is working successfully , ideally it should not work
      STR:
      ====
      1. put some raw data in hdfs path /user/user1/tempdata
      2. in ranger check policy , user1 should not have any permission on any table
      3. login through user1 into beeline ( obviously it will fail since user doesnt have permission to create table)
      create table tt1(id INT,ff String);
      FAILED: HiveAccessControlException Permission denied: user user1 does not have CREATE privilege on default/tt1 (state=42000,code=40000)
      4. now try following command to import data into a table ( table should not exist already)
      import table tt1 from '/user/user1/tempdata';
      ER:
      since user1 doesnt have permission to create table so this operation should fail
      AR:
      table is created successfully and data is also imported !!

      Attachments

        1. HIVE-11988.patch
          10 kB
          Sushanth Sowmyan
        2. HIVE-11988.2.patch
          31 kB
          Sushanth Sowmyan
        3. HIVE-11988.3.patch
          31 kB
          Sushanth Sowmyan
        4. HIVE-11988.4.patch
          33 kB
          Sushanth Sowmyan
        5. HIVE-11988.5.patch
          32 kB
          Sushanth Sowmyan
        6. authorization_uri_import_q_hive.log
          3.95 MB
          Sushanth Sowmyan
        7. authorization_uri_import_q_output.txt
          147 kB
          Sushanth Sowmyan

        Issue Links

          Activity

            People

              sushanth Sushanth Sowmyan
              deepakhuawei Deepak Sharma
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: