[HIVE-21532] RuntimeException due to AccessControlException during creating hive-staging-dir

• Type: Bug
• Status: Patch Available
• Priority: Minor
• Resolution: Unresolved
• Assignee: Oleksiy Sayankin
• Reporter: Oleksandr Polishchuk
• Created: 28/Mar/19 12:19
• Updated: 01/Apr/19 12:13

Description

The bug was found with environment - Hive-2.3.

Steps lead to an exception:
1) Create user without root permissions on your node.
2) The hive-site.xml file has to contain the next properties:

 <property>
    <name>hive.security.authorization.enabled</name>
  <value>true</value>
  </property>
  <property>
   <name>hive.security.authorization.manager</name>
 <value>org.apache.hadoop.hive.ql.security.authorization.plugin.fallback.FallbackHiveAuthorizerFactory</value>
  </property>

3) Open Hive CLI and do next query:

 insert overwrite local directory '/tmp/test_dir' row format delimited fields terminated by ',' select * from temp.test;

The previous query will fails with the next exception:

FAILED: RuntimeException Cannot create staging directory 'hdfs:///tmp/test_dir/.hive-staging_hive_2019-03-28_11-51-05_319_5882446299335967521-1': User testuser(user id 3456)  has been denied access to create .hive-staging_hive_2019-03-28_11-51-05_319_5882446299335967521-1

The investigation shows that if delete the mentioned above properties from hive-site.xml and pass `queryTmpdir` instead of `dest_path` in the org.apache.hadoop.hive.ql.Context#getTempDirForPath() as was in the Hive-2.1. everything will be fine. The current method is using in the org.apache.hadoop.hive.ql.parse.SemanticAnalyzer  - String statsTmpLoc = ctx.getTempDirForPath(dest_path).toString();

Issue Links

• links to: Review Board