[HIVE-3271] Privilege can be granted by any user(not owner) to any user(even to the same user)

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 0.8.1
• Component/s: Authorization, Security
• Assignee: Unassigned
• Reporter: Unnikrishnan V T
• Created: 18/Jul/12 12:55
• Updated: 08/Jul/15 23:51

Description

I have created two users user 'unni' and user 'sachin'. user unni created a table 'test3' so that user sachin cannot view that table. But user sachin is able to grant all permission to the table test3.
I have set
1)hive.security.authorization.enabled=true(in hive-site.xml)
2)dfs.permissions=true(in hdfs-site.xml)
3)dfs.permissions.supergroup=supergroup(in hdfs-site.xml)
User sachin and user unni are in supergroup group.
The user sachin is even able to revoke all permissions from the owner of the table user unni.