[IMPALA-1279] Impala does not employ ACLs when checking path permissions for LOAD and INSERT

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Impala 1.4.1
• Fix Version/s: Impala 2.0
• Assignee: Henry Robinson
• Reporter: Henry Robinson
• Created: 20/Sep/14 00:22
• Updated: 20/Sep/14 05:11
• Resolved: 20/Sep/14 05:11

Description

Impala checks permissions for LOAD and INSERT statements before executing them to allow for early-exit if the query would not succeed. However, it does not take extended ACLs in CDH5 into account.

When a directory has restrictive Posix permissions (e.g. 000), but has an ACL allowing writes, Impala should allow INSERTs and LOADs to happen to that directory. Instead, the early check will disallow them.

If the checks were disabled, the queries would execute (or not!) correctly, because we delegate to libhdfs or the DistributedFileSystem API to actually perform the operations we need.