[IMPALA-3133] Unexpected privileges in show output

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Impala 2.2.4, Impala 2.3.0, Impala 2.5.0
• Fix Version/s: Impala 2.6.0, impala 2.5.1
• Component/s: Frontend
• Target Version: Impala 2.6.0, impala 2.5.1, Impala 2.4.2, Impala 2.3.5
• Assignee: Dimitris Tsirogiannis
• Reporter: Thomas Tauber-Marshall
• Created: 03/Mar/16 21:53
• Updated: 07/Jul/16 00:55
• Resolved: 06/May/16 20:36

Description

Impalad's catalog cache, which is used to respond to 'show' operations, can return inconsistent data.

I believe that this is because when a catalog operation is issued, we immediately update the local catalog cache, via ImpaladCatalog::updateCatalog. Every 60 seconds, SentryProxy (via PolicyReader) refreshes the authorization policy metadata in the catalog by querying the Sentry service.

Some sort of race condition exists where an authorization operation may be issued, and the local catalog cache gets updated to reflect this, but then before the Sentry service has received the update SentryProxy refreshes the data, getting stale state from the Sentry service and undoing the change to the local catalog cache. eg:

> grant all on server to role test;
> show grant role test;

scope	server	database	table	column	uri	privilege	grant_option	create_time
SERVER	server1					ALL	false	NULL

> revoke all on server from role test;
> show grant role test;
(no output)

// a few seconds later

> show grant role test

scope	server	database	table	column	uri	privilege	grant_option	create_time
SERVER	server1					ALL	false	NULL

The attached query test file reproduces the error (non-deterministically).

Because operations requiring authorization always contact Sentry instead of relying on the catalog cache, this is not a security issue, but the inconsistent output could be confusing to users.