[IMPALA-4315] USE <db> statement throws auth error if user only has column privileges

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Impala 2.7.0
• Fix Version/s: Impala 2.12.0
• Component/s: Frontend
• Labels: security usability
• Target Version: Product Backlog
• Assignee: Csaba Ringhofer
• Reporter: Dimitris Tsirogiannis
• Created: 18/Oct/16 18:34
• Updated: 18/Jan/18 22:39
• Resolved: 18/Jan/18 14:13

Description

From an admin account:

USE test_db;
GRANT SELECT (col_name) ON TABLE foo TO ROLE `test-role`;

If that's the only permission that role 'test-role' has, then any account that belongs to that role cannot run a "USE test_db" statement:

USE test_db;
AuthorizationException: User 'testuser' does not have privileges to access: test_db.*

The following statement works though:

select col_name from test_db.foo;

The problem is that checking for ANY privileges, when accessing a database during the analysis of a USE statement, does not seem to be taking column level privileges into account.

Issue Links

• is related to: IMPALA-4951 Impala does not show database if the user only has column-level access