[IMPALA-6881] COMPUTE STATS should check for SELECT privilege at analysis

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: Impala 2.9.0, Impala 2.10.0, Impala 2.11.0
• Fix Version/s: Impala 2.13.0, Impala 3.1.0
• Component/s: Frontend
• Labels: security
• Epic Color: ghx-label-2
• Assignee: Fredy Wijaya
• Reporter: Fredy Wijaya
• Created: 18/Apr/18 21:37
• Updated: 14/Jun/19 02:20
• Resolved: 18/Jul/18 04:23

Description

COMPUTE STATS execute SELECT child queries. However in the COMPUTE STATS analysis phase, we only register for ALTER privilege. In other words, having only ALTER privilege on the target will pass the COMPUTE STATS analysis phase, but will fail later in the child queries due to insufficient SELECT privilege on the target table. It will be good to fail early at COMPUTE STATS analysis phase by registering both ALTER and SELECT privileges in the COMPUTE STATS analysis phase.