[IMPALA-7325] SHOW CREATE VIEW on a view that references built-in functions requires access to the built-in database

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Impala 3.0, Impala 2.12.0
• Fix Version/s: Impala 3.1.0
• Component/s: Frontend
• Labels: security
• Epic Color: ghx-label-9
• Assignee: Fredy Wijaya
• Reporter: Fredy Wijaya
• Created: 19/Jul/18 17:37
• Updated: 22/Aug/18 15:53
• Resolved: 07/Aug/18 20:54

Description

[localhost:21000] default> create table foo.t(i int);
[localhost:21000] default> create view foo.v1 as select count(*) from foo.t;
[localhost:21000] default> create view foo.v2 as select * from foo.t;
[localhost:21000] default> grant select on database foo to role foo_role;

[localhost:21000] default> show create view foo.v1;
Query: show create view foo.v1
ERROR: AuthorizationException: User 'impdev' does not have privileges to see the definition of view 'foo.v1'.

[localhost:21000] default> show create view foo.v2;
Query: show create view foo.v2
+-----------------------+
| result                |
+-----------------------+
| CREATE VIEW foo.v2 AS |
| SELECT * FROM foo.t   |
+-----------------------+
Fetched 1 row(s) in 0.01s

Issue Links

• is duplicated by: IMPALA-2595 Impala inconsistently checks authorization on query and explain query
• is duplicated by: IMPALA-5674 When using Sentry, it does not have privileges to run SHOW CREATE VIEW including Built-In functions.