Uploaded image for project: 'Sentry'
  1. Sentry
  2. SENTRY-1544

Sentry HDFS sync does not work for sentry admin user

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: Hdfs Plugin, Sentry
    • Labels:
      None

      Description

      How to re-produce the issue:

      1. Assuming Sentry HDFS Sync enabled

      2. Create sentry admin user, grant correct group and server level access for this user:

      GRANT ALL ON SERVER serve1 TO ROLE ericlin;
      

      3. Confirmed that the new user can access all databases and tables, including READ and WRITE

      4. Do the following simple hdfs command:

      hadoop fs -mkdir /user/hive/warehouse/ericlin
      mkdir: Permission denied: user=ericlin, access=WRITE, inode="/user/hive/warehouse":hive:hive:drwxrwx--x
      hadoop fs -ls /user/hive/warehouse/
      ls: Permission denied: user=ericlin, access=READ_EXECUTE, inode="/user/hive/warehouse":hive:hive:drwxrwx--x
      

      Same for other databases:

      hadoop fs -ls /user/hive/warehouse/test.db
      ls: Permission denied: user=ericlin, access=READ_EXECUTE, inode="/user/hive/warehouse/test.db":hive:hive:drwxrwx--x
      

      getfacl shows the new user has no access to the warehouse directory:

      hadoop fs -getfacl /user/hive/warehouse
      # file: /user/hive/warehouse
      # owner: hive
      # group: hive
      user::rwx
      user:hive:rwx
      group::---
      group:hive:rwx
      mask::rwx
      other::--x
      

      The only way is to grant database or table permissions for the admin user.

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              ericlin Eric Lin
            • Votes:
              2 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated: