[SENTRY-2270] Illegal privileges on columns can be granted on Hive

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.1.0
• Component/s: Sentry
• Assignee: Sergio Peña
• Reporter: Sergio Peña
• Created: 13/Jun/18 22:35
• Updated: 15/Jun/18 16:34
• Resolved: 15/Jun/18 16:34

Description

It is possible to grant the following privileges on columns in beeline: ALTER, CREATE, DROP. However, these privileges have no semantics for a column.

For ALL, and INSERT, beeline raises an error if the user tries to grant the privilege to a column, e.g.:

beeline> grant all(fn) on table tbl1 to role r1;
Error: Error while compiling statement: FAILED: SemanticException Sentry does not support privilege: All on Column (state=42000,code=40000)
beeline> grant insert(fn) on table tbl1 to role r1;
Error: Error while compiling statement: FAILED: SemanticException Sentry does not support privilege: Insert on Column (state=42000,code=40000)

A similar error should be created when granting CREATE, ALTER, and DROP on column.

 

Issue Links

• links to: Review Board