[SENTRY-594] Alter database should check output privilege instead of input

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.5.0
• Assignee: Xiaomeng Huang
• Reporter: Xiaomeng Huang
• Created: 23/Dec/14 01:26
• Updated: 18/Mar/15 05:13
• Resolved: 26/Jan/15 07:24

Description

"ALTER DATABASE" command can get entities from WriteEntity, and get nothing from ReadEntity. So this command should check output privilege instead of input.
What's more, "ALTER TABLE" also check output privilege, likes below:

HiveAuthzPrivileges alterTablePrivilege = new HiveAuthzPrivileges.AuthzPrivilegeBuilder().
        addOutputObjectPriviledge(AuthorizableType.Table, EnumSet.of(DBModelAction.ALTER)).
        setOperationScope(HiveOperationScope.TABLE).
        setOperationType(HiveOperationType.DDL).
        build();

Issue Links

• blocks: SENTRY-498 Sentry integration with Hive authorization framework V2
• is depended upon by: SENTRY-514 Enable e2e tests for authorization V2