Uploaded image for project: 'Sentry'
  1. Sentry
  2. SENTRY-953

External Partitions which are referenced by more than one table can cause some unexpected behavior with Sentry HDFS sync

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.6.0
    • Fix Version/s: 1.7.0
    • Component/s: Sentry
    • Labels:
      None

      Description

      With Sentry HDFS ACL Sync enabled:

      Under a configured prefix create two external permission directories;

      1. file: /location/pk=1
      2. owner: ryanp
      3. group: ryanp
        user::rwx
        group::rwx
        other::rwx
      1. file: /location/pk=2
      2. owner: ryanp
      3. group: ryanp
        user::rwx
        group::rwx
        other::rwx

      Once a table is created that references these partitions they begin to act as managed directories as expected.

      drwxrwx---+ - hive hive 0 2015-11-04 11:07 /location/pk=1
      drwxrwx---+ - hive hive 0 2015-11-04 11:07 /location/pk=2

      The problem however arrives once we have two tables referencing these partitions with different grants placed against them.

      *both table1 and table2 include both partitions

      grant all on table home1 to role table1;
      grant role home1 to group root;

      grant all on table home2 to role table2;
      grant role home2 to group ryanp;

      You will notice that only the first grant takes effect on the managed directories:

      1. file: /location/pk=1
      2. owner: hive
      3. group: hive
        user::rwx
        user:hive:rwx
        group:root:rwx
        group::---
        group:hive:rwx
        mask::rwx
        other::---
      1. file: /location/pk=2
      2. owner: hive
      3. group: hive
        user::rwx
        user:hive:rwx
        group:root:rwx
        group::---
        group:hive:rwx
        mask::rwx
        other::---

      Dropping the first table also results in the directories no longer being managed at all.

      drop table home1;

      1. file: /location/pk=1
      2. owner: ryanp
      3. group: ryanp
        user::rwx
        group::rwx
        other::rwx
      1. file: /location/pk=2
      2. owner: ryanp
      3. group: ryanp
        user::rwx
        group::rwx
        other::rwx

      The only way to pick up the 2 tables grants at this point would be to restart HMS.

      Since theoretically partitions can be member of numerous tables we should fix this behavior. Grants placed agains either authorizable object should be reflected in HDFS. As long as there are any references to the partition it should remain managed as well.

        Attachments

        1. SENTRY-953.005.patch
          173 kB
          Hao Hao
        2. SENTRY-953.003.patch
          167 kB
          Hao Hao
        3. SENTRY-953.002.patch
          150 kB
          Hao Hao
        4. SENTRY-953.1.patch
          134 kB
          Sravya Tirukkovalur
        5. SENTRY-953.0.patch
          125 kB
          Sravya Tirukkovalur

          Activity

            People

            • Assignee:
              hahao Hao Hao
              Reporter:
              Ryan P Ryan P
            • Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: