[TRAFODION-2463] Hive: Any user can do update statistics for hive tables

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0
• Component/s: sql-security
• Environment: hadoop - HDP2.4; OS - CentOS6.7
• Assignee: Roberta Marton
• Reporter: Gao, Rui-Xian
• Created: 26/Jan/17 00:22
• Updated: 15/Feb/17 15:57
• Resolved: 15/Feb/17 15:57

Description

Currently, any user can do 'update statistics' for hive tables, then the user will become owner for this table and has all privileges on it.

1. create table in hive :
create external table ext_t1(a int);
2. logon trafci with user1, select from hive.hive.ext_t1 will get internal error as described above, but the user can do 'update statistics' for the hive table.
connect user1/******;
SQL>update statistics for table hive.qa_db_1.traf_ext_t1 on every column;
— SQL operation complete.
Expect result is ERROR[4481], the user cannot do 'update statistics' since he/she doesn't have select privileges on the table.