[
https://issues.apache.org/jira/browse/SENTRY-960?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15014914#comment-15014914
]
Sravya Tirukkovalur commented on SENTRY-960:
--------------------------------------------
Attaching a patch with the following behavior:
By default Sentry whitelists a set of commands, currently this is equivalent to
all UDF commands supported by Hive except "reflect,reflec2,java_method"
Users can append to this whitelist using hive parameter:
"hive.server2.builtin.udf.whitelist"
Users can also specify the blacklist using hive parameter:
"hive.server2.builtin.udf.blacklist"
> Sentry no longer enforces it's whitelist
> ----------------------------------------
>
> Key: SENTRY-960
> URL: https://issues.apache.org/jira/browse/SENTRY-960
> Project: Sentry
> Issue Type: Bug
> Components: Sentry
> Reporter: Ryan P
> Assignee: Sravya Tirukkovalur
> Attachments: SENTRY-960.2.patch, SENTRY-960.3.patch,
> SENTRY-960.4.patch, SENTRY-960.4.patch, SENTRY-960.5.patch,
> SENTRY-960.6.patch, SENTRY-960.7.patch, SENTRY-960.8.patch,
> SENTRY-960.9.patch, SENTRY-960.patch
>
>
> HiveSemanticAnalyzerHookContext no longer includes built-in functions as an
> input to it's Read Entities. This change hides built in functions from
> HiveAuthzBindingHook which is a huge security hole.
> Failing to enforce the whitelist will allow users to execute such functions
> as REFLECT and JAVA_METHOD.
> https://cwiki.apache.org/confluence/display/Hive/ReflectUDF
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
