Hello, I ran into an escalation when a customer having partial access to a table (can query some columns only) was unable to use aggregate functions like COUNT(*) or COUNT(1) from the table.
The scenario can be easily reproduced with the following .q file contents and using the negative test driver set hive.security.authorization.manager=org.apache.hadoop.hive.ql.security.authorization.DefaultHiveAuthorizationProvider; create table count_column_minimal (a int, b int); grant select(a) on table count_column_minimal to user hive_test_user; set hive.security.authorization.enabled=true; select count(a) from count_column_minimal; select count(*) from count_column_minimal; Technically, if a user has a SELECT privilege on at least one column of a table, prohibiting the user from querying COUNT() on such a table does not restrict users from obtaining any new info they otherwise have access to anyways. Trino happily allows aggregate functions in cases like this. Major DBs seem to be "split" on this. I was unable (yet) to conclusively figure out whether this restriction is a deliberate choice or not (Except really old SENTRY-878 and HIVE-78). I thought I'd ask if it could make sense to relax this restriction. I'd be. happy to work on implementing the change. Thanks! Konstantin
