> On May 31, 2016, 8:21 p.m., Sravya Tirukkovalur wrote: > > sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivilegesMap.java, > > line 96 > > <https://reviews.apache.org/r/48055/diff/1/?file=1401413#file1401413line96> > > > > Should we enforce "all" instead? As rename is equivalent to dropping > > the original table from the original db? And creating a new table in new db?
You're right, the "all" will be better for this situation. I'll update the patch, thanks. - Colin ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/48055/#review135680 ----------------------------------------------------------- On May 31, 2016, 5:14 a.m., Colin Ma wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/48055/ > ----------------------------------------------------------- > > (Updated May 31, 2016, 5:14 a.m.) > > > Review request for sentry and Sravya Tirukkovalur. > > > Repository: sentry > > > Description > ------- > > User Pete > has read-write access to schema A > has read-only access to schema B > > User Pete nevertheless was able to rename/move Hive table > from schema A to schema B (where he has read-only access): > > {quote} > use A; > alter table table_a rename to B.table_a; > {quote} > > Hive allows to use rename table syntax to move tables across schemas, not > just rename. > > Sentry does not check security boundaries in this case. > > > Diffs > ----- > > > sentry-binding/sentry-binding-hive-common/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHookBase.java > dd16960 > > sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHook.java > ac8265f > > sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivilegesMap.java > bc158ff > > sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/dbprovider/TestDbPrivilegeCleanupOnDrop.java > 767bcbe > > sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/hive/TestOperationsPart2.java > 8eb2851 > > Diff: https://reviews.apache.org/r/48055/diff/ > > > Testing > ------- > > > Thanks, > > Colin Ma > >
