[
https://issues.apache.org/jira/browse/HIVE-23339?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17107149#comment-17107149
]
Miklos Gergely commented on HIVE-23339:
---------------------------------------
Thank you [~thejas]
[~ShubhamChaurasia] I'd also suggest to find more meaningful names for the
methods here. Currently all the functions declared in this interface are called
"authorize", and they differ only in their signature. The aforementioned
function is for (according to it's comment): "Authorization user level
privileges.". Actually it is called only for create database commands, so we
might as well rename it to something like authorizeCreateDatabase. The rest of
the methods should be reviewed as well.
It is not closely related to this jira, but as we'll change the API now anyway,
we could do this now too.
> SBA does not check permissions for DB location specified in Create database
> query
> ---------------------------------------------------------------------------------
>
> Key: HIVE-23339
> URL: https://issues.apache.org/jira/browse/HIVE-23339
> Project: Hive
> Issue Type: Bug
> Components: Hive
> Affects Versions: 3.1.0
> Reporter: Riju Trivedi
> Assignee: Shubham Chaurasia
> Priority: Critical
> Labels: pull-request-available
> Attachments: HIVE-23339.01.patch
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> With doAs=true and StorageBasedAuthorization provider, create database with
> specific location succeeds even if user doesn't have access to that path.
>
> {code:java}
> hadoop fs -ls -d /tmp/cannot_write
> drwx------ - hive hadoop 0 2020-04-01 22:53 /tmp/cannot_write
> create a database under /tmp/cannot_write. We would expect it to fail, but is
> actually created successfully with "hive" as the owner:
> rtrivedi@bdp01:~> beeline -e "create database rtrivedi_1 location
> '/tmp/cannot_write/rtrivedi_1'"
> INFO : OK
> No rows affected (0.116 seconds)
> hive@hpchdd2e:~> hadoop fs -ls /tmp/cannot_write
> Found 1 items
> drwx------ - hive hadoop 0 2020-04-01 23:05 /tmp/cannot_write/rtrivedi_1
> {code}
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
