[ https://issues.apache.org/jira/browse/SENTRY-2315?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16548741#comment-16548741 ]
Na Li commented on SENTRY-2315: ------------------------------- [~spena] What is the behavior when role role_A has "ALL" privilege on an object DB_1, then admin revokes "CREATE" from this role_A on DB_1? Do we keep the behavior that revoking "CREATE" from "ALL" has no impact and role_A still has "ALL" privilege? * If so, this is different behavior of revoking "SELECT" or "INSERT" from "ALL", which removes "ALL". * If not, then user may be surprised that revoking "SELECT" from "ALL" may result in "CREATE" and other actions > The grant all operation is not dropping the create/alter/drop/index/lock > privileges. > ------------------------------------------------------------------------------------ > > Key: SENTRY-2315 > URL: https://issues.apache.org/jira/browse/SENTRY-2315 > Project: Sentry > Issue Type: Bug > Components: Sentry > Affects Versions: 2.1.0 > Reporter: Sergio Peña > Assignee: Sergio Peña > Priority: Major > Attachments: SENTRY-2315.1.patch > > > When an object has the ALL privilege, any individual privilege explicitly > granted (i.e. create, select, insert, ...) after that has no effect on the > privilege list because ALL implies the role or user has all those privileges. > However, when any of the new privileges list (create, alter, drop) is granted > before, and then the grant ALL happens, those privileges are not removed. We > should keep the GRANT ALL consistent and remove any individual privilege > (except the OWNER privilege) from the list. -- This message was sent by Atlassian JIRA (v7.6.3#76005)