Sorry, the SENTRY reference should have used is SENTRY-838
On Fri, Nov 6, 2026 at 6:59 PM Konstantin Bereznyakov <[email protected]> wrote: > > Hello, > > I ran into an escalation when a customer having partial access to a > table (can query some columns only) was unable to use aggregate > functions like COUNT(*) or COUNT(1) from the table. > > The scenario can be easily reproduced with the following .q file > contents and using the negative test driver > > set > hive.security.authorization.manager=org.apache.hadoop.hive.ql.security.authorization.DefaultHiveAuthorizationProvider; > create table count_column_minimal (a int, b int); > grant select(a) on table count_column_minimal to user hive_test_user; > set hive.security.authorization.enabled=true; > select count(a) from count_column_minimal; > select count(*) from count_column_minimal; > > Technically, if a user has a SELECT privilege on at least one column > of a table, prohibiting the user from querying COUNT() on such a table > does not restrict users from obtaining any new info they otherwise > have access to anyways. > > Trino happily allows aggregate functions in cases like this. Major DBs > seem to be "split" on this. > > I was unable (yet) to conclusively figure out whether this restriction > is a deliberate choice or not (Except really old SENTRY-878 and > HIVE-78). I thought I'd ask if it could make sense to relax this > restriction. I'd be. happy to work on implementing the change. > > Thanks! > Konstantin
