----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/48055/#review135680 -----------------------------------------------------------
sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivilegesMap.java (line 96) <https://reviews.apache.org/r/48055/#comment200696> Should we enforce "all" instead? As rename is equivalent to dropping the original table from the original db? And creating a new table in new db? - Sravya Tirukkovalur On May 31, 2016, 5:14 a.m., Colin Ma wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/48055/ > ----------------------------------------------------------- > > (Updated May 31, 2016, 5:14 a.m.) > > > Review request for sentry and Sravya Tirukkovalur. > > > Repository: sentry > > > Description > ------- > > User Pete > has read-write access to schema A > has read-only access to schema B > > User Pete nevertheless was able to rename/move Hive table > from schema A to schema B (where he has read-only access): > > {quote} > use A; > alter table table_a rename to B.table_a; > {quote} > > Hive allows to use rename table syntax to move tables across schemas, not > just rename. > > Sentry does not check security boundaries in this case. > > > Diffs > ----- > > > sentry-binding/sentry-binding-hive-common/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHookBase.java > dd16960 > > sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHook.java > ac8265f > > sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivilegesMap.java > bc158ff > > sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/dbprovider/TestDbPrivilegeCleanupOnDrop.java > 767bcbe > > sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/hive/TestOperationsPart2.java > 8eb2851 > > Diff: https://reviews.apache.org/r/48055/diff/ > > > Testing > ------- > > > Thanks, > > Colin Ma > >