[
https://issues.apache.org/jira/browse/HIVE-25532?focusedWorklogId=651991&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-651991
]
ASF GitHub Bot logged work on HIVE-25532:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 16/Sep/21 20:46
Start Date: 16/Sep/21 20:46
Worklog Time Spent: 10m
Work Description: achennagiri opened a new pull request #2649:
URL: https://github.com/apache/hive/pull/2649
### What changes were proposed in this pull request?
We added authorization support for Kill Query command a while back. Below is
the ticket https://issues.apache.org/jira/browse/RANGER-1851
However, we have observed that this hasn't been working as expected. The
Ranger service expects Hive to send in a privilege object of the type
SERVICE_NAME but we can see below
https://github.com/apache/hive/blob/master/service/src/java/org/apache/hive/service/server/KillQueryImpl.java#L131
that it is sending an empty array list.
The Ranger service never throws an exception to this and this results in any
user being able to kill any query even though they don't have necessary
permissions.
### Why are the changes needed?
Currently, any user can kill any other query using the query id. Basically,
KILL QUERY is an ADMIN level command and a user is supposed to have the
necessary permissions to execute it without which it should fail.
We need this fix to address that bug.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
This patch was used to create the hive-service jar. This dev jar was
replaced on a cluster running Hive and Ranger services. The hiveserver logs
were used to confirm that the checkPrivileges() call returns an exception on a
user without sufficient permissions(Basically, any user without SERVICE_ADMIN
permission is not allowed to execute Kill query).
Also, the logs are audited in the Ranger and they are as expected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
Issue Time Tracking
-------------------
Worklog Id: (was: 651991)
Remaining Estimate: 0h
Time Spent: 10m
> Fix authorization support for Kill Query Command
> ------------------------------------------------
>
> Key: HIVE-25532
> URL: https://issues.apache.org/jira/browse/HIVE-25532
> Project: Hive
> Issue Type: Bug
> Components: HiveServer2
> Reporter: Abhay
> Assignee: Abhay
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> We added authorization for Kill Query command some time back with the help of
> Ranger. Below is the ticket https://issues.apache.org/jira/browse/RANGER-1851
> However, we have observed that this hasn't been working as expected. The
> Ranger service expects Hive to send in a privilege object of the type
> SERVICE_NAME but we can see below
>
> [https://github.com/apache/hive/blob/master/service/src/java/org/apache/hive/service/server/KillQueryImpl.java#L131]
> that it is sending an empty array list.
> The Ranger service never throws an exception to this and this results in any
> user being able to kill any query even though they don't have necessary
> permissions.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
