Konstantin Bereznyakov created HIVE-29823:
---------------------------------------------
Summary: Deferred-authorization views omit accessed columns from
base table privilege objects
Key: HIVE-29823
URL: https://issues.apache.org/jira/browse/HIVE-29823
Project: Hive
Issue Type: Bug
Reporter: Konstantin Bereznyakov
Column-level access policies do not work through deferred-authorization views:
a user with column-scoped access to the base table is denied *all* reads
through the view, including columns they can read directly.
HIVE-24026 makes {{CommandAuthorizerV2}} pass a view's underlying tables to the
authorizer when the view carries the table property {{Authorized=false}} (set
on views created outside Hive's authorization, e.g. by Spark). These base table
privilege objects are built without their accessed columns, because the column
map used by {{getHivePrivObjects}} ({{{}ColumnAccessInfo{}}}) records directly
scanned tables only. A column-scoped read therefore reaches the authorizer as a
table-scope request: {{RangerHiveAuthorizer.getObjectType()}} types a
column-less {{TABLE_OR_VIEW}} object as {{TABLE}} rather than {{{}COLUMN{}}},
satisfiable only by a {{column=*}} policy.
*Reproduction* (qtest against current master, included in the upcoming PR
together with the small column-scoped test validator it uses; the validator
scopes the user's access to column {{id}} of {{{}dv_base{}}}):
{code:sql}
create table dv_base (id int, secret string);
create view dv_def as select id, secret from dv_base;
alter view dv_def set tblproperties('Authorized'='false');
set test.hive.authz.colscoped.allowed=default.dv_base:id;
set hive.security.authorization.enabled=true;
select id from dv_base; /* allowed: covered column, read directly */
select secret from dv_base; /* denied: non-covered column, read directly */
select id from dv_def; /* denied: the SAME covered column, via the view
*/
{code}
{code:java}
FAILED: HiveAccessControlException Permission denied: access to default.dv_base
is column-scoped to [id], request includes [secret]
FAILED: HiveAccessControlException Permission denied: access to default.dv_base
is column-scoped to [id], but the request carries no column list; a table-scope
request requires access to all columns
{code}
In the same via-view query {{applyRowFilterAndColumnMasking}} *does* receive
{{dv_base}} with its columns, so the omission on the {{checkPrivileges}} side
is not a design choice.
The pre-fix path fails closed, so this is a functional defect in an opt-in
feature, not a security exposure; regular (unstamped) views are unaffected.
*Proposed fix:* record indirectly accessed columns in {{ColumnAccessInfo}}
separately from direct accesses, and attach them in {{CommandAuthorizerV2}} to
base tables reached via a deferred-auth view. Post-fix the via-view read of the
covered column succeeds and the direct read of the non-covered column stays
denied.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
