[
https://issues.apache.org/jira/browse/IMPALA-7676?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Fredy Wijaya resolved IMPALA-7676.
----------------------------------
Resolution: Fixed
Fix Version/s: Impala 3.1.0
> DESCRIBE on table should require VIEW_METADATA privilege
> --------------------------------------------------------
>
> Key: IMPALA-7676
> URL: https://issues.apache.org/jira/browse/IMPALA-7676
> Project: IMPALA
> Issue Type: Bug
> Affects Versions: Impala 3.0, Impala 2.12.0
> Reporter: Fredy Wijaya
> Assignee: Fredy Wijaya
> Priority: Major
> Labels: security
> Fix For: Impala 3.1.0
>
>
> Assume there exists a table foo.bar.
> {noformat}
> [localhost:21000] default> create role foo_role;
> [localhost:21000] default> grant role to group test_user;
> [localhost:21000] default> grant create on database foo to role foo_role;
> [localhost:21000] default> describe foo.bar;
> Query: describe foo.bar
> Fetched 0 row(s) in 0.01s
> {noformat}
> Let's contrast this with "describe database".
> {noformat}
> [localhost:21000] default> grant create on server to role foo_role;
> [localhost:21000] default> describe database functional;
> Query: describe database functional
> ERROR: AuthorizationException: User 'test_user' does not have privileges to
> access: functional
> {noformat}
> The "describe table" behavior is inconsistent with "describe database" and
> it's also not a good idea having "create" privilege on a particular table to
> allow issuing "describe table" on another table although no information is
> shown on another table. This is also to make the behavior consistent with
> Hive.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
