Quanlong Huang created IMPALA-10554:
---------------------------------------
Summary: Block modifications when row-filter/column-mask is
enabled for the user
Key: IMPALA-10554
URL: https://issues.apache.org/jira/browse/IMPALA-10554
Project: IMPALA
Issue Type: Bug
Components: Security
Affects Versions: Impala 3.4.0
Reporter: Quanlong Huang
Attachments: column_masking_policy.png
Per RANGER-1087 and RANGER-1100, table modifications(insert/delete/update)
should be blocked when row-filter/column-masking policy is enabled for the user.
Currently, Impala doesn't block them, which is a bug considering to Hive's
behavior.
*Reproducing the issue*
Create a table and a column masking policy on it:
{code:sql}
hive> create table hql_tbl (id int, name string) stored as textfile;
hive> insert into table hql_tbl values (0, 'aaa'), (1, 'bbb'), (2, 'ccc');
{code}
Column masking policy:
In Hive, the INSERT will be denied:
{code:sql}
hive> insert into table hql_tbl values (3, 'ddd');
Error while compiling statement: FAILED: HiveAccessControlException Permission
denied: user [admin] does not have [UPDATE] privilege on [default/hql_tbl]
{code}
However, the user is able to insert values using Impala.
The related Ranger config is
xasecure.hive.block.update.if.rowfilter.columnmask.specified.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
