[jira] [Work started] (IMPALA-7676) DESCRIBE on table should require VIEW_METADATA privilege

["Fredy Wijaya (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/IMPALA-7676?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Work on IMPALA-7676 started by Fredy Wijaya.
--------------------------------------------
> DESCRIBE on table should require VIEW_METADATA privilege
> --------------------------------------------------------
>
>                 Key: IMPALA-7676
>                 URL: https://issues.apache.org/jira/browse/IMPALA-7676
>             Project: IMPALA
>          Issue Type: Bug
>    Affects Versions: Impala 3.0, Impala 2.12.0
>            Reporter: Fredy Wijaya
>            Assignee: Fredy Wijaya
>            Priority: Major
>
> Assume there exists a table foo.bar.
> {noformat}
> [localhost:21000] default> create role foo_role;
> [localhost:21000] default> grant role to group test_user;
> [localhost:21000] default> grant create on database foo to role foo_role;
> [localhost:21000] default> describe foo.bar;
> Query: describe foo.bar
> Fetched 0 row(s) in 0.01s
> {noformat}
> Let's contrast this with "describe database".
> {noformat}
> [localhost:21000] default> grant create on server to role foo_role;
> [localhost:21000] default> describe database functional;
> Query: describe database functional
> ERROR: AuthorizationException: User 'test_user' does not have privileges to access: functional
> {noformat}
> The "describe table" behavior is inconsistent with "describe database" and it's also not a good idea having "create" privilege on a particular table to allow issuing "describe table" on another table although no information is shown on another table.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org