You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Fredy Wijaya (Code Review)" <ge...@cloudera.org> on 2018/08/28 21:23:56 UTC
[Impala-ASF-CR] IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Fredy Wijaya has uploaded this change for review. ( http://gerrit.cloudera.org:8080/11344
Change subject: IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
......................................................................
IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Prior to this patch, ALTER TABLE/VIEW RENAME required ALTER on the old
table. This may pose a potential security risk, such as having ALTER on
a table and ALL on a particular database allows a user to move the table
to a database with ALL, which will automatically grant that user with
ALL privilege on that table due to the privilege inherited from the
database. This patch fixes the issue by requring ALL on the old table.
What this means is moving a table to a database with ALL privilege will
not elevate the privilege since ALL is now required for a table to be
renamed.
Testing:
- Ran all FE tests
Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
---
M fe/src/main/java/org/apache/impala/analysis/AlterTableOrViewRenameStmt.java
M fe/src/test/java/org/apache/impala/analysis/AuditingTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
3 files changed, 57 insertions(+), 43 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/44/11344/2
--
To view, visit http://gerrit.cloudera.org:8080/11344
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
Gerrit-Change-Number: 11344
Gerrit-PatchSet: 2
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
[Impala-ASF-CR] IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11344 )
Change subject: IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
......................................................................
Patch Set 3: Verified+1
--
To view, visit http://gerrit.cloudera.org:8080/11344
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
Gerrit-Change-Number: 11344
Gerrit-PatchSet: 3
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Thu, 30 Aug 2018 01:11:06 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11344 )
Change subject: IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
......................................................................
Patch Set 3: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/11344
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
Gerrit-Change-Number: 11344
Gerrit-PatchSet: 3
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 29 Aug 2018 21:46:03 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11344 )
Change subject: IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
......................................................................
Patch Set 3:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/3093/ DRY_RUN=false
--
To view, visit http://gerrit.cloudera.org:8080/11344
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
Gerrit-Change-Number: 11344
Gerrit-PatchSet: 3
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 29 Aug 2018 21:46:04 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Posted by "Adam Holley (Code Review)" <ge...@cloudera.org>.
Adam Holley has posted comments on this change. ( http://gerrit.cloudera.org:8080/11344 )
Change subject: IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
......................................................................
Patch Set 2: Code-Review+1
--
To view, visit http://gerrit.cloudera.org:8080/11344
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
Gerrit-Change-Number: 11344
Gerrit-PatchSet: 2
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 28 Aug 2018 23:03:57 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Posted by "Vuk Ercegovac (Code Review)" <ge...@cloudera.org>.
Vuk Ercegovac has posted comments on this change. ( http://gerrit.cloudera.org:8080/11344 )
Change subject: IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
......................................................................
Patch Set 2: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/11344
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
Gerrit-Change-Number: 11344
Gerrit-PatchSet: 2
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 29 Aug 2018 20:25:51 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11344 )
Change subject: IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
......................................................................
Patch Set 2:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/509/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/11344
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
Gerrit-Change-Number: 11344
Gerrit-PatchSet: 2
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 28 Aug 2018 21:59:13 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/11344 )
Change subject: IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
......................................................................
IMPALA-7502: ALTER TABLE RENAME should require ALL on the old table
Prior to this patch, ALTER TABLE/VIEW RENAME required ALTER on the old
table. This may pose a potential security risk, such as having ALTER on
a table and ALL on a particular database allows a user to move the table
to a database with ALL, which will automatically grant that user with
ALL privilege on that table due to the privilege inherited from the
database. This patch fixes the issue by requring ALL on the old table.
What this means is moving a table to a database with ALL privilege will
not elevate the privilege since ALL is now required for a table to be
renamed.
Testing:
- Ran all FE tests
Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
Reviewed-on: http://gerrit.cloudera.org:8080/11344
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
M fe/src/main/java/org/apache/impala/analysis/AlterTableOrViewRenameStmt.java
M fe/src/test/java/org/apache/impala/analysis/AuditingTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
3 files changed, 57 insertions(+), 43 deletions(-)
Approvals:
Impala Public Jenkins: Looks good to me, approved; Verified
--
To view, visit http://gerrit.cloudera.org:8080/11344
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I47a417a77df3f3030cf5f54fd2280b5e5e1fb77a
Gerrit-Change-Number: 11344
Gerrit-PatchSet: 4
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Csaba Ringhofer <cs...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>