You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@sentry.apache.org by "Na Li (JIRA)" <ji...@apache.org> on 2018/10/05 04:04:00 UTC
[jira] [Assigned] (SENTRY-2424) sentry.db.explicit.grants.permitted
config does not allow empty value to mean allow all privileges
[ https://issues.apache.org/jira/browse/SENTRY-2424?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Na Li reassigned SENTRY-2424:
-----------------------------
Assignee: Sergio Peña
> sentry.db.explicit.grants.permitted config does not allow empty value to mean allow all privileges
> --------------------------------------------------------------------------------------------------
>
> Key: SENTRY-2424
> URL: https://issues.apache.org/jira/browse/SENTRY-2424
> Project: Sentry
> Issue Type: Bug
> Components: Core
> Affects Versions: 2.0.1
> Reporter: Fredy Wijaya
> Assignee: Sergio Peña
> Priority: Major
>
> https://issues.apache.org/jira/browse/SENTRY-2413 introduced "sentry.db.explicit.grants.permitted" to specify which privileges are permitted to be granted explicitly. Empty value means allow all privileges. However the following sentry-site.xml does not work.
> {noformat}
> <property>
> <name>sentry.db.explicit.grants.permitted</name>
> <value></value>
> </property>
> {noformat}
> Apparently using a space works.
> {noformat}
> <property>
> <name>sentry.db.explicit.grants.permitted</name>
> <value> </value>
> </property>
> {noformat}
> Steps to reproduce in Impala:
> {noformat}
> [localhost:21000] default> create role foo_role;
> [localhost:21000] default> grant alter on table functional.alltypes to role foo_role;
> ERROR: AuthorizationException: User 'foobar' does not have privileges to execute: GRANT_PRIVILEGE
> {noformat}
> Stacktrace:
> {noformat}
> 18/10/04 20:01:06 ERROR thrift.SentryPolicyStoreProcessor: GRANT privilege for [ALTER] not permitted.
> org.apache.sentry.core.common.exception.SentryGrantDeniedException: GRANT privilege for [ALTER] not permitted.
> at org.apache.sentry.api.common.SentryServiceUtil.checkDbExplicitGrantsPermitted(SentryServiceUtil.java:364)
> at org.apache.sentry.api.service.thrift.SentryPolicyStoreProcessor.alter_sentry_role_grant_privilege(SentryPolicyStoreProcessor.java:265)
> at org.apache.sentry.api.service.thrift.SentryPolicyService$Processor$alter_sentry_role_grant_privilege.getResult(SentryPolicyService.java:1597)
> at org.apache.sentry.api.service.thrift.SentryPolicyService$Processor$alter_sentry_role_grant_privilege.getResult(SentryPolicyService.java:1582)
> at org.apache.thrift.ProcessFunction.process(ProcessFunction.java:39)
> at org.apache.thrift.TBaseProcessor.process(TBaseProcessor.java:39)
> at org.apache.sentry.api.service.thrift.SentryProcessorWrapper.process(SentryProcessorWrapper.java:36)
> at org.apache.thrift.TMultiplexedProcessor.process(TMultiplexedProcessor.java:123)
> at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:286)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> at java.lang.Thread.run(Thread.java:748)
> {noformat}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)