You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues-all@impala.apache.org by "Tim Armstrong (JIRA)" <ji...@apache.org> on 2018/06/14 22:58:00 UTC
[jira] [Commented] (IMPALA-6086) Use of permanent function should
require SELECT privilege on DB
[ https://issues.apache.org/jira/browse/IMPALA-6086?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16513098#comment-16513098 ]
Tim Armstrong commented on IMPALA-6086:
---------------------------------------
[~zoram] I left you hanging for a while here... yeah it seems like this is maybe related to the lifecycle of query rewrites and authorisation requests. It seems like we shouldn't execute the function at all, even for the purposes of constant folding, if the user doesn't have permissions. IIRC we do the full analysis, collect authorisation checks, and then check privileges only after analysis completes: https://github.com/apache/impala/blob/1d699a142b2b4adc0dc19665f6196ffc1eff4bfa/fe/src/main/java/org/apache/impala/analysis/AnalysisContext.java#L416
[~aholley][~fredyw] this may be of interest.
> Use of permanent function should require SELECT privilege on DB
> ---------------------------------------------------------------
>
> Key: IMPALA-6086
> URL: https://issues.apache.org/jira/browse/IMPALA-6086
> Project: IMPALA
> Issue Type: Bug
> Components: Catalog, Security
> Affects Versions: Impala 2.9.0, Impala 3.1.0
> Reporter: Zoram Thanga
> Assignee: Zoram Thanga
> Priority: Minor
>
> A user that has no privilege on a database should not be able to execute any permanent functions in that database. This is currently possible, and should be fixed, so that the user must have SELECT privilege to execute permanent functions.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org