You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues-all@impala.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2021/03/12 00:41:00 UTC
[jira] [Commented] (IMPALA-10576) Failing
test_grant_revoke_with_role on ASAN builds
[ https://issues.apache.org/jira/browse/IMPALA-10576?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17299954#comment-17299954 ]
ASF subversion and git services commented on IMPALA-10576:
----------------------------------------------------------
Commit 2039746ebecaf75b416d46abb4201e19bcbb98d8 in impala's branch refs/heads/master from Fang-Yu Rao
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=2039746 ]
IMPALA-10576: Add refresh authorization to make a test case less flaky
We found that a test case run in test_grant_revoke_with_role() that is
used to verify a requesting user does not possess the necessary
privilege to perform the GRANT operation could fail since the expected
AuthorizationException is not returned after the query. Since the
privilege of GRANT was revoked immediately before this test case, we
suspect the authorization-related metadata has not been updated. To make
this test case less flaky, in this patch we add a REFRESH AUTHORIZATION
after the query that revoked the GRANT privilege from the requesting
user.
Testing:
- Verified that this patch passes the core tests in an ASAN build.
Change-Id: I7407bac0407e162ab5ba623505bd7ee49bdf3abf
Reviewed-on: http://gerrit.cloudera.org:8080/17165
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
> Failing test_grant_revoke_with_role on ASAN builds
> --------------------------------------------------
>
> Key: IMPALA-10576
> URL: https://issues.apache.org/jira/browse/IMPALA-10576
> Project: IMPALA
> Issue Type: Bug
> Components: Frontend
> Reporter: Fang-Yu Rao
> Assignee: Fang-Yu Rao
> Priority: Major
>
> We found that test_grant_revoke_with_role() could fail with the following error message.
> {noformat}
> Stacktrace
> authorization/test_ranger.py:1084: in test_grant_revoke_with_role
> self.run_test_case('QueryTest/grant_revoke', vector, use_db="default")
> common/impala_test_suite.py:677: in run_test_case
> expected_str, query)
> E AssertionError: Expected exception: User doesn't have necessary permission to grant access
> E
> E when running:
> E
> E grant all on table functional.alltypes to grant_revoke_test_NON_OWNER
> {noformat}
> The failed test case is the query "[grant all on table functional.alltypes to grant_revoke_test_NON_OWNER|https://github.com/apache/impala/blob/3f2eab8764cb19d75de64a6bdc4c4cf982b201a0/testdata/workloads/functional-query/queries/QueryTest/grant_revoke.test#L627]", where the user {{non_owner}} is used to grant the privilege on the {{functional.alltypes}} table to the role {{grant_revoke_test_NON_OWNER}}.
> We expected Impala to return an {{AuthorizationException}} since "[revoke grant option for all on database functional from grant_revoke_test_NON_OWNER|https://github.com/apache/impala/blob/3f2eab8764cb19d75de64a6bdc4c4cf982b201a0/testdata/workloads/functional-query/queries/QueryTest/grant_revoke.test#L622]" was executed so that the users belonging to the groups associated with the role "{{grant_revoke_test_NON_OWNER}}" do not have the privilege to perform grant/revoke operations anymore. Recall that the user {{non_owner}} belongs to the group {{non_owner}} as well, and the group {{non_owner}} is granted the role of {{grant_revoke_test_NON_OWNER}}.
> One thing I can think of to make this test less flaky is to add a "{{refresh authorization}}" after "{{revoke grant option for all on database functional from grant_revoke_test_NON_OWNER}}".
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org