You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sentry.apache.org by Prasad Mujumdar <pr...@cloudera.com> on 2014/04/11 09:10:16 UTC
Review Request 20251: SENTRY-152:Sentry checks permissions on underlying
partitioned table when accessing a view
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/20251/
-----------------------------------------------------------
Review request for sentry, Brock Noland and Sravya Tirukkovalur.
Bugs: SENTRY-152
https://issues.apache.org/jira/browse/SENTRY-152
Repository: sentry
Description
-------
When Hive compiler parses a query with view, it includes both view and the base tables as the input entities. The table entities added for view have reference to view as parent object. Sentry uses this to filter out such tables from authorization check.
In case of partitioned tables, Hive includes the partition input entity for partitions accessed in the query. Sentry extracts the underlying tables. Now for the case of view defined on partition table, we get partition entities with view as parent reference. Just like tables, these partitions should also be skipped since they are added for the base table.
The patch is just extending this filtering logic to include partitions as well.
Diffs
-----
sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHook.java 8e5cf4e
sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/hive/TestViewPrivileges.java PRE-CREATION
Diff: https://reviews.apache.org/r/20251/diff/
Testing
-------
Added new test case for queries on view with partition tables. The tests fail without the patch and passes with the patch.
Thanks,
Prasad Mujumdar
Re: Review Request 20251: SENTRY-152:Sentry checks permissions on underlying
partitioned table when accessing a view
Posted by Brock Noland <br...@cloudera.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/20251/#review40151
-----------------------------------------------------------
sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/hive/TestViewPrivileges.java
<https://reviews.apache.org/r/20251/#comment73021>
nit: trailing ws
sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/hive/TestViewPrivileges.java
<https://reviews.apache.org/r/20251/#comment73022>
nit: trailing ws
- Brock Noland
On April 11, 2014, 7:10 a.m., Prasad Mujumdar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/20251/
> -----------------------------------------------------------
>
> (Updated April 11, 2014, 7:10 a.m.)
>
>
> Review request for sentry, Brock Noland and Sravya Tirukkovalur.
>
>
> Bugs: SENTRY-152
> https://issues.apache.org/jira/browse/SENTRY-152
>
>
> Repository: sentry
>
>
> Description
> -------
>
> When Hive compiler parses a query with view, it includes both view and the base tables as the input entities. The table entities added for view have reference to view as parent object. Sentry uses this to filter out such tables from authorization check.
> In case of partitioned tables, Hive includes the partition input entity for partitions accessed in the query. Sentry extracts the underlying tables. Now for the case of view defined on partition table, we get partition entities with view as parent reference. Just like tables, these partitions should also be skipped since they are added for the base table.
> The patch is just extending this filtering logic to include partitions as well.
>
>
> Diffs
> -----
>
> sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHook.java 8e5cf4e
> sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/hive/TestViewPrivileges.java PRE-CREATION
>
> Diff: https://reviews.apache.org/r/20251/diff/
>
>
> Testing
> -------
>
> Added new test case for queries on view with partition tables. The tests fail without the patch and passes with the patch.
>
>
> Thanks,
>
> Prasad Mujumdar
>
>
Re: Review Request 20251: SENTRY-152:Sentry checks permissions on underlying
partitioned table when accessing a view
Posted by Prasad Mujumdar <pr...@cloudera.com>.
> On April 11, 2014, 1:03 p.m., Brock Noland wrote:
> > lgtm
Thanks Brock! I will fix the formatting before committing the patch.
BTW would you mind adding a +1 to the ticket when get a chance. Thanks!
- Prasad
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/20251/#review40152
-----------------------------------------------------------
On April 11, 2014, 7:10 a.m., Prasad Mujumdar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/20251/
> -----------------------------------------------------------
>
> (Updated April 11, 2014, 7:10 a.m.)
>
>
> Review request for sentry, Brock Noland and Sravya Tirukkovalur.
>
>
> Bugs: SENTRY-152
> https://issues.apache.org/jira/browse/SENTRY-152
>
>
> Repository: sentry
>
>
> Description
> -------
>
> When Hive compiler parses a query with view, it includes both view and the base tables as the input entities. The table entities added for view have reference to view as parent object. Sentry uses this to filter out such tables from authorization check.
> In case of partitioned tables, Hive includes the partition input entity for partitions accessed in the query. Sentry extracts the underlying tables. Now for the case of view defined on partition table, we get partition entities with view as parent reference. Just like tables, these partitions should also be skipped since they are added for the base table.
> The patch is just extending this filtering logic to include partitions as well.
>
>
> Diffs
> -----
>
> sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHook.java 8e5cf4e
> sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/hive/TestViewPrivileges.java PRE-CREATION
>
> Diff: https://reviews.apache.org/r/20251/diff/
>
>
> Testing
> -------
>
> Added new test case for queries on view with partition tables. The tests fail without the patch and passes with the patch.
>
>
> Thanks,
>
> Prasad Mujumdar
>
>
Re: Review Request 20251: SENTRY-152:Sentry checks permissions on underlying
partitioned table when accessing a view
Posted by Brock Noland <br...@cloudera.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/20251/#review40152
-----------------------------------------------------------
Ship it!
lgtm
- Brock Noland
On April 11, 2014, 7:10 a.m., Prasad Mujumdar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/20251/
> -----------------------------------------------------------
>
> (Updated April 11, 2014, 7:10 a.m.)
>
>
> Review request for sentry, Brock Noland and Sravya Tirukkovalur.
>
>
> Bugs: SENTRY-152
> https://issues.apache.org/jira/browse/SENTRY-152
>
>
> Repository: sentry
>
>
> Description
> -------
>
> When Hive compiler parses a query with view, it includes both view and the base tables as the input entities. The table entities added for view have reference to view as parent object. Sentry uses this to filter out such tables from authorization check.
> In case of partitioned tables, Hive includes the partition input entity for partitions accessed in the query. Sentry extracts the underlying tables. Now for the case of view defined on partition table, we get partition entities with view as parent reference. Just like tables, these partitions should also be skipped since they are added for the base table.
> The patch is just extending this filtering logic to include partitions as well.
>
>
> Diffs
> -----
>
> sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHook.java 8e5cf4e
> sentry-tests/sentry-tests-hive/src/test/java/org/apache/sentry/tests/e2e/hive/TestViewPrivileges.java PRE-CREATION
>
> Diff: https://reviews.apache.org/r/20251/diff/
>
>
> Testing
> -------
>
> Added new test case for queries on view with partition tables. The tests fail without the patch and passes with the patch.
>
>
> Thanks,
>
> Prasad Mujumdar
>
>