You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sentry.apache.org by "Sravya Tirukkovalur (JIRA)" <ji...@apache.org> on 2015/11/21 01:39:11 UTC
[jira] [Comment Edited] (SENTRY-960) Sentry no longer enforces it's
whitelist
[ https://issues.apache.org/jira/browse/SENTRY-960?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15019171#comment-15019171 ]
Sravya Tirukkovalur edited comment on SENTRY-960 at 11/21/15 12:38 AM:
-----------------------------------------------------------------------
https://issues.apache.org/jira/browse/HIVE-12486
Looks like Hive requires temporary functions to be whitelisted, if white listing is being used. Which means users will not be able to use temporary functions: As appending a function name to whitelist which will be used by a user in a future session in unrealistic.
I think until HIVE-12486 is fixed, we should use blacklist approach.
was (Author: sravya):
https://issues.apache.org/jira/browse/HIVE-12486
Looks like Hive requires temporary functions to be whitelisted, if white listing is being used. Which means will not be able to use temporary functions: As appending a function name to whitelist which will be used by a user in a future session in unrealistic.
I think until HIVE-12486 is fixed, we should use blacklist approach.
> Sentry no longer enforces it's whitelist
> ----------------------------------------
>
> Key: SENTRY-960
> URL: https://issues.apache.org/jira/browse/SENTRY-960
> Project: Sentry
> Issue Type: Bug
> Components: Sentry
> Reporter: Ryan P
> Assignee: Sravya Tirukkovalur
> Attachments: SENTRY-960.10.patch, SENTRY-960.11.patch, SENTRY-960.2.patch, SENTRY-960.3.patch, SENTRY-960.4.patch, SENTRY-960.4.patch, SENTRY-960.5.patch, SENTRY-960.6.patch, SENTRY-960.7.patch, SENTRY-960.8.patch, SENTRY-960.9.patch, SENTRY-960.patch
>
>
> HiveSemanticAnalyzerHookContext no longer includes built-in functions as an input to it's Read Entities. This change hides built in functions from HiveAuthzBindingHook which is a huge security hole.
> Failing to enforce the whitelist will allow users to execute such functions as REFLECT and JAVA_METHOD.
> https://cwiki.apache.org/confluence/display/Hive/ReflectUDF
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)