You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "adutra (via GitHub)" <gi...@apache.org> on 2026/10/29 19:31:01 UTC
[PR] Make fine-grained table update privileges subsume TABLE_READ_PROPERTIES [polaris]
adutra opened a new pull request, #5923:
URL: https://github.com/apache/polaris/pull/5923
A table update returns the full table metadata, just like `loadTable`. Unlike `TABLE_WRITE_PROPERTIES`, the fine-grained update privileges (`TABLE_ASSIGN_UUID`, `TABLE_SET_PROPERTIES`, etc.) and `TABLE_MANAGE_STRUCTURE` did not subsume `TABLE_READ_PROPERTIES`, so a role could update a table it could not read.
Make all of them subsume `TABLE_READ_PROPERTIES`, consistent with `TABLE_WRITE_PROPERTIES`. The Ranger service definition mirrors the change through impliedGrants.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make fine-grained table update privileges subsume TABLE_READ_PROPERTIES [polaris]
Posted by "jbonofre (via GitHub) via issues" <is...@polaris.apache.org>.
jbonofre commented on PR #5923:
URL: https://github.com/apache/polaris/pull/5923#issuecomment-6578712565
@adutra it seems we have to deal with the `CHANGELOG` pain again 😄 Do you mind to rebase/resolve the conflict?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make fine-grained table update privileges subsume TABLE_READ_PROPERTIES [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra commented on code in PR #5923:
URL: https://github.com/apache/polaris/pull/5923#discussion_r4423566638
##########
runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/AbstractIcebergCatalogHandlerAuthzTest.java:
##########
@@ -1015,6 +1015,24 @@ Stream<DynamicNode> testLoadTablePrivileges() {
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
Review Comment:
Interesting idea but I prefer to list all privileges one by one. If someone thinks otherwise please let me know and I can make the change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make fine-grained table update privileges subsume TABLE_READ_PROPERTIES [polaris]
Posted by "orca-review-bot (via GitHub)" <gi...@apache.org>.
orca-review-bot commented on code in PR #5923:
URL: https://github.com/apache/polaris/pull/5923#discussion_r4417306491
##########
CHANGELOG.md:
##########
@@ -135,6 +135,13 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
accounts for them. Entities with many grants weigh more, which can lead to more evictions than before
with the same configured value. The description of `ENTITY_CACHE_WEIGHER_TARGET` now documents that
its weights approximate bytes.
+- `TABLE_MANAGE_STRUCTURE` and the fine-grained table update privileges (such as
+ `TABLE_ASSIGN_UUID`, `TABLE_ADD_SCHEMA` or `TABLE_SET_PROPERTIES`) now subsume
+ `TABLE_READ_PROPERTIES`, consistent with `TABLE_WRITE_PROPERTIES`, because a table update returns
+ the full table metadata. Roles holding only one of these privileges can now also load the table.
Review Comment:
This only says these roles can now load the table. The same change also lets them get applicable policies on the table and load generic tables (both need TABLE_READ_PROPERTIES). Can we mention that here so operators auditing grants see the full scope?
<sub>🤖 AI-generated review comment — agents make mistakes, so please verify before acting on it.</sub>
##########
runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/AbstractIcebergCatalogHandlerAuthzTest.java:
##########
@@ -1015,6 +1015,24 @@ Stream<DynamicNode> testLoadTablePrivileges() {
.shouldPassWith(PolarisPrivilege.TABLE_FULL_METADATA)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_CONTENT)
.shouldPassWith(PolarisPrivilege.CATALOG_MANAGE_METADATA)
+ .shouldPassWith(PolarisPrivilege.TABLE_MANAGE_STRUCTURE)
Review Comment:
The same 18-privilege list is now copied into four test methods across three files. Could we pull it into one shared constant? Then the next fine-grained privilege only has to be added in one place.
<sub>🤖 AI-generated review comment — agents make mistakes, so please verify before acting on it.</sub>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make fine-grained table update privileges subsume TABLE_READ_PROPERTIES [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on PR #5923:
URL: https://github.com/apache/polaris/pull/5923#issuecomment-6507149114
> One doc follow-up that's outside the diff: the properties warning in site/content/in-dev/unreleased/managing-security/access-control.md (around line 136) says only TABLE_READ_PROPERTIES / TABLE_FULL_METADATA holders can read table properties. Can we add the update privileges there too?
this is valid, but I'm OK with a followup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Make fine-grained table update privileges subsume TABLE_READ_PROPERTIES [polaris]
Posted by "adutra (via GitHub) via issues" <is...@polaris.apache.org>.
adutra merged PR #5923:
URL: https://github.com/apache/polaris/pull/5923
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org