You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hive.apache.org by jd...@apache.org on 2014/07/18 20:15:34 UTC
svn commit: r1611743 [6/6] - in /hive/trunk:
itests/hive-unit/src/test/java/org/apache/hadoop/hive/metastore/
metastore/if/ metastore/src/gen/thrift/gen-cpp/
metastore/src/gen/thrift/gen-javabean/org/apache/hadoop/hive/metastore/api/
metastore/src/gen/...
Modified: hive/trunk/metastore/src/gen/thrift/gen-php/metastore/Types.php
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/gen/thrift/gen-php/metastore/Types.php?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/gen/thrift/gen-php/metastore/Types.php (original)
+++ hive/trunk/metastore/src/gen/thrift/gen-php/metastore/Types.php Fri Jul 18 18:15:33 2014
@@ -1356,6 +1356,195 @@ class PrincipalPrivilegeSet {
}
+class GrantRevokePrivilegeRequest {
+ static $_TSPEC;
+
+ public $requestType = null;
+ public $privileges = null;
+ public $revokeGrantOption = null;
+
+ public function __construct($vals=null) {
+ if (!isset(self::$_TSPEC)) {
+ self::$_TSPEC = array(
+ 1 => array(
+ 'var' => 'requestType',
+ 'type' => TType::I32,
+ ),
+ 2 => array(
+ 'var' => 'privileges',
+ 'type' => TType::STRUCT,
+ 'class' => '\metastore\PrivilegeBag',
+ ),
+ 3 => array(
+ 'var' => 'revokeGrantOption',
+ 'type' => TType::BOOL,
+ ),
+ );
+ }
+ if (is_array($vals)) {
+ if (isset($vals['requestType'])) {
+ $this->requestType = $vals['requestType'];
+ }
+ if (isset($vals['privileges'])) {
+ $this->privileges = $vals['privileges'];
+ }
+ if (isset($vals['revokeGrantOption'])) {
+ $this->revokeGrantOption = $vals['revokeGrantOption'];
+ }
+ }
+ }
+
+ public function getName() {
+ return 'GrantRevokePrivilegeRequest';
+ }
+
+ public function read($input)
+ {
+ $xfer = 0;
+ $fname = null;
+ $ftype = 0;
+ $fid = 0;
+ $xfer += $input->readStructBegin($fname);
+ while (true)
+ {
+ $xfer += $input->readFieldBegin($fname, $ftype, $fid);
+ if ($ftype == TType::STOP) {
+ break;
+ }
+ switch ($fid)
+ {
+ case 1:
+ if ($ftype == TType::I32) {
+ $xfer += $input->readI32($this->requestType);
+ } else {
+ $xfer += $input->skip($ftype);
+ }
+ break;
+ case 2:
+ if ($ftype == TType::STRUCT) {
+ $this->privileges = new \metastore\PrivilegeBag();
+ $xfer += $this->privileges->read($input);
+ } else {
+ $xfer += $input->skip($ftype);
+ }
+ break;
+ case 3:
+ if ($ftype == TType::BOOL) {
+ $xfer += $input->readBool($this->revokeGrantOption);
+ } else {
+ $xfer += $input->skip($ftype);
+ }
+ break;
+ default:
+ $xfer += $input->skip($ftype);
+ break;
+ }
+ $xfer += $input->readFieldEnd();
+ }
+ $xfer += $input->readStructEnd();
+ return $xfer;
+ }
+
+ public function write($output) {
+ $xfer = 0;
+ $xfer += $output->writeStructBegin('GrantRevokePrivilegeRequest');
+ if ($this->requestType !== null) {
+ $xfer += $output->writeFieldBegin('requestType', TType::I32, 1);
+ $xfer += $output->writeI32($this->requestType);
+ $xfer += $output->writeFieldEnd();
+ }
+ if ($this->privileges !== null) {
+ if (!is_object($this->privileges)) {
+ throw new TProtocolException('Bad type in structure.', TProtocolException::INVALID_DATA);
+ }
+ $xfer += $output->writeFieldBegin('privileges', TType::STRUCT, 2);
+ $xfer += $this->privileges->write($output);
+ $xfer += $output->writeFieldEnd();
+ }
+ if ($this->revokeGrantOption !== null) {
+ $xfer += $output->writeFieldBegin('revokeGrantOption', TType::BOOL, 3);
+ $xfer += $output->writeBool($this->revokeGrantOption);
+ $xfer += $output->writeFieldEnd();
+ }
+ $xfer += $output->writeFieldStop();
+ $xfer += $output->writeStructEnd();
+ return $xfer;
+ }
+
+}
+
+class GrantRevokePrivilegeResponse {
+ static $_TSPEC;
+
+ public $success = null;
+
+ public function __construct($vals=null) {
+ if (!isset(self::$_TSPEC)) {
+ self::$_TSPEC = array(
+ 1 => array(
+ 'var' => 'success',
+ 'type' => TType::BOOL,
+ ),
+ );
+ }
+ if (is_array($vals)) {
+ if (isset($vals['success'])) {
+ $this->success = $vals['success'];
+ }
+ }
+ }
+
+ public function getName() {
+ return 'GrantRevokePrivilegeResponse';
+ }
+
+ public function read($input)
+ {
+ $xfer = 0;
+ $fname = null;
+ $ftype = 0;
+ $fid = 0;
+ $xfer += $input->readStructBegin($fname);
+ while (true)
+ {
+ $xfer += $input->readFieldBegin($fname, $ftype, $fid);
+ if ($ftype == TType::STOP) {
+ break;
+ }
+ switch ($fid)
+ {
+ case 1:
+ if ($ftype == TType::BOOL) {
+ $xfer += $input->readBool($this->success);
+ } else {
+ $xfer += $input->skip($ftype);
+ }
+ break;
+ default:
+ $xfer += $input->skip($ftype);
+ break;
+ }
+ $xfer += $input->readFieldEnd();
+ }
+ $xfer += $input->readStructEnd();
+ return $xfer;
+ }
+
+ public function write($output) {
+ $xfer = 0;
+ $xfer += $output->writeStructBegin('GrantRevokePrivilegeResponse');
+ if ($this->success !== null) {
+ $xfer += $output->writeFieldBegin('success', TType::BOOL, 1);
+ $xfer += $output->writeBool($this->success);
+ $xfer += $output->writeFieldEnd();
+ }
+ $xfer += $output->writeFieldStop();
+ $xfer += $output->writeStructEnd();
+ return $xfer;
+ }
+
+}
+
class Role {
static $_TSPEC;
Modified: hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ThriftHiveMetastore-remote
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ThriftHiveMetastore-remote?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ThriftHiveMetastore-remote (original)
+++ hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ThriftHiveMetastore-remote Fri Jul 18 18:15:33 2014
@@ -114,6 +114,7 @@ if len(sys.argv) <= 1 or sys.argv[1] ==
print ' list_privileges(string principal_name, PrincipalType principal_type, HiveObjectRef hiveObject)'
print ' bool grant_privileges(PrivilegeBag privileges)'
print ' bool revoke_privileges(PrivilegeBag privileges)'
+ print ' GrantRevokePrivilegeResponse grant_revoke_privileges(GrantRevokePrivilegeRequest request)'
print ' set_ugi(string user_name, group_names)'
print ' string get_delegation_token(string token_owner, string renewer_kerberos_principal_name)'
print ' i64 renew_delegation_token(string token_str_form)'
@@ -728,6 +729,12 @@ elif cmd == 'revoke_privileges':
sys.exit(1)
pp.pprint(client.revoke_privileges(eval(args[0]),))
+elif cmd == 'grant_revoke_privileges':
+ if len(args) != 1:
+ print 'grant_revoke_privileges requires 1 args'
+ sys.exit(1)
+ pp.pprint(client.grant_revoke_privileges(eval(args[0]),))
+
elif cmd == 'set_ugi':
if len(args) != 2:
print 'set_ugi requires 2 args'
Modified: hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ThriftHiveMetastore.py
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ThriftHiveMetastore.py?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ThriftHiveMetastore.py (original)
+++ hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ThriftHiveMetastore.py Fri Jul 18 18:15:33 2014
@@ -791,6 +791,13 @@ class Iface(fb303.FacebookService.Iface)
"""
pass
+ def grant_revoke_privileges(self, request):
+ """
+ Parameters:
+ - request
+ """
+ pass
+
def set_ugi(self, user_name, group_names):
"""
Parameters:
@@ -4278,6 +4285,38 @@ class Client(fb303.FacebookService.Clien
raise result.o1
raise TApplicationException(TApplicationException.MISSING_RESULT, "revoke_privileges failed: unknown result");
+ def grant_revoke_privileges(self, request):
+ """
+ Parameters:
+ - request
+ """
+ self.send_grant_revoke_privileges(request)
+ return self.recv_grant_revoke_privileges()
+
+ def send_grant_revoke_privileges(self, request):
+ self._oprot.writeMessageBegin('grant_revoke_privileges', TMessageType.CALL, self._seqid)
+ args = grant_revoke_privileges_args()
+ args.request = request
+ args.write(self._oprot)
+ self._oprot.writeMessageEnd()
+ self._oprot.trans.flush()
+
+ def recv_grant_revoke_privileges(self, ):
+ (fname, mtype, rseqid) = self._iprot.readMessageBegin()
+ if mtype == TMessageType.EXCEPTION:
+ x = TApplicationException()
+ x.read(self._iprot)
+ self._iprot.readMessageEnd()
+ raise x
+ result = grant_revoke_privileges_result()
+ result.read(self._iprot)
+ self._iprot.readMessageEnd()
+ if result.success is not None:
+ return result.success
+ if result.o1 is not None:
+ raise result.o1
+ raise TApplicationException(TApplicationException.MISSING_RESULT, "grant_revoke_privileges failed: unknown result");
+
def set_ugi(self, user_name, group_names):
"""
Parameters:
@@ -4899,6 +4938,7 @@ class Processor(fb303.FacebookService.Pr
self._processMap["list_privileges"] = Processor.process_list_privileges
self._processMap["grant_privileges"] = Processor.process_grant_privileges
self._processMap["revoke_privileges"] = Processor.process_revoke_privileges
+ self._processMap["grant_revoke_privileges"] = Processor.process_grant_revoke_privileges
self._processMap["set_ugi"] = Processor.process_set_ugi
self._processMap["get_delegation_token"] = Processor.process_get_delegation_token
self._processMap["renew_delegation_token"] = Processor.process_renew_delegation_token
@@ -6426,6 +6466,20 @@ class Processor(fb303.FacebookService.Pr
oprot.writeMessageEnd()
oprot.trans.flush()
+ def process_grant_revoke_privileges(self, seqid, iprot, oprot):
+ args = grant_revoke_privileges_args()
+ args.read(iprot)
+ iprot.readMessageEnd()
+ result = grant_revoke_privileges_result()
+ try:
+ result.success = self._handler.grant_revoke_privileges(args.request)
+ except MetaException as o1:
+ result.o1 = o1
+ oprot.writeMessageBegin("grant_revoke_privileges", TMessageType.REPLY, seqid)
+ result.write(oprot)
+ oprot.writeMessageEnd()
+ oprot.trans.flush()
+
def process_set_ugi(self, seqid, iprot, oprot):
args = set_ugi_args()
args.read(iprot)
@@ -22017,6 +22071,140 @@ class revoke_privileges_result:
def __ne__(self, other):
return not (self == other)
+class grant_revoke_privileges_args:
+ """
+ Attributes:
+ - request
+ """
+
+ thrift_spec = (
+ None, # 0
+ (1, TType.STRUCT, 'request', (GrantRevokePrivilegeRequest, GrantRevokePrivilegeRequest.thrift_spec), None, ), # 1
+ )
+
+ def __init__(self, request=None,):
+ self.request = request
+
+ def read(self, iprot):
+ if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+ fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+ return
+ iprot.readStructBegin()
+ while True:
+ (fname, ftype, fid) = iprot.readFieldBegin()
+ if ftype == TType.STOP:
+ break
+ if fid == 1:
+ if ftype == TType.STRUCT:
+ self.request = GrantRevokePrivilegeRequest()
+ self.request.read(iprot)
+ else:
+ iprot.skip(ftype)
+ else:
+ iprot.skip(ftype)
+ iprot.readFieldEnd()
+ iprot.readStructEnd()
+
+ def write(self, oprot):
+ if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+ oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+ return
+ oprot.writeStructBegin('grant_revoke_privileges_args')
+ if self.request is not None:
+ oprot.writeFieldBegin('request', TType.STRUCT, 1)
+ self.request.write(oprot)
+ oprot.writeFieldEnd()
+ oprot.writeFieldStop()
+ oprot.writeStructEnd()
+
+ def validate(self):
+ return
+
+
+ def __repr__(self):
+ L = ['%s=%r' % (key, value)
+ for key, value in self.__dict__.iteritems()]
+ return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+ def __eq__(self, other):
+ return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+ def __ne__(self, other):
+ return not (self == other)
+
+class grant_revoke_privileges_result:
+ """
+ Attributes:
+ - success
+ - o1
+ """
+
+ thrift_spec = (
+ (0, TType.STRUCT, 'success', (GrantRevokePrivilegeResponse, GrantRevokePrivilegeResponse.thrift_spec), None, ), # 0
+ (1, TType.STRUCT, 'o1', (MetaException, MetaException.thrift_spec), None, ), # 1
+ )
+
+ def __init__(self, success=None, o1=None,):
+ self.success = success
+ self.o1 = o1
+
+ def read(self, iprot):
+ if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+ fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+ return
+ iprot.readStructBegin()
+ while True:
+ (fname, ftype, fid) = iprot.readFieldBegin()
+ if ftype == TType.STOP:
+ break
+ if fid == 0:
+ if ftype == TType.STRUCT:
+ self.success = GrantRevokePrivilegeResponse()
+ self.success.read(iprot)
+ else:
+ iprot.skip(ftype)
+ elif fid == 1:
+ if ftype == TType.STRUCT:
+ self.o1 = MetaException()
+ self.o1.read(iprot)
+ else:
+ iprot.skip(ftype)
+ else:
+ iprot.skip(ftype)
+ iprot.readFieldEnd()
+ iprot.readStructEnd()
+
+ def write(self, oprot):
+ if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+ oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+ return
+ oprot.writeStructBegin('grant_revoke_privileges_result')
+ if self.success is not None:
+ oprot.writeFieldBegin('success', TType.STRUCT, 0)
+ self.success.write(oprot)
+ oprot.writeFieldEnd()
+ if self.o1 is not None:
+ oprot.writeFieldBegin('o1', TType.STRUCT, 1)
+ self.o1.write(oprot)
+ oprot.writeFieldEnd()
+ oprot.writeFieldStop()
+ oprot.writeStructEnd()
+
+ def validate(self):
+ return
+
+
+ def __repr__(self):
+ L = ['%s=%r' % (key, value)
+ for key, value in self.__dict__.iteritems()]
+ return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+ def __eq__(self, other):
+ return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+ def __ne__(self, other):
+ return not (self == other)
+
class set_ugi_args:
"""
Attributes:
Modified: hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ttypes.py
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ttypes.py?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ttypes.py (original)
+++ hive/trunk/metastore/src/gen/thrift/gen-py/hive_metastore/ttypes.py Fri Jul 18 18:15:33 2014
@@ -990,6 +990,151 @@ class PrincipalPrivilegeSet:
def __ne__(self, other):
return not (self == other)
+class GrantRevokePrivilegeRequest:
+ """
+ Attributes:
+ - requestType
+ - privileges
+ - revokeGrantOption
+ """
+
+ thrift_spec = (
+ None, # 0
+ (1, TType.I32, 'requestType', None, None, ), # 1
+ (2, TType.STRUCT, 'privileges', (PrivilegeBag, PrivilegeBag.thrift_spec), None, ), # 2
+ (3, TType.BOOL, 'revokeGrantOption', None, None, ), # 3
+ )
+
+ def __init__(self, requestType=None, privileges=None, revokeGrantOption=None,):
+ self.requestType = requestType
+ self.privileges = privileges
+ self.revokeGrantOption = revokeGrantOption
+
+ def read(self, iprot):
+ if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+ fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+ return
+ iprot.readStructBegin()
+ while True:
+ (fname, ftype, fid) = iprot.readFieldBegin()
+ if ftype == TType.STOP:
+ break
+ if fid == 1:
+ if ftype == TType.I32:
+ self.requestType = iprot.readI32();
+ else:
+ iprot.skip(ftype)
+ elif fid == 2:
+ if ftype == TType.STRUCT:
+ self.privileges = PrivilegeBag()
+ self.privileges.read(iprot)
+ else:
+ iprot.skip(ftype)
+ elif fid == 3:
+ if ftype == TType.BOOL:
+ self.revokeGrantOption = iprot.readBool();
+ else:
+ iprot.skip(ftype)
+ else:
+ iprot.skip(ftype)
+ iprot.readFieldEnd()
+ iprot.readStructEnd()
+
+ def write(self, oprot):
+ if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+ oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+ return
+ oprot.writeStructBegin('GrantRevokePrivilegeRequest')
+ if self.requestType is not None:
+ oprot.writeFieldBegin('requestType', TType.I32, 1)
+ oprot.writeI32(self.requestType)
+ oprot.writeFieldEnd()
+ if self.privileges is not None:
+ oprot.writeFieldBegin('privileges', TType.STRUCT, 2)
+ self.privileges.write(oprot)
+ oprot.writeFieldEnd()
+ if self.revokeGrantOption is not None:
+ oprot.writeFieldBegin('revokeGrantOption', TType.BOOL, 3)
+ oprot.writeBool(self.revokeGrantOption)
+ oprot.writeFieldEnd()
+ oprot.writeFieldStop()
+ oprot.writeStructEnd()
+
+ def validate(self):
+ return
+
+
+ def __repr__(self):
+ L = ['%s=%r' % (key, value)
+ for key, value in self.__dict__.iteritems()]
+ return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+ def __eq__(self, other):
+ return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+ def __ne__(self, other):
+ return not (self == other)
+
+class GrantRevokePrivilegeResponse:
+ """
+ Attributes:
+ - success
+ """
+
+ thrift_spec = (
+ None, # 0
+ (1, TType.BOOL, 'success', None, None, ), # 1
+ )
+
+ def __init__(self, success=None,):
+ self.success = success
+
+ def read(self, iprot):
+ if iprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and isinstance(iprot.trans, TTransport.CReadableTransport) and self.thrift_spec is not None and fastbinary is not None:
+ fastbinary.decode_binary(self, iprot.trans, (self.__class__, self.thrift_spec))
+ return
+ iprot.readStructBegin()
+ while True:
+ (fname, ftype, fid) = iprot.readFieldBegin()
+ if ftype == TType.STOP:
+ break
+ if fid == 1:
+ if ftype == TType.BOOL:
+ self.success = iprot.readBool();
+ else:
+ iprot.skip(ftype)
+ else:
+ iprot.skip(ftype)
+ iprot.readFieldEnd()
+ iprot.readStructEnd()
+
+ def write(self, oprot):
+ if oprot.__class__ == TBinaryProtocol.TBinaryProtocolAccelerated and self.thrift_spec is not None and fastbinary is not None:
+ oprot.trans.write(fastbinary.encode_binary(self, (self.__class__, self.thrift_spec)))
+ return
+ oprot.writeStructBegin('GrantRevokePrivilegeResponse')
+ if self.success is not None:
+ oprot.writeFieldBegin('success', TType.BOOL, 1)
+ oprot.writeBool(self.success)
+ oprot.writeFieldEnd()
+ oprot.writeFieldStop()
+ oprot.writeStructEnd()
+
+ def validate(self):
+ return
+
+
+ def __repr__(self):
+ L = ['%s=%r' % (key, value)
+ for key, value in self.__dict__.iteritems()]
+ return '%s(%s)' % (self.__class__.__name__, ', '.join(L))
+
+ def __eq__(self, other):
+ return isinstance(other, self.__class__) and self.__dict__ == other.__dict__
+
+ def __ne__(self, other):
+ return not (self == other)
+
class Role:
"""
Attributes:
Modified: hive/trunk/metastore/src/gen/thrift/gen-rb/hive_metastore_types.rb
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/gen/thrift/gen-rb/hive_metastore_types.rb?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/gen/thrift/gen-rb/hive_metastore_types.rb (original)
+++ hive/trunk/metastore/src/gen/thrift/gen-rb/hive_metastore_types.rb Fri Jul 18 18:15:33 2014
@@ -268,6 +268,45 @@ class PrincipalPrivilegeSet
::Thrift::Struct.generate_accessors self
end
+class GrantRevokePrivilegeRequest
+ include ::Thrift::Struct, ::Thrift::Struct_Union
+ REQUESTTYPE = 1
+ PRIVILEGES = 2
+ REVOKEGRANTOPTION = 3
+
+ FIELDS = {
+ REQUESTTYPE => {:type => ::Thrift::Types::I32, :name => 'requestType', :enum_class => ::GrantRevokeType},
+ PRIVILEGES => {:type => ::Thrift::Types::STRUCT, :name => 'privileges', :class => ::PrivilegeBag},
+ REVOKEGRANTOPTION => {:type => ::Thrift::Types::BOOL, :name => 'revokeGrantOption', :optional => true}
+ }
+
+ def struct_fields; FIELDS; end
+
+ def validate
+ unless @requestType.nil? || ::GrantRevokeType::VALID_VALUES.include?(@requestType)
+ raise ::Thrift::ProtocolException.new(::Thrift::ProtocolException::UNKNOWN, 'Invalid value of field requestType!')
+ end
+ end
+
+ ::Thrift::Struct.generate_accessors self
+end
+
+class GrantRevokePrivilegeResponse
+ include ::Thrift::Struct, ::Thrift::Struct_Union
+ SUCCESS = 1
+
+ FIELDS = {
+ SUCCESS => {:type => ::Thrift::Types::BOOL, :name => 'success', :optional => true}
+ }
+
+ def struct_fields; FIELDS; end
+
+ def validate
+ end
+
+ ::Thrift::Struct.generate_accessors self
+end
+
class Role
include ::Thrift::Struct, ::Thrift::Struct_Union
ROLENAME = 1
Modified: hive/trunk/metastore/src/gen/thrift/gen-rb/thrift_hive_metastore.rb
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/gen/thrift/gen-rb/thrift_hive_metastore.rb?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/gen/thrift/gen-rb/thrift_hive_metastore.rb (original)
+++ hive/trunk/metastore/src/gen/thrift/gen-rb/thrift_hive_metastore.rb Fri Jul 18 18:15:33 2014
@@ -1560,6 +1560,22 @@ module ThriftHiveMetastore
raise ::Thrift::ApplicationException.new(::Thrift::ApplicationException::MISSING_RESULT, 'revoke_privileges failed: unknown result')
end
+ def grant_revoke_privileges(request)
+ send_grant_revoke_privileges(request)
+ return recv_grant_revoke_privileges()
+ end
+
+ def send_grant_revoke_privileges(request)
+ send_message('grant_revoke_privileges', Grant_revoke_privileges_args, :request => request)
+ end
+
+ def recv_grant_revoke_privileges()
+ result = receive_message(Grant_revoke_privileges_result)
+ return result.success unless result.success.nil?
+ raise result.o1 unless result.o1.nil?
+ raise ::Thrift::ApplicationException.new(::Thrift::ApplicationException::MISSING_RESULT, 'grant_revoke_privileges failed: unknown result')
+ end
+
def set_ugi(user_name, group_names)
send_set_ugi(user_name, group_names)
return recv_set_ugi()
@@ -3052,6 +3068,17 @@ module ThriftHiveMetastore
write_result(result, oprot, 'revoke_privileges', seqid)
end
+ def process_grant_revoke_privileges(seqid, iprot, oprot)
+ args = read_args(iprot, Grant_revoke_privileges_args)
+ result = Grant_revoke_privileges_result.new()
+ begin
+ result.success = @handler.grant_revoke_privileges(args.request)
+ rescue ::MetaException => o1
+ result.o1 = o1
+ end
+ write_result(result, oprot, 'grant_revoke_privileges', seqid)
+ end
+
def process_set_ugi(seqid, iprot, oprot)
args = read_args(iprot, Set_ugi_args)
result = Set_ugi_result.new()
@@ -6806,6 +6833,40 @@ module ThriftHiveMetastore
::Thrift::Struct.generate_accessors self
end
+ class Grant_revoke_privileges_args
+ include ::Thrift::Struct, ::Thrift::Struct_Union
+ REQUEST = 1
+
+ FIELDS = {
+ REQUEST => {:type => ::Thrift::Types::STRUCT, :name => 'request', :class => ::GrantRevokePrivilegeRequest}
+ }
+
+ def struct_fields; FIELDS; end
+
+ def validate
+ end
+
+ ::Thrift::Struct.generate_accessors self
+ end
+
+ class Grant_revoke_privileges_result
+ include ::Thrift::Struct, ::Thrift::Struct_Union
+ SUCCESS = 0
+ O1 = 1
+
+ FIELDS = {
+ SUCCESS => {:type => ::Thrift::Types::STRUCT, :name => 'success', :class => ::GrantRevokePrivilegeResponse},
+ O1 => {:type => ::Thrift::Types::STRUCT, :name => 'o1', :class => ::MetaException}
+ }
+
+ def struct_fields; FIELDS; end
+
+ def validate
+ end
+
+ ::Thrift::Struct.generate_accessors self
+ end
+
class Set_ugi_args
include ::Thrift::Struct, ::Thrift::Struct_Union
USER_NAME = 1
Modified: hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java (original)
+++ hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStore.java Fri Jul 18 18:15:33 2014
@@ -85,6 +85,8 @@ import org.apache.hadoop.hive.metastore.
import org.apache.hadoop.hive.metastore.api.GetPrincipalsInRoleResponse;
import org.apache.hadoop.hive.metastore.api.GetRoleGrantsForPrincipalRequest;
import org.apache.hadoop.hive.metastore.api.GetRoleGrantsForPrincipalResponse;
+import org.apache.hadoop.hive.metastore.api.GrantRevokePrivilegeRequest;
+import org.apache.hadoop.hive.metastore.api.GrantRevokePrivilegeResponse;
import org.apache.hadoop.hive.metastore.api.GrantRevokeRoleRequest;
import org.apache.hadoop.hive.metastore.api.GrantRevokeRoleResponse;
import org.apache.hadoop.hive.metastore.api.GrantRevokeType;
@@ -4128,13 +4130,44 @@ public class HiveMetaStore extends Thrif
}
@Override
+ public GrantRevokePrivilegeResponse grant_revoke_privileges(GrantRevokePrivilegeRequest request)
+ throws MetaException, org.apache.thrift.TException {
+ GrantRevokePrivilegeResponse response = new GrantRevokePrivilegeResponse();
+ switch (request.getRequestType()) {
+ case GRANT: {
+ boolean result = grant_privileges(request.getPrivileges());
+ response.setSuccess(result);
+ break;
+ }
+ case REVOKE: {
+ boolean revokeGrantOption = false;
+ if (request.isSetRevokeGrantOption()) {
+ revokeGrantOption = request.isRevokeGrantOption();
+ }
+ boolean result = revoke_privileges(request.getPrivileges(), revokeGrantOption);
+ response.setSuccess(result);
+ break;
+ }
+ default:
+ throw new MetaException("Unknown request type " + request.getRequestType());
+ }
+
+ return response;
+ }
+
+ @Override
public boolean revoke_privileges(final PrivilegeBag privileges)
throws MetaException, TException {
+ return revoke_privileges(privileges, false);
+ }
+
+ public boolean revoke_privileges(final PrivilegeBag privileges, boolean grantOption)
+ throws MetaException, TException {
incrementCounter("revoke_privileges");
firePreEvent(new PreAuthorizationCallEvent(this));
Boolean ret = null;
try {
- ret = getMS().revokePrivileges(privileges);
+ ret = getMS().revokePrivileges(privileges, grantOption);
} catch (MetaException e) {
throw e;
} catch (Exception e) {
Modified: hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java (original)
+++ hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/HiveMetaStoreClient.java Fri Jul 18 18:15:33 2014
@@ -70,6 +70,8 @@ import org.apache.hadoop.hive.metastore.
import org.apache.hadoop.hive.metastore.api.GetPrincipalsInRoleResponse;
import org.apache.hadoop.hive.metastore.api.GetRoleGrantsForPrincipalRequest;
import org.apache.hadoop.hive.metastore.api.GetRoleGrantsForPrincipalResponse;
+import org.apache.hadoop.hive.metastore.api.GrantRevokePrivilegeRequest;
+import org.apache.hadoop.hive.metastore.api.GrantRevokePrivilegeResponse;
import org.apache.hadoop.hive.metastore.api.GrantRevokeRoleRequest;
import org.apache.hadoop.hive.metastore.api.GrantRevokeRoleResponse;
import org.apache.hadoop.hive.metastore.api.GrantRevokeType;
@@ -1494,7 +1496,14 @@ public class HiveMetaStoreClient impleme
@Override
public boolean grant_privileges(PrivilegeBag privileges)
throws MetaException, TException {
- return client.grant_privileges(privileges);
+ GrantRevokePrivilegeRequest req = new GrantRevokePrivilegeRequest();
+ req.setRequestType(GrantRevokeType.GRANT);
+ req.setPrivileges(privileges);
+ GrantRevokePrivilegeResponse res = client.grant_revoke_privileges(req);
+ if (!res.isSetSuccess()) {
+ throw new MetaException("GrantRevokePrivilegeResponse missing success field");
+ }
+ return res.isSuccess();
}
@Override
@@ -1514,9 +1523,17 @@ public class HiveMetaStoreClient impleme
}
@Override
- public boolean revoke_privileges(PrivilegeBag privileges) throws MetaException,
+ public boolean revoke_privileges(PrivilegeBag privileges, boolean grantOption) throws MetaException,
TException {
- return client.revoke_privileges(privileges);
+ GrantRevokePrivilegeRequest req = new GrantRevokePrivilegeRequest();
+ req.setRequestType(GrantRevokeType.REVOKE);
+ req.setPrivileges(privileges);
+ req.setRevokeGrantOption(grantOption);
+ GrantRevokePrivilegeResponse res = client.grant_revoke_privileges(req);
+ if (!res.isSetSuccess()) {
+ throw new MetaException("GrantRevokePrivilegeResponse missing success field");
+ }
+ return res.isSuccess();
}
@Override
Modified: hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/IMetaStoreClient.java
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/IMetaStoreClient.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/IMetaStoreClient.java (original)
+++ hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/IMetaStoreClient.java Fri Jul 18 18:15:33 2014
@@ -52,6 +52,8 @@ import org.apache.hadoop.hive.metastore.
import org.apache.hadoop.hive.metastore.api.GetPrincipalsInRoleResponse;
import org.apache.hadoop.hive.metastore.api.GetRoleGrantsForPrincipalRequest;
import org.apache.hadoop.hive.metastore.api.GetRoleGrantsForPrincipalResponse;
+import org.apache.hadoop.hive.metastore.api.GrantRevokePrivilegeRequest;
+import org.apache.hadoop.hive.metastore.api.GrantRevokePrivilegeResponse;
import org.apache.hadoop.hive.metastore.api.HiveObjectPrivilege;
import org.apache.hadoop.hive.metastore.api.HiveObjectRef;
import org.apache.hadoop.hive.metastore.api.Index;
@@ -1010,7 +1012,7 @@ public interface IMetaStoreClient {
* @throws MetaException
* @throws TException
*/
- public boolean revoke_privileges(PrivilegeBag privileges)
+ public boolean revoke_privileges(PrivilegeBag privileges, boolean grantOption)
throws MetaException, TException;
/**
Modified: hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/ObjectStore.java
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/ObjectStore.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/ObjectStore.java (original)
+++ hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/ObjectStore.java Fri Jul 18 18:15:33 2014
@@ -3916,7 +3916,7 @@ public class ObjectStore implements RawS
}
@Override
- public boolean revokePrivileges(PrivilegeBag privileges)
+ public boolean revokePrivileges(PrivilegeBag privileges, boolean grantOption)
throws InvalidObjectException, MetaException, NoSuchObjectException {
boolean committed = false;
try {
@@ -3950,6 +3950,14 @@ public class ObjectStore implements RawS
String userGrantPrivs = userGrant.getPrivilege();
if (privilege.equals(userGrantPrivs)) {
found = true;
+ if (grantOption) {
+ if (userGrant.getGrantOption()) {
+ userGrant.setGrantOption(false);
+ } else {
+ throw new MetaException("User " + userName
+ + " does not have grant option with privilege " + privilege);
+ }
+ }
persistentObjs.add(userGrant);
break;
}
@@ -3973,6 +3981,14 @@ public class ObjectStore implements RawS
String dbGrantPriv = dbGrant.getPrivilege();
if (privilege.equals(dbGrantPriv)) {
found = true;
+ if (grantOption) {
+ if (dbGrant.getGrantOption()) {
+ dbGrant.setGrantOption(false);
+ } else {
+ throw new MetaException("User " + userName
+ + " does not have grant option with privilege " + privilege);
+ }
+ }
persistentObjs.add(dbGrant);
break;
}
@@ -3994,6 +4010,14 @@ public class ObjectStore implements RawS
String tableGrantPriv = tabGrant.getPrivilege();
if (privilege.equalsIgnoreCase(tableGrantPriv)) {
found = true;
+ if (grantOption) {
+ if (tabGrant.getGrantOption()) {
+ tabGrant.setGrantOption(false);
+ } else {
+ throw new MetaException("User " + userName
+ + " does not have grant option with privilege " + privilege);
+ }
+ }
persistentObjs.add(tabGrant);
break;
}
@@ -4020,6 +4044,14 @@ public class ObjectStore implements RawS
String partPriv = partGrant.getPrivilege();
if (partPriv.equalsIgnoreCase(privilege)) {
found = true;
+ if (grantOption) {
+ if (partGrant.getGrantOption()) {
+ partGrant.setGrantOption(false);
+ } else {
+ throw new MetaException("User " + userName
+ + " does not have grant option with privilege " + privilege);
+ }
+ }
persistentObjs.add(partGrant);
break;
}
@@ -4051,6 +4083,14 @@ public class ObjectStore implements RawS
String colPriv = col.getPrivilege();
if (colPriv.equalsIgnoreCase(privilege)) {
found = true;
+ if (grantOption) {
+ if (col.getGrantOption()) {
+ col.setGrantOption(false);
+ } else {
+ throw new MetaException("User " + userName
+ + " does not have grant option with privilege " + privilege);
+ }
+ }
persistentObjs.add(col);
break;
}
@@ -4075,6 +4115,14 @@ public class ObjectStore implements RawS
String colPriv = col.getPrivilege();
if (colPriv.equalsIgnoreCase(privilege)) {
found = true;
+ if (grantOption) {
+ if (col.getGrantOption()) {
+ col.setGrantOption(false);
+ } else {
+ throw new MetaException("User " + userName
+ + " does not have grant option with privilege " + privilege);
+ }
+ }
persistentObjs.add(col);
break;
}
@@ -4095,7 +4143,12 @@ public class ObjectStore implements RawS
}
if (persistentObjs.size() > 0) {
- pm.deletePersistentAll(persistentObjs);
+ if (grantOption) {
+ // If grant option specified, only update the privilege, don't remove it.
+ // Grant option has already been removed from the privileges in the section above
+ } else {
+ pm.deletePersistentAll(persistentObjs);
+ }
}
committed = commitTransaction();
} finally {
Modified: hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/RawStore.java
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/RawStore.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/RawStore.java (original)
+++ hive/trunk/metastore/src/java/org/apache/hadoop/hive/metastore/RawStore.java Fri Jul 18 18:15:33 2014
@@ -273,7 +273,7 @@ public interface RawStore extends Config
public abstract boolean grantPrivileges (PrivilegeBag privileges)
throws InvalidObjectException, MetaException, NoSuchObjectException;
- public abstract boolean revokePrivileges (PrivilegeBag privileges)
+ public abstract boolean revokePrivileges (PrivilegeBag privileges, boolean grantOption)
throws InvalidObjectException, MetaException, NoSuchObjectException;
public abstract org.apache.hadoop.hive.metastore.api.Role getRole(
Modified: hive/trunk/metastore/src/test/org/apache/hadoop/hive/metastore/DummyRawStoreControlledCommit.java
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/test/org/apache/hadoop/hive/metastore/DummyRawStoreControlledCommit.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/test/org/apache/hadoop/hive/metastore/DummyRawStoreControlledCommit.java (original)
+++ hive/trunk/metastore/src/test/org/apache/hadoop/hive/metastore/DummyRawStoreControlledCommit.java Fri Jul 18 18:15:33 2014
@@ -437,9 +437,9 @@ public class DummyRawStoreControlledComm
}
@Override
- public boolean revokePrivileges(PrivilegeBag privileges) throws InvalidObjectException,
- MetaException, NoSuchObjectException {
- return objectStore.revokePrivileges(privileges);
+ public boolean revokePrivileges(PrivilegeBag privileges, boolean grantOption)
+ throws InvalidObjectException, MetaException, NoSuchObjectException {
+ return objectStore.revokePrivileges(privileges, grantOption);
}
@Override
Modified: hive/trunk/metastore/src/test/org/apache/hadoop/hive/metastore/DummyRawStoreForJdoConnection.java
URL: http://svn.apache.org/viewvc/hive/trunk/metastore/src/test/org/apache/hadoop/hive/metastore/DummyRawStoreForJdoConnection.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/metastore/src/test/org/apache/hadoop/hive/metastore/DummyRawStoreForJdoConnection.java (original)
+++ hive/trunk/metastore/src/test/org/apache/hadoop/hive/metastore/DummyRawStoreForJdoConnection.java Fri Jul 18 18:15:33 2014
@@ -462,8 +462,8 @@ public class DummyRawStoreForJdoConnecti
}
@Override
- public boolean revokePrivileges(PrivilegeBag privileges) throws InvalidObjectException,
- MetaException, NoSuchObjectException {
+ public boolean revokePrivileges(PrivilegeBag privileges, boolean grantOption)
+ throws InvalidObjectException, MetaException, NoSuchObjectException {
return false;
}
Modified: hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/DDLTask.java
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/DDLTask.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/DDLTask.java (original)
+++ hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/exec/DDLTask.java Fri Jul 18 18:15:33 2014
@@ -452,7 +452,8 @@ public class DDLTask extends Task<DDLWor
RevokeDesc revokeDesc = work.getRevokeDesc();
if (revokeDesc != null) {
return grantOrRevokePrivileges(revokeDesc.getPrincipals(), revokeDesc
- .getPrivileges(), revokeDesc.getPrivilegeSubjectDesc(), null, null, false, false);
+ .getPrivileges(), revokeDesc.getPrivilegeSubjectDesc(), null, null,
+ revokeDesc.isGrantOption(), false);
}
ShowGrantDesc showGrantDesc = work.getShowGrantDesc();
@@ -882,8 +883,9 @@ public class DDLTask extends Task<DDLWor
if (isGrant) {
db.grantPrivileges(privBag);
} else {
- db.revokePrivileges(privBag);
+ db.revokePrivileges(privBag, grantOption);
}
+
}
} catch (Exception e) {
console.printError("Error: " + e.getMessage());
Modified: hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/metadata/Hive.java
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/metadata/Hive.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/metadata/Hive.java (original)
+++ hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/metadata/Hive.java Fri Jul 18 18:15:33 2014
@@ -1136,10 +1136,10 @@ public class Hive {
* @return true on success
* @throws HiveException
*/
- public boolean revokePrivileges(PrivilegeBag privileges)
+ public boolean revokePrivileges(PrivilegeBag privileges, boolean grantOption)
throws HiveException {
try {
- return getMSC().revoke_privileges(privileges);
+ return getMSC().revoke_privileges(privileges, grantOption);
} catch (Exception e) {
throw new HiveException(e);
}
Modified: hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/parse/HiveParser.g
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/parse/HiveParser.g?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/parse/HiveParser.g (original)
+++ hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/parse/HiveParser.g Fri Jul 18 18:15:33 2014
@@ -264,6 +264,7 @@ TOK_RESOURCE_ALL;
TOK_GRANT_WITH_OPTION;
TOK_GRANT_WITH_ADMIN_OPTION;
TOK_ADMIN_OPTION_FOR;
+TOK_GRANT_OPTION_FOR;
TOK_PRIV_ALL;
TOK_PRIV_ALTER_METADATA;
TOK_PRIV_ALTER_DATA;
@@ -1388,8 +1389,8 @@ grantPrivileges
revokePrivileges
@init {pushMsg("revoke privileges", state);}
@afer {popMsg(state);}
- : KW_REVOKE privilegeList privilegeObject? KW_FROM principalSpecification
- -> ^(TOK_REVOKE privilegeList principalSpecification privilegeObject?)
+ : KW_REVOKE grantOptionFor? privilegeList privilegeObject? KW_FROM principalSpecification
+ -> ^(TOK_REVOKE privilegeList principalSpecification privilegeObject? grantOptionFor?)
;
grantRole
@@ -1526,6 +1527,13 @@ withGrantOption
-> ^(TOK_GRANT_WITH_OPTION)
;
+grantOptionFor
+@init {pushMsg("grant option for", state);}
+@after {popMsg(state);}
+ : KW_GRANT KW_OPTION KW_FOR
+ -> ^(TOK_GRANT_OPTION_FOR)
+;
+
adminOptionFor
@init {pushMsg("admin option for", state);}
@after {popMsg(state);}
Modified: hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/parse/authorization/HiveAuthorizationTaskFactoryImpl.java
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/parse/authorization/HiveAuthorizationTaskFactoryImpl.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/parse/authorization/HiveAuthorizationTaskFactoryImpl.java (original)
+++ hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/parse/authorization/HiveAuthorizationTaskFactoryImpl.java Fri Jul 18 18:15:33 2014
@@ -138,11 +138,16 @@ public class HiveAuthorizationTaskFactor
List<PrivilegeDesc> privilegeDesc = analyzePrivilegeListDef((ASTNode) ast.getChild(0));
List<PrincipalDesc> principalDesc = AuthorizationParseUtils.analyzePrincipalListDef((ASTNode) ast.getChild(1));
PrivilegeObjectDesc hiveObj = null;
+ boolean grantOption = false;
if (ast.getChildCount() > 2) {
ASTNode astChild = (ASTNode) ast.getChild(2);
hiveObj = analyzePrivilegeObject(astChild, outputs);
+
+ if (null != ast.getFirstChildWithType(HiveParser.TOK_GRANT_OPTION_FOR)) {
+ grantOption = true;
+ }
}
- RevokeDesc revokeDesc = new RevokeDesc(privilegeDesc, principalDesc, hiveObj);
+ RevokeDesc revokeDesc = new RevokeDesc(privilegeDesc, principalDesc, hiveObj, grantOption);
return TaskFactory.get(new DDLWork(inputs, outputs, revokeDesc), conf);
}
@Override
Modified: hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/plan/RevokeDesc.java
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/plan/RevokeDesc.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/plan/RevokeDesc.java (original)
+++ hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/plan/RevokeDesc.java Fri Jul 18 18:15:33 2014
@@ -31,16 +31,24 @@ public class RevokeDesc extends DDLDesc
private List<PrincipalDesc> principals;
private PrivilegeObjectDesc privilegeSubjectDesc;
-
+
+ private boolean grantOption;
+
public RevokeDesc(){
}
public RevokeDesc(List<PrivilegeDesc> privileges,
List<PrincipalDesc> principals, PrivilegeObjectDesc privilegeSubjectDesc) {
+ this(privileges, principals, privilegeSubjectDesc, false);
+ }
+
+ public RevokeDesc(List<PrivilegeDesc> privileges,
+ List<PrincipalDesc> principals, PrivilegeObjectDesc privilegeSubjectDesc, boolean grantOption) {
super();
this.privileges = privileges;
this.principals = principals;
this.privilegeSubjectDesc = privilegeSubjectDesc;
+ this.grantOption = grantOption;
}
public List<PrivilegeDesc> getPrivileges() {
@@ -66,5 +74,13 @@ public class RevokeDesc extends DDLDesc
public void setPrivilegeSubjectDesc(PrivilegeObjectDesc privilegeSubjectDesc) {
this.privilegeSubjectDesc = privilegeSubjectDesc;
}
+
+ public boolean isGrantOption() {
+ return grantOption;
+ }
+
+ public void setGrantOption(boolean grantOption) {
+ this.grantOption = grantOption;
+ }
}
Modified: hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAccessController.java
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAccessController.java?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAccessController.java (original)
+++ hive/trunk/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAccessController.java Fri Jul 18 18:15:33 2014
@@ -236,7 +236,7 @@ public class SQLStdHiveAccessController
// So this will revoke privileges that are granted by other users.This is
// not SQL compliant behavior. Need to change/add a metastore api
// that has desired behavior.
- metastoreClient.revoke_privileges(new PrivilegeBag(revokePrivs));
+ metastoreClient.revoke_privileges(new PrivilegeBag(revokePrivs), grantOption);
} catch (Exception e) {
throw new HiveAuthzPluginException("Error revoking privileges", e);
}
Added: hive/trunk/ql/src/test/queries/clientnegative/authorization_fail_8.q
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/test/queries/clientnegative/authorization_fail_8.q?rev=1611743&view=auto
==============================================================================
--- hive/trunk/ql/src/test/queries/clientnegative/authorization_fail_8.q (added)
+++ hive/trunk/ql/src/test/queries/clientnegative/authorization_fail_8.q Fri Jul 18 18:15:33 2014
@@ -0,0 +1,21 @@
+set hive.security.authorization.manager=org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.SQLStdHiveAuthorizerFactoryForTest;
+set hive.security.authenticator.manager=org.apache.hadoop.hive.ql.security.SessionStateConfigUserAuthenticator;
+
+set user.name=user1;
+create table authorization_fail (key int, value string) partitioned by (ds string);
+GRANT SELECT ON authorization_fail TO USER user2 WITH GRANT OPTION;
+
+set user.name=user2;
+SHOW GRANT USER user2 ON TABLE authorization_fail;
+-- user2 current has grant option, this should work
+GRANT SELECT ON authorization_fail TO USER user3;
+REVOKE SELECT ON authorization_fail FROM USER user3;
+
+set user.name=user1;
+REVOKE GRANT OPTION FOR SELECT ON authorization_fail FROM USER user2;
+
+set user.name=user2;
+SHOW GRANT USER user2 ON TABLE authorization_fail;
+-- Now that grant option has been revoked, granting to other users should fail
+GRANT SELECT ON authorization_fail TO USER user3;
+
Modified: hive/trunk/ql/src/test/queries/clientpositive/authorization_revoke_table_priv.q
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/test/queries/clientpositive/authorization_revoke_table_priv.q?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/ql/src/test/queries/clientpositive/authorization_revoke_table_priv.q (original)
+++ hive/trunk/ql/src/test/queries/clientpositive/authorization_revoke_table_priv.q Fri Jul 18 18:15:33 2014
@@ -74,6 +74,13 @@ set user.name=user2;
SHOW GRANT USER user2 ON TABLE table_priv_rev;
set user.name=user1;
+-- revoke grant option for select privilege from user2
+REVOKE GRANT OPTION FOR SELECT ON TABLE table_priv_rev FROM USER user2;
+
+set user.name=user2;
+SHOW GRANT USER user2 ON TABLE table_priv_rev;
+set user.name=user1;
+
-- revoke select privilege from user2
REVOKE SELECT ON TABLE table_priv_rev FROM USER user2;
Added: hive/trunk/ql/src/test/results/clientnegative/authorization_fail_8.q.out
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/test/results/clientnegative/authorization_fail_8.q.out?rev=1611743&view=auto
==============================================================================
--- hive/trunk/ql/src/test/results/clientnegative/authorization_fail_8.q.out (added)
+++ hive/trunk/ql/src/test/results/clientnegative/authorization_fail_8.q.out Fri Jul 18 18:15:33 2014
@@ -0,0 +1,48 @@
+PREHOOK: query: create table authorization_fail (key int, value string) partitioned by (ds string)
+PREHOOK: type: CREATETABLE
+PREHOOK: Output: database:default
+POSTHOOK: query: create table authorization_fail (key int, value string) partitioned by (ds string)
+POSTHOOK: type: CREATETABLE
+POSTHOOK: Output: database:default
+POSTHOOK: Output: default@authorization_fail
+PREHOOK: query: GRANT SELECT ON authorization_fail TO USER user2 WITH GRANT OPTION
+PREHOOK: type: GRANT_PRIVILEGE
+PREHOOK: Output: default@authorization_fail
+POSTHOOK: query: GRANT SELECT ON authorization_fail TO USER user2 WITH GRANT OPTION
+POSTHOOK: type: GRANT_PRIVILEGE
+POSTHOOK: Output: default@authorization_fail
+PREHOOK: query: SHOW GRANT USER user2 ON TABLE authorization_fail
+PREHOOK: type: SHOW_GRANT
+POSTHOOK: query: SHOW GRANT USER user2 ON TABLE authorization_fail
+POSTHOOK: type: SHOW_GRANT
+default authorization_fail user2 USER SELECT true -1 user1
+PREHOOK: query: -- user2 current has grant option, this should work
+GRANT SELECT ON authorization_fail TO USER user3
+PREHOOK: type: GRANT_PRIVILEGE
+PREHOOK: Output: default@authorization_fail
+POSTHOOK: query: -- user2 current has grant option, this should work
+GRANT SELECT ON authorization_fail TO USER user3
+POSTHOOK: type: GRANT_PRIVILEGE
+POSTHOOK: Output: default@authorization_fail
+PREHOOK: query: REVOKE SELECT ON authorization_fail FROM USER user3
+PREHOOK: type: REVOKE_PRIVILEGE
+PREHOOK: Output: default@authorization_fail
+POSTHOOK: query: REVOKE SELECT ON authorization_fail FROM USER user3
+POSTHOOK: type: REVOKE_PRIVILEGE
+POSTHOOK: Output: default@authorization_fail
+PREHOOK: query: REVOKE GRANT OPTION FOR SELECT ON authorization_fail FROM USER user2
+PREHOOK: type: REVOKE_PRIVILEGE
+PREHOOK: Output: default@authorization_fail
+POSTHOOK: query: REVOKE GRANT OPTION FOR SELECT ON authorization_fail FROM USER user2
+POSTHOOK: type: REVOKE_PRIVILEGE
+POSTHOOK: Output: default@authorization_fail
+PREHOOK: query: SHOW GRANT USER user2 ON TABLE authorization_fail
+PREHOOK: type: SHOW_GRANT
+POSTHOOK: query: SHOW GRANT USER user2 ON TABLE authorization_fail
+POSTHOOK: type: SHOW_GRANT
+default authorization_fail user2 USER SELECT false -1 user1
+PREHOOK: query: -- Now that grant option has been revoked, granting to other users should fail
+GRANT SELECT ON authorization_fail TO USER user3
+PREHOOK: type: GRANT_PRIVILEGE
+PREHOOK: Output: default@authorization_fail
+FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.DDLTask. Permission denied. Principal [name=user2, type=USER] does not have following privileges on Object [type=TABLE_OR_VIEW, name=default.authorization_fail] : [SELECT with grant]
Modified: hive/trunk/ql/src/test/results/clientpositive/authorization_revoke_table_priv.q.out
URL: http://svn.apache.org/viewvc/hive/trunk/ql/src/test/results/clientpositive/authorization_revoke_table_priv.q.out?rev=1611743&r1=1611742&r2=1611743&view=diff
==============================================================================
--- hive/trunk/ql/src/test/results/clientpositive/authorization_revoke_table_priv.q.out (original)
+++ hive/trunk/ql/src/test/results/clientpositive/authorization_revoke_table_priv.q.out Fri Jul 18 18:15:33 2014
@@ -155,6 +155,19 @@ PREHOOK: type: SHOW_GRANT
POSTHOOK: query: SHOW GRANT USER user2 ON TABLE table_priv_rev
POSTHOOK: type: SHOW_GRANT
default table_priv_rev user2 USER SELECT true -1 user1
+PREHOOK: query: -- revoke grant option for select privilege from user2
+REVOKE GRANT OPTION FOR SELECT ON TABLE table_priv_rev FROM USER user2
+PREHOOK: type: REVOKE_PRIVILEGE
+PREHOOK: Output: default@table_priv_rev
+POSTHOOK: query: -- revoke grant option for select privilege from user2
+REVOKE GRANT OPTION FOR SELECT ON TABLE table_priv_rev FROM USER user2
+POSTHOOK: type: REVOKE_PRIVILEGE
+POSTHOOK: Output: default@table_priv_rev
+PREHOOK: query: SHOW GRANT USER user2 ON TABLE table_priv_rev
+PREHOOK: type: SHOW_GRANT
+POSTHOOK: query: SHOW GRANT USER user2 ON TABLE table_priv_rev
+POSTHOOK: type: SHOW_GRANT
+default table_priv_rev user2 USER SELECT false -1 user1
PREHOOK: query: -- revoke select privilege from user2
REVOKE SELECT ON TABLE table_priv_rev FROM USER user2
PREHOOK: type: REVOKE_PRIVILEGE