[jira] [Commented] (TRAFODION-2175) a user should only see specific schemas/tables that he has privileges to

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TRAFODION-2175?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16434056#comment-16434056 ] 

ASF GitHub Bot commented on TRAFODION-2175:
-------------------------------------------

Github user robertamarton commented on a diff in the pull request:

    https://github.com/apache/trafodion/pull/1512#discussion_r180791492
  
    --- Diff: core/sql/executor/ExExeUtilGet.cpp ---
    @@ -1642,6 +1672,119 @@ NABoolean ExExeUtilGetMetadataInfoTcb::checkUserPrivs(
       return TRUE;
     }
     
    +// ----------------------------------------------------------------------------
    +// method:  colPrivsFrag
    +//
    +// This method was added to address a performance issue.  When determining if 
    +// the user has column level privileges, we need to get the column name from 
    +// Hive.  The call to get the column name (hivemd) is very expensive.  So this
    +// method checks to see if the requested user has been granted any column
    +// level privileges on a hive table.  If so, we will go ahead and do the
    +// mapping (call hivemd).  If not, then we will not include the hivemd 
    +// fragment for the query.
    +//
    +// Since we are scanning the column privileges table anyway, we also see if 
    +// the requested user (or their roles) has been granted any privileges.  If so,
    +// we include the column privileges check in the query. 
    +//
    +// For Sentry enabled installations, we won't store Hive privileges in 
    +// EsgynDB metadata.  By avoiding the hivemd calls, we save a lot of time
    +// in processing the request.
    +//
    +//  returns additional union(s) for the getPrivForAuth query
    +//  returns:
    +//     0 - successful
    +//    -1 - unexpected error occurred
    +// ----------------------------------------------------------------------------
    +Int32 ExExeUtilGetMetadataInfoTcb::colPrivsFrag(
    +  const char *authName,
    +  const char * cat,
    +  const NAString &privWhereClause,
    +  NAString &colPrivsStmt)
    +{
    +  // if no authorization, skip
    +  if (!CmpCommon::context()->isAuthorizationEnabled())
    +    return 0;
    +
    +  short rc      = 0;
    +  Lng32 cliRC   = 0;
    +
    +  // See if privileges granted on Hive object or to the user/user's roles
    +  NAString likeClause("like 'HIVE.%'");
    +  sprintf(queryBuf_, "select "
    +                     "sum(case when (object_name %s and grantee_id %s) then 1 else 0 end), "
    +                     "sum(case when grantee_id %s then 1 else 0 end) "
    +                     "from %s.\"%s\".%s",
    +          likeClause.data(), privWhereClause.data(), privWhereClause.data(),
    +          cat, SEABASE_PRIVMGR_SCHEMA,
    +          PRIVMGR_COLUMN_PRIVILEGES);
    +
    +  if (initializeInfoList(infoList_)) return -1;
    +
    +  numOutputEntries_ = 2;
    +  cliRC = fetchAllRows(infoList_, queryBuf_, numOutputEntries_, FALSE, rc);
    +  if (cliRC < 0)
    +  {
    +    cliInterface()->retrieveSQLDiagnostics(getDiagsArea());
    +    return -1;
    +  }
    +
    +  bool hasHive = false;
    +  bool hasGrants = false;
    +  infoList_->position();
    +  OutputInfo * vi = (OutputInfo*)infoList_->getCurr();
    +  if (vi && vi->get(0))
    +  {
    +    if (*(Lng32*)vi->get(0) > 0)
    --- End diff --
    
    I will change these to int64 for a future delivery.


> a user should only see specific schemas/tables that he has privileges to
> ------------------------------------------------------------------------
>
>                 Key: TRAFODION-2175
>                 URL: https://issues.apache.org/jira/browse/TRAFODION-2175
>             Project: Apache Trafodion
>          Issue Type: Improvement
>          Components: sql-security
>         Environment: OS -- centos6.7 , centos7.1 , centos7.2
> R2.2 daily build
>            Reporter: Gao, Rui-Xian
>            Assignee: Roberta Marton
>            Priority: Major
>
> we have a requirement that a user should only see the objects that he has privileges to do operations on.
> Current feature is, ‘get schemas’ will return all schemas in the database, and in a private schema created by a user, another user can still see all tables with ‘get tables’, and also can check table’s structure with ‘showddl’.
>  
> If we have many customer data on cloud cluster, we don’t want a customer to view any other customers’ data, we want the customers to be isolated from each other.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)