[jira] [Work logged] (HIVE-25532) Fix authorization support for Kill Query Command

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/HIVE-25532?focusedWorklogId=651991&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-651991 ]

ASF GitHub Bot logged work on HIVE-25532:
-----------------------------------------

                Author: ASF GitHub Bot
            Created on: 16/Sep/21 20:46
            Start Date: 16/Sep/21 20:46
    Worklog Time Spent: 10m 
      Work Description: achennagiri opened a new pull request #2649:
URL: https://github.com/apache/hive/pull/2649


   ### What changes were proposed in this pull request?
   We added authorization support for Kill Query command a while back. Below is the ticket https://issues.apache.org/jira/browse/RANGER-1851
   
   However, we have observed that this hasn't been working as expected. The Ranger service expects Hive to send in a privilege object of the type SERVICE_NAME but we can see below
   https://github.com/apache/hive/blob/master/service/src/java/org/apache/hive/service/server/KillQueryImpl.java#L131 that it is sending an empty array list. 
   The Ranger service never throws an exception to this and this results in any user being able to kill any query even though they don't have necessary permissions.
   
   
   ### Why are the changes needed?
   Currently, any user can kill any other query using the query id. Basically, KILL QUERY is an ADMIN level command and a user is supposed to have the necessary permissions to execute it without which it should fail. 
   We need this fix to address that bug.
   
   ### Does this PR introduce _any_ user-facing change?
   No.
   
   
   ### How was this patch tested?
   This patch was used to create the hive-service jar. This dev jar was replaced on a cluster running Hive and Ranger services. The hiveserver logs were used to confirm that the checkPrivileges() call returns an exception on a user without sufficient permissions(Basically, any user without SERVICE_ADMIN permission is not allowed to execute Kill query).
   
   
   Also, the logs are audited in the Ranger and they are as expected.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


Issue Time Tracking
-------------------

            Worklog Id:     (was: 651991)
    Remaining Estimate: 0h
            Time Spent: 10m

> Fix authorization support for Kill Query Command
> ------------------------------------------------
>
>                 Key: HIVE-25532
>                 URL: https://issues.apache.org/jira/browse/HIVE-25532
>             Project: Hive
>          Issue Type: Bug
>          Components: HiveServer2
>            Reporter: Abhay
>            Assignee: Abhay
>            Priority: Major
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> We added authorization for Kill Query command some time back with the help of Ranger. Below is the ticket https://issues.apache.org/jira/browse/RANGER-1851
> However, we have observed that this hasn't been working as expected. The Ranger service expects Hive to send in a privilege object of the type SERVICE_NAME but we can see below
>  [https://github.com/apache/hive/blob/master/service/src/java/org/apache/hive/service/server/KillQueryImpl.java#L131] that it is sending an empty array list. 
>  The Ranger service never throws an exception to this and this results in any user being able to kill any query even though they don't have necessary permissions.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)