Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

INSERT only permission not working : "does not have privileges for QUERY" , _tmp_table issue ?!?!

avatar
Guru

Hi,

I am playing around with Sentry and want to provide "write-only" permission to a user via

 

grant insert ON default.shipment_test TO ROLE ingester;

But if I connect to hive via beeline and execute an insert statement, I receive the error:

 

 

0: jdbc:hive2://quickstart.cloudera:10000/def> insert into shipment_test values (1,'1111');
Error: Error while compiling statement: FAILED: SemanticException No valid privileges
 User writer does not have privileges for QUERY
 The required privileges: Server=server1->Db=default->Table=values__tmp__table__2->Column=tmp_values_col1->action=select; (state=42000,code=40000)

 

The environment is CDH sandbox 5.8

Linux user 'writer' is member of group 'ingester';

The group 'ingester' is assigned to the proper role in Sentry and was given the INSERT privilege:

grant role sentry_ingester to group ingester;
grant INSERT ON default.shipment_test TO ROLE sentry_ingester;

 

 

Why the statement errors out due to a "select" issue on a tmp table ?!?! 

Do I have to specify some more privileges, or how do you grant "INSERT"-only permissions to a group ?

 

Thanks in advance...

 

 

1 ACCEPTED SOLUTION

avatar
Super Collaborator

I have run some tests.

And indeed, the problem seems to be around the temporary table (at least, it is failing here before anything else).

 

The query you make with the "VALUES" part work like this :

- it create a temporary hive table with the line to be inserted

- it query that temporary table for inserting the data into the target table

 

From what I see, the temporary table is created. But the user do not have "select" permission on it.

Surprisingly sentry allow for the creation but not the select.

 

 

I guess that a workaround would be to grant "SELECT" on the database "default" but this could bring some issues for you (since the user will have read permission on all the tables inside "default").

 

Seems like a defect to me.

 

 

View solution in original post

11 REPLIES 11

avatar
Guru

Hi @mathieu.d ,

do you think this needs to be raised as an issue/bug , or is my case that unusual (I don't think so, honestly 😉 )?

avatar
Super Collaborator

I do think this is a defect. Not sure how Cloudera will see it.

 

But to be fair, this particular way of inserting data (with the VALUES syntax) into a table is pretty much limited to small testing.