INSERT only permission not working : "does not have privileges for QUERY" , _tmp_table issue ?!?!

[#1]

Hi,

I am playing around with Sentry and want to provide "write-only" permission to a user via

grant insert ON default.shipment_test TO ROLE ingester;

But if I connect to hive via beeline and execute an insert statement, I receive the error:

0: jdbc:hive2://quickstart.cloudera:10000/def> insert into shipment_test values (1,'1111');
Error: Error while compiling statement: FAILED: SemanticException No valid privileges
 User writer does not have privileges for QUERY
 The required privileges: Server=server1->Db=default->Table=values__tmp__table__2->Column=tmp_values_col1->action=select; (state=42000,code=40000)

The environment is CDH sandbox 5.8

Linux user 'writer' is member of group 'ingester';

The group 'ingester' is assigned to the proper role in Sentry and was given the INSERT privilege:

grant role sentry_ingester to group ingester;
grant INSERT ON default.shipment_test TO ROLE sentry_ingester;

Why the statement errors out due to a "select" issue on a tmp table ?!?! 

Do I have to specify some more privileges, or how do you grant "INSERT"-only permissions to a group ?

Thanks in advance...

[#2]

Hi @mathieu.d ,

do you think this needs to be raised as an issue/bug , or is my case that unusual (I don't think so, honestly 😉 )?

[#3]

I do think this is a defect. Not sure how Cloudera will see it.

But to be fair, this particular way of inserting data (with the VALUES syntax) into a table is pretty much limited to small testing.