Ranger Hive row level filter policy prevent INSERT, is it a bug?

[#1]

working on a demo for client and noticed an interesting behavior of row level filter. Not sure it is the desired behavior.

I have a row level filter on one of my table "rowfilter". Once I enable this policy, it will block INSERT to this table by hive user. hive user has all permission for all hive table/UDF, so this is quite unexpected.

error message read "HiveAccessControlException Permission denied: user [hive] does not have [UPDATE] privilege on [hr/rowfilter] (state=42000,code=40000)"

The only way I could insert to this table is by temporarily disable the row level filter. This really looks like a bug to me..

[#2]

can you show use the policy where you provide hive user update permission on table

[#3]

It is part of the default policy created by Ranger. hive user has all permission on everything

[#4 · Accepted solution]

Did some more test and an interesting finding. The row based policy was created to target public group and that seems to be causing the problem.

This will block the insert for hive user.

But once the public group is removed, the hive user could works fine.

An interesting question is: does the row level filter limit the users to only select permission?

[#5]

if row-level filter/column-masking is enabled on a table for a user, that user will not be allowed to perform any update operations (like insert, delete) on the table. This is to prevent such users from updating rows/columns that they don't have permissions for.

[#6]

@Madhan Neethiraj

That makes sense. Thanks for you answer

[#7]

Which version of Ranger are you using ?

Row level filter policy supports only 'select' permission

[#8]

I know row level filter only has select. But does it also remove the permission from other policy? Like hive users universal access from the base policy.

[#9]

I could re-create the same issue on hdp 2.5 sandbox. it looks to me a bug.

[#10]

Hi Qi Wang: To your question "I know row level filter only has select. But does it also remove the permission from other policy? Like hive users universal access from the base policy.”

--> In this case your user 'hive' has all permissions on all tables through the default access based policy. Also there is a row level policy for user 'hive’ on 'rowfilter' table. We have only ‘select’ privilege to choose in row level policy, what this means is that you are giving user ‘hive’ only ‘select' privilege on the table and that too with restrictions on what he can view on doing ‘select’.

Why this is done? If you as a user are not allowed to even see the full contents of a particular table, you cannot be allowed to perform operations on that table.

When Hive request comes in from a user, all row level policies are scanned for that user. If a row level policy found for the user, the access privileges are scanned on that resource by going through access policies. (An access policy needs to grant the user access to that resource, row filer policy does not grant access). Now since update is not granted by masking policy, the operation is denied. The request does not even reach access policy.

Hope this helps.