Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Ranger Hive row level filter policy prevent INSERT, is it a bug?

Solved Go to solution

Ranger Hive row level filter policy prevent INSERT, is it a bug?

Expert Contributor

working on a demo for client and noticed an interesting behavior of row level filter. Not sure it is the desired behavior.

I have a row level filter on one of my table "rowfilter". Once I enable this policy, it will block INSERT to this table by hive user. hive user has all permission for all hive table/UDF, so this is quite unexpected.

error message read "HiveAccessControlException Permission denied: user [hive] does not have [UPDATE] privilege on [hr/rowfilter] (state=42000,code=40000)"

10200-screen-shot-2016-12-09-at-10825-pm.png

10211-screen-shot-2016-12-09-at-10839-pm.png

The only way I could insert to this table is by temporarily disable the row level filter. This really looks like a bug to me..

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

Expert Contributor

Did some more test and an interesting finding. The row based policy was created to target public group and that seems to be causing the problem.

10213-screen-shot-2016-12-09-at-32351-pm.png

This will block the insert for hive user.

But once the public group is removed, the hive user could works fine.

10214-screen-shot-2016-12-09-at-32630-pm.png

An interesting question is: does the row level filter limit the users to only select permission?

9 REPLIES 9

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

Super Guru

can you show use the policy where you provide hive user update permission on table

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

Expert Contributor

It is part of the default policy created by Ranger. hive user has all permission on everything

10212-screen-shot-2016-12-09-at-31553-pm.png

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

Expert Contributor

Did some more test and an interesting finding. The row based policy was created to target public group and that seems to be causing the problem.

10213-screen-shot-2016-12-09-at-32351-pm.png

This will block the insert for hive user.

But once the public group is removed, the hive user could works fine.

10214-screen-shot-2016-12-09-at-32630-pm.png

An interesting question is: does the row level filter limit the users to only select permission?

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

Contributor

if row-level filter/column-masking is enabled on a table for a user, that user will not be allowed to perform any update operations (like insert, delete) on the table. This is to prevent such users from updating rows/columns that they don't have permissions for.

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

Expert Contributor

@Madhan Neethiraj

That makes sense. Thanks for you answer

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

New Contributor

Which version of Ranger are you using ?

Row level filter policy supports only 'select' permission

10232-screen-shot-2016-12-12-at-82728-am.png

10233-screen-shot-2016-12-12-at-82856-am.png

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

Expert Contributor

I know row level filter only has select. But does it also remove the permission from other policy? Like hive users universal access from the base policy.

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

Rising Star

I could re-create the same issue on hdp 2.5 sandbox. it looks to me a bug.

Highlighted

Re: Ranger Hive row level filter policy prevent INSERT, is it a bug?

Contributor

Hi Qi Wang: To your question "I know row level filter only has select. But does it also remove the permission from other policy? Like hive users universal access from the base policy.”

--> In this case your user 'hive' has all permissions on all tables through the default access based policy. Also there is a row level policy for user 'hive’ on 'rowfilter' table. We have only ‘select’ privilege to choose in row level policy, what this means is that you are giving user ‘hive’ only ‘select' privilege on the table and that too with restrictions on what he can view on doing ‘select’.

Why this is done? If you as a user are not allowed to even see the full contents of a particular table, you cannot be allowed to perform operations on that table.

When Hive request comes in from a user, all row level policies are scanned for that user. If a row level policy found for the user, the access privileges are scanned on that resource by going through access policies. (An access policy needs to grant the user access to that resource, row filer policy does not grant access). Now since update is not granted by masking policy, the operation is denied. The request does not even reach access policy.

Hope this helps.