Member since
10-14-2019
3
Posts
0
Kudos Received
0
Solutions
10-15-2019
02:21 AM
I think the ranger action should be right, since it denies at the path '/apps/hive/warehouse/testdb.db', I only granted the user hdfs permission to the table path '/apps/hive/warehouse/testdb.db/table1'. I don't understand why it need the read permission to the database directory to do a desc on a table. Since with my ranger setting, I can do select on the table with no problem. It's just that I cannot do "desc" command on this table.
... View more
10-15-2019
02:08 AM
thanks for your reply, the enforcer is ranger-acl.
... View more
10-14-2019
07:46 PM
In ranger, I have already gave the select permission of certain hive table, and read, execute permission on hdfs path of the table. To make a example:
set read, execute permission on path /apps/hive/warehouse/testdb.db/table1 to account
set select permission on hive table 'table1' on all columns to account
When I do the command:
"show tables in testdb.db;" or "desc testdb.table1"
I get the Error from hive client:
Error: Error while compiling statement: FAILED: SemanticException [Error 10072]: Database does not exist: dwd (state=42000,code=10072)
When I check the 'hivemetastore.log', it shows the query requires the read permission on path '/apps/hive/warehouse/testdb.db'
org.apache.hadoop.ipc.RemoteException(org.apache.ranger.authorization.hadoop.exceptions.RangerAccessControlException): Permission denied: user=xxx, access=READ, inode="/apps/hive/warehouse/testdb.db"
The problem is, I only want to grant the permission of the table to this account. From my experience I don't need such database path permission to use 'desc' command on the table. What could be the problem?
... View more
Labels:
- Labels:
-
Apache Hive
-
Apache Ranger