基于元数据和sql标准权限验证
问题1:show database show tables 没有进行控制
问题1:show database show tables 没有进行控制
问题2:load 数据 和创建表制定location 的时候必须是自己用户对应的数据,如果本地数据linux 用户 和hdfs 数据用户 不是自己没有权限
问题3: 创建函数必须是要admin 用户
具体分析:SQLStdHiveAuthorizationValidator checkPrivileges
switch (hiveObj.getType()) {
case LOCAL_URI://load 数据和create table 制定location的时候会执行此处
case DFS_URI:
availPrivs = SQLAuthorizationUtils.getPrivilegesFromFS(new Path(hiveObj.getObjectName()),
conf, userName);
break;
case PARTITION:
// sql std authorization is managing privileges at the table/view levels
// only
// ignore partitions
continue;
case COMMAND_PARAMS:
case FUNCTION://创建函数的时候会走次逻辑
// operations that have objects of type COMMAND_PARAMS, FUNCTION are authorized
// solely on the type
if (privController.isUserAdmin()) {
availPrivs.addPrivilege(SQLPrivTypeGrant.ADMIN_PRIV);
}
break;
default:
availPrivs = SQLAuthorizationUtils.getPrivilegesFromMetaStore(metastoreClient, userName,
hiveObj, privController.getCurrentRoleNames(), privController.isUserAdmin());
}
LOCAL_URI DFS_URI
public static RequiredPrivileges getPrivilegesFromFS(Path filePath, HiveConf conf,
String userName) throws HiveAuthzPluginException {
// get the 'available privileges' from file system
RequiredPrivileges availPrivs = new RequiredPrivileges();
// check file system permission
FileSystem fs;
try {
fs = FileSystem.get(filePath.toUri(), conf);
Path path = FileUtils.getPathOrParentThatExists(fs, filePath);
FileStatus fileStatus = fs.getFileStatus(path);
if (FileUtils.isOwnerOfFileHierarchy(fs, fileStatus, userName)) {
availPrivs.addPrivilege(SQLPrivTypeGrant.OWNER_PRIV);// 需要时owner
}
if (FileUtils.isActionPermittedForFileHierarchy(fs, fileStatus, userName, FsAction.WRITE)) {
availPrivs.addPrivilege(SQLPrivTypeGrant.INSERT_NOGRANT); //需要insert
availPrivs.addPrivilege(SQLPrivTypeGrant.DELETE_NOGRANT); //需要delete
}
if (FileUtils.isActionPermittedForFileHierarchy(fs, fileStatus, userName, FsAction.READ)) {
availPrivs.addPrivilege(SQLPrivTypeGrant.SELECT_NOGRANT); //需要select
}
} catch (Exception e) {
String msg = "Error getting permissions for " + filePath + ": " + e.getMessage();
throw new HiveAuthzPluginException(msg, e);
}
return availPrivs;
}