Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] [authZ] dfs path privilege check error #6854

Open
2 of 4 tasks
lordk911 opened this issue Dec 18, 2024 · 2 comments
Open
2 of 4 tasks

[Bug] [authZ] dfs path privilege check error #6854

lordk911 opened this issue Dec 18, 2024 · 2 comments
Labels
kind:bug This is a clearly a bug priority:major

Comments

@lordk911
Copy link
Contributor

Code of Conduct

Search before asking

  • I have searched in the issues and found no similar issues.

Describe the bug

apache spark 3.4.4
kyuubi 1.9.3
ranger 1.2.0

authZ complie with :
mvn clean package -pl :kyuubi-spark-authz-shaded_2.12 -am -DskipTests -Pspark-3.4 -Dspark.version=3.4.4 -Dranger.version=1.2.0

connect to kyuubi:
jdbc:hive2://10.0.1.1:10009/;?kyuubi.engine.share.level=user;#spark.sql.runSQLOnFiles=true;spark.app.name=spark-3.4-test

try:

select * from parquet.`/warehouse/tablespace/managed/hive/test.db/students/student_id=1` limit 10;

error:
Caused by: org.apache.kyuubi.plugin.spark.authz.AccessControlException: Permission denied: user [xman] does not have [read] privilege on [[hdfs://nsprd/warehouse/tablespace/managed/hive/test.db/students/student_id=1, hdfs://nsprd/warehouse/tablespace/managed/hive/test.db/students/student_id=1/]]

the user have all db and table privilege , and hdfs path privilege about the warehouse:

image

and this is fine with spark 3.3.3 and kyuubi-spark-authz_2.12-1.8.0-SNAPSHOT.jar

Affects Version(s)

1.9.3

Kyuubi Server Log Output

No response

Kyuubi Engine Log Output

No response

Kyuubi Server Configurations

No response

Kyuubi Engine Configurations

No response

Additional context

No response

Are you willing to submit PR?

  • Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
  • No. I cannot submit a PR at this time.
@lordk911 lordk911 added kind:bug This is a clearly a bug priority:major labels Dec 18, 2024
@lordk911
Copy link
Contributor Author

this also affect load data inpath statement

@lordk911
Copy link
Contributor Author

lordk911 commented Dec 23, 2024

kyuubi-spark-authz_2.12-1.8.3 is fine with spark3.4.4 and spark3.5.4

@lordk911 lordk911 changed the title [Bug] [authZ] when spark.sql.runSQLOnFiles got user does not have [read] privilege error [Bug] [authZ] dfs path privilege check error Dec 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind:bug This is a clearly a bug priority:major
Projects
None yet
Development

No branches or pull requests

1 participant