ClickHouse / ClickHouse/ClickHouse

information_schema.tables require GRANT SELECT ON system.parts

Open
#86,411 0 comments 0 reactions 0 assignees View on GitHub
comp-rbac external potential bug
Dominant language
C++
Stars
49.9k
Forks
9k
Avg merge
21h 32m
Merged PRs (30d)
515

Description

### Company or project name

_No response_

### Describe what's wrong

If you :
- set **users_without_row_policies_can_read_rows** = False
- have a ```sql CREATE ROW POLICY pol_admin_system ON CLUSTER default ON system.* FOR SELECT USING 1 TO admin;```
- run a ```sql select table_schema, table_name from information_schema.tables``` from another user

On version 25.2.2.39: work as expected

On version 25.7.5.34 or 25.8.1, you get : ```
Not enough privileges. To execute this query, it's necessary to have the grant SELECT(database, `table`) ON system.parts
```

### Does it reproduce on the most recent release?

Yes

### How to reproduce

version: 25.8.1, 25.7.5.34

non-default setting : false

as an admin account :
CREATE ROW POLICY pol_admin_system ON CLUSTER default ON system.* FOR SELECT USING 1 TO admin;

as a not admin account:
SELECT table_schema, table_name FROM information_schema.tables;

### Expected behavior

```
INFORMATION_SCHEMA COLUMNS
INFORMATION_SCHEMA KEY_COLUMN_USAGE
INFORMATION_SCHEMA REFERENTIAL_CONSTRAINTS
INFORMATION_SCHEMA SCHEMATA
INFORMATION_SCHEMA STATISTICS
```

### Error message and/or stacktrace

Not enough privileges. To execute this query, it's necessary to have the grant SELECT(database, `table`) ON system.parts. (ACCESS_DENIED)

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.