[Bug] [authZ] dfs path privilege check error
- Dominant language
- Scala
- Stars
- 2.4k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
### Search before asking
- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.
### Describe the bug
apache spark 3.4.4
kyuubi 1.9.3
ranger 1.2.0
authZ complie with :
`mvn clean package -pl :kyuubi-spark-authz-shaded_2.12 -am -DskipTests -Pspark-3.4 -Dspark.version=3.4.4 -Dranger.version=1.2.0`
connect to kyuubi:
`jdbc:hive2://10.0.1.1:10009/;?kyuubi.engine.share.level=user;#spark.sql.runSQLOnFiles=true;spark.app.name=spark-3.4-test`
try:
```
select * from parquet.`/warehouse/tablespace/managed/hive/test.db/students/student_id=1` limit 10;
```
error:
Caused by: org.apache.kyuubi.plugin.spark.authz.AccessControlException: Permission denied: user [xman] does not have [read] privilege on [[hdfs://nsprd/warehouse/tablespace/managed/hive/test.db/students/student_id=1, hdfs://nsprd/warehouse/tablespace/managed/hive/test.db/students/student_id=1/]]
the user have all db and table privilege , and hdfs path privilege about the warehouse:

**and this is fine with spark 3.3.3 and kyuubi-spark-authz_2.12-1.8.0-SNAPSHOT.jar**
### Affects Version(s)
1.9.3
### Kyuubi Server Log Output
_No response_
### Kyuubi Engine Log Output
_No response_
### Kyuubi Server Configurations
_No response_
### Kyuubi Engine Configurations
_No response_
### Additional context
_No response_
### Are you willing to submit PR?
- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [ ] No. I cannot submit a PR at this time.
Contributor guide
Research direction
Reproduce the parquet path query with Spark 3.4.4, Kyuubi 1.9.3, and Ranger 1.2.0, then inspect the kyuubi-spark-authz-shaded_2.12 path privilege handling. Compare the result with Spark 3.3.3 and the Kyuubi 1.8.0-SNAPSHOT authorization jar; done means a user with the stated warehouse privileges is not denied read access to the partition path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- hadoop, scala, sql
- Domain
- authorization, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100