apache / apache/kyuubi

[Bug] [authZ] dfs path privilege check error

Open
#6,854 2 comments 0 reactions 0 assignees View on GitHub
kind:bug priority:major
Dominant language
Scala
Stars
2.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the bug

apache spark 3.4.4
kyuubi 1.9.3
ranger 1.2.0

authZ complie with :
`mvn clean package -pl :kyuubi-spark-authz-shaded_2.12 -am -DskipTests -Pspark-3.4 -Dspark.version=3.4.4 -Dranger.version=1.2.0`

connect to kyuubi:
`jdbc:hive2://10.0.1.1:10009/;?kyuubi.engine.share.level=user;#spark.sql.runSQLOnFiles=true;spark.app.name=spark-3.4-test`

try:
```
select * from parquet.`/warehouse/tablespace/managed/hive/test.db/students/student_id=1` limit 10;
```

error:
Caused by: org.apache.kyuubi.plugin.spark.authz.AccessControlException: Permission denied: user [xman] does not have [read] privilege on [[hdfs://nsprd/warehouse/tablespace/managed/hive/test.db/students/student_id=1, hdfs://nsprd/warehouse/tablespace/managed/hive/test.db/students/student_id=1/]]

the user have all db and table privilege , and hdfs path privilege about the warehouse:

![image](https://github.com/user-attachments/assets/127da8dd-fb92-42d6-b67d-ccbabcd73e0f)

**and this is fine with spark 3.3.3 and kyuubi-spark-authz_2.12-1.8.0-SNAPSHOT.jar**

### Affects Version(s)

1.9.3

### Kyuubi Server Log Output

_No response_

### Kyuubi Engine Log Output

_No response_

### Kyuubi Server Configurations

_No response_

### Kyuubi Engine Configurations

_No response_

### Additional context

_No response_

### Are you willing to submit PR?

- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [ ] No. I cannot submit a PR at this time.

Contributor guide

Open the contributing guide

Research direction

Reproduce the parquet path query with Spark 3.4.4, Kyuubi 1.9.3, and Ranger 1.2.0, then inspect the kyuubi-spark-authz-shaded_2.12 path privilege handling. Compare the result with Spark 3.3.3 and the Kyuubi 1.8.0-SNAPSHOT authorization jar; done means a user with the stated warehouse privileges is not denied read access to the partition path.

Written by the indexing model from the issue text.

Assessment

Tech stack
hadoop, scala, sql
Domain
authorization, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.