src/java/org/apache/hcatalog/cli/SemanticAnalysis/HCatSemanticAnalyzerBase.java

/**
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.hcatalog.cli.SemanticAnalysis;

import java.io.Serializable;
import java.util.List;

import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hadoop.hive.metastore.api.Database;
import org.apache.hadoop.hive.ql.exec.Task;
import org.apache.hadoop.hive.ql.metadata.AuthorizationException;
import org.apache.hadoop.hive.ql.metadata.Hive;
import org.apache.hadoop.hive.ql.metadata.HiveException;
import org.apache.hadoop.hive.ql.metadata.InvalidTableException;
import org.apache.hadoop.hive.ql.metadata.Partition;
import org.apache.hadoop.hive.ql.metadata.Table;
import org.apache.hadoop.hive.ql.parse.AbstractSemanticAnalyzerHook;
import org.apache.hadoop.hive.ql.parse.HiveSemanticAnalyzerHookContext;
import org.apache.hadoop.hive.ql.parse.SemanticException;
import org.apache.hadoop.hive.ql.plan.DDLWork;
import org.apache.hadoop.hive.ql.security.authorization.HiveAuthorizationProvider;
import org.apache.hadoop.hive.ql.security.authorization.Privilege;
import org.apache.hadoop.hive.ql.session.SessionState;

/**
 * Base class for HCatSemanticAnalyzer hooks.
 */
public class HCatSemanticAnalyzerBase extends AbstractSemanticAnalyzerHook {

    private HiveAuthorizationProvider authProvider;

    protected String getDbName(Hive hive, String dbName) {
        return dbName == null ? hive.getCurrentDatabase() : dbName;
    }

    public HiveAuthorizationProvider getAuthProvider() {
        if (authProvider == null) {
            authProvider = SessionState.get().getAuthorizer();
        }

        return authProvider;
    }

    @Override
    public void postAnalyze(HiveSemanticAnalyzerHookContext context,
                            List<Task<? extends Serializable>> rootTasks) throws SemanticException {
        super.postAnalyze(context, rootTasks);

        //Authorize the operation.
        authorizeDDL(context, rootTasks);
    }

    /**
     * Checks for the given rootTasks, and calls authorizeDDLWork() for each DDLWork to
     * be authorized. The hooks should override this, or authorizeDDLWork to perform the
     * actual authorization.
     */
    /*
    * Impl note: Hive provides authorization with it's own model, and calls the defined
    * HiveAuthorizationProvider from Driver.doAuthorization(). However, HCat has to
    * do additional calls to the auth provider to implement expected behavior for
    * StorageDelegationAuthorizationProvider. This means, that the defined auth provider
    * is called by both Hive and HCat. The following are missing from Hive's implementation,
    * and when they are fixed in Hive, we can remove the HCat-specific auth checks.
    * 1. CREATE DATABASE/TABLE, ADD PARTITION statements does not call
    * HiveAuthorizationProvider.authorize() with the candidate objects, which means that
    * we cannot do checks against defined LOCATION.
    * 2. HiveOperation does not define sufficient Privileges for most of the operations,
    * especially database operations.
    * 3. For some of the operations, Hive SemanticAnalyzer does not add the changed
    * object as a WriteEntity or ReadEntity.
    *
    * @see https://issues.apache.org/jira/browse/HCATALOG-244
    * @see https://issues.apache.org/jira/browse/HCATALOG-245
    */
    protected void authorizeDDL(HiveSemanticAnalyzerHookContext context,
                                List<Task<? extends Serializable>> rootTasks) throws SemanticException {

        if (!HiveConf.getBoolVar(context.getConf(),
            HiveConf.ConfVars.HIVE_AUTHORIZATION_ENABLED)) {
            return;
        }

        Hive hive;
        try {
            hive = context.getHive();

            for (Task<? extends Serializable> task : rootTasks) {
                if (task.getWork() instanceof DDLWork) {
                    DDLWork work = (DDLWork) task.getWork();
                    if (work != null) {
                        authorizeDDLWork(context, hive, work);
                    }
                }
            }
        } catch (SemanticException ex) {
            throw ex;
        } catch (AuthorizationException ex) {
            throw ex;
        } catch (Exception ex) {
            throw new SemanticException(ex);
        }
    }

    /**
     * Authorized the given DDLWork. Does nothing by default. Override this
     * and delegate to the relevant method in HiveAuthorizationProvider obtained by
     * getAuthProvider().
     */
    protected void authorizeDDLWork(HiveSemanticAnalyzerHookContext context,
                                    Hive hive, DDLWork work) throws HiveException {
    }

    protected void authorize(Privilege[] inputPrivs, Privilege[] outputPrivs)
        throws AuthorizationException, SemanticException {
        try {
            getAuthProvider().authorize(inputPrivs, outputPrivs);
        } catch (HiveException ex) {
            throw new SemanticException(ex);
        }
    }

    protected void authorize(Database db, Privilege priv)
        throws AuthorizationException, SemanticException {
        try {
            getAuthProvider().authorize(db, null, new Privilege[]{priv});
        } catch (HiveException ex) {
            throw new SemanticException(ex);
        }
    }

    protected void authorizeTable(Hive hive, String tableName, Privilege priv)
        throws AuthorizationException, HiveException {
        Table table;
        try {
            table = hive.getTable(tableName);
        } catch (InvalidTableException ite) {
            // Table itself doesn't exist in metastore, nothing to validate.
            return;
        }

        authorize(table, priv);
    }

    protected void authorize(Table table, Privilege priv)
        throws AuthorizationException, SemanticException {
        try {
            getAuthProvider().authorize(table, new Privilege[]{priv}, null);
        } catch (HiveException ex) {
            throw new SemanticException(ex);
        }
    }

    protected void authorize(Partition part, Privilege priv)
        throws AuthorizationException, SemanticException {
        try {
            getAuthProvider().authorize(part, new Privilege[]{priv}, null);
        } catch (HiveException ex) {
            throw new SemanticException(ex);
        }
    }
}