Skip to content

Commit

Permalink
Allow all for admin role
Browse files Browse the repository at this point in the history
Admin user has all the available permissions for all the entities
implicitly. So it may be considered as a database and table "owner"
for all tables and databases. Also it has all the SELECT, INSERT, DELETE
permissions implicitly.

Extracted-From: prestodb/presto#10904
  • Loading branch information
Andrii Rosa authored and sopel39 committed Jan 29, 2019
1 parent d455185 commit e5f2784
Showing 1 changed file with 15 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ public void checkCanDropSchema(ConnectorTransactionHandle transaction, Connector
@Override
public void checkCanRenameSchema(ConnectorTransactionHandle transaction, ConnectorIdentity identity, String schemaName, String newSchemaName)
{
if (!isAdmin(transaction, identity) || !isDatabaseOwner(transaction, identity, schemaName)) {
if (!isDatabaseOwner(transaction, identity, schemaName)) {
denyRenameSchema(schemaName, newSchemaName);
}
}
Expand Down Expand Up @@ -354,6 +354,10 @@ private boolean isDatabaseOwner(ConnectorTransactionHandle transaction, Connecto
return true;
}

if (isAdmin(transaction, identity)) {
return true;
}

SemiTransactionalHiveMetastore metastore = metastoreProvider.apply(((HiveTransactionHandle) transaction));
Optional<Database> databaseMetadata = metastore.getDatabase(databaseName);
if (!databaseMetadata.isPresent()) {
Expand All @@ -374,7 +378,11 @@ private boolean isDatabaseOwner(ConnectorTransactionHandle transaction, Connecto

private boolean checkTablePermission(ConnectorTransactionHandle transaction, ConnectorIdentity identity, SchemaTableName tableName, HivePrivilege... requiredPrivileges)
{
if (tableName.equals(ROLES) && !isAdmin(transaction, identity)) {
if (isAdmin(transaction, identity)) {
return true;
}

if (tableName.equals(ROLES)) {
return false;
}

Expand All @@ -396,6 +404,10 @@ private boolean checkTablePermission(ConnectorTransactionHandle transaction, Con

private boolean hasGrantOptionForPrivilege(ConnectorTransactionHandle transaction, ConnectorIdentity identity, Privilege privilege, SchemaTableName tableName)
{
if (isAdmin(transaction, identity)) {
return true;
}

SemiTransactionalHiveMetastore metastore = metastoreProvider.apply(((HiveTransactionHandle) transaction));
return listApplicableTablePrivileges(
metastore,
Expand All @@ -410,6 +422,7 @@ private boolean hasAdminOptionForRoles(ConnectorTransactionHandle transaction, C
if (isAdmin(transaction, identity)) {
return true;
}

SemiTransactionalHiveMetastore metastore = metastoreProvider.apply(((HiveTransactionHandle) transaction));
Set<RoleGrant> grants = listApplicableRoles(new PrestoPrincipal(USER, identity.getUser()), metastore::listRoleGrants);
Set<String> rolesWithGrantOption = grants.stream()
Expand Down

0 comments on commit e5f2784

Please sign in to comment.