[Bug] [AUTHZ]ALTER operation to change the table name don't require any permission

[baotran306]

Code of Conduct

• [x] I agree to follow this project's Code of Conduct

Search before asking

• [x] I have searched in the issues and found no similar issues.

Describe the bug

Describe the bug I'm using Iceberg table version 1.9.0 and try to rename table using ALTER TABLE t1 rename to t2

In my current situation, despite having revoked all my permissions, I am still able to change my table name using the ALTER TABLE RENAME command. Furthermore, I can even move a table from one schema to another using a command like ALTER TABLE schema_a.my_table RENAME TO schema_bb.my_table without any apparent permissions.

I try to another ALTER TABLE command, for example ALTER TABLE ADD COLUMNS and it deny my command as our expectation.

However, the ALTER TABLE RENAME command appears to run regardless of whether the user has the ALTER permission or not. I believe this constitutes a critical security or data governance issue.

What happens here?

Affects Version(s)

master

Expectation

Ranger check support iceberg all operation permission check

---

Task list

Spark 3 Reference: https://iceberg.apache.org/docs/1.9.0/spark-getting-started/

• DDL: https://iceberg.apache.org/docs/1.9.0/spark-ddl/
• Queries: https://iceberg.apache.org/docs/1.9.0/spark-queries/
• Procedures: https://iceberg.apache.org/docs/1.9.0/spark-procedures/
• Write: https://iceberg.apache.org/docs/1.9.0/spark-writes/#writing-with-sql

DDL

• [ ] Create Table:

  • [ ] Create Table Partitioned By

• [ ] Create Table As Select:

• [ ] Replace Table As Select:

• [ ] Drop table:

  • [ ] Drop table

  • [ ] Drop table purge

• [x] Alter table: https://github.com/apache/kyuubi/issues/7099

  • [x] Alter Table Rename To

  • [x] Alter Table Set Properties

  • [x] Alter Table Unset Properties

  • [x] Alter Table Add Column

  • [x] Alter Table Rename Column

  • [x] Alter Table Alter Column

  • [x] Alter Table Drop Column

• [x] Alter Table SQL Extensions: #7066

  • [x] Alter Table Add Partition Field

  • [x] Alter Table Drop Partition Field

  • [x] Alter Table Replace Partition Field

  • [x] Alter Table Write Ordered By

  • [x] Alter Table Write Distributed By Partition

  • [x] Alter Table Set Identifier Fields

  • [x] Alter Table Drop Identifier Fields

• [x] Branching and Tagging DDL: #7068

  • [x] Alter Table Create Branch

  • [x] Alter Table Create Tag

  • [x] Alter Table Replace Branch

  • [x] Alter Table Replace Tag

  • [x] Alter Table Drop Branch

  • [x] Alter Table Drop Tag

• [x] View: #7136

  • [x] Creating view

  • [x] Creating view with properties

  • [x] Dropping view

  • [x] Replacing view

  • [x] Setting and removing view properties

  • [x] Showing views

  • [x] Showing the CREATE statement of view

  • [x] Displaying view details

Writing with SQL:

• [ ] Write to table:

  • [ ] Inserting into table

  • [ ] Inserting overwrite table

  • [x] Updating table

  • [x] Deleting from table

  • [x] Merging into table

• [ ] Write to branch:

Procedures:

• [x] Snapshot Management: #7136

  • [x] Rolling back to snapshot

  • [x] Rolling back to timestamp

  • [x] Setting current snapshot

  • [x] Cherry picking snapshot

  • [x] Publish change

  • [x] Fast forward

• [x] Metadata Management: #7136

  • [x] Expiring snapshot

  • [x] Removing orphan files

  • [x] Rewriting data files

  • [x] Rewriting manifests

  • [x] Rewriting position delete files

• [x] Migration: #7136

  • [x] Snapshotting

  • [x] Migrating

  • [x] Adding files

  • [x] Registering table

• [x] Metadata information: #7136

  • [x] Ancestors of

• [x] Change Data Capture: #7136

  • [x] Creating change log view

• [x] Table Statistics: #7136

  • [x] Compute table stats

• [x] Table Replication: #7136

  • [x] Rewrite table stats

Queries

• [ ] Select table

• [ ] Select view

• [ ] Time traveling

• [ ] Inspecting table:

Are you willing to submit PR?

• [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
• [x] No. I cannot submit a PR at this time.

[github-actions[bot]]

Hello @baotran306, Thanks for finding the time to report the issue! We really appreciate the community's efforts to improve Apache Kyuubi.

[nqvuong1998]

cc @yaooqinn @turboFei @davidyuan1223 @developster

[davidyuan1223]

I think the test of iceberg ranger may not fully check all commands of spark. I did not find alter table command in this file. https://github.com/apache/kyuubi/blob/branch-1.10/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/IcebergCatalogRangerSparkExtensionSuite.scala

[davidyuan1223]

If you need, I can check iceberg's alter table command for you. If there are code changes, you may need to merge a new patch into your branch. Do you need me to do this? @baotran306

[baotran306]

Hi @davidyuan1223, thanks for your prompt response. I really need your help in coding this new patch. Please do this. Once you've made the necessary changes, I'll merge the new patch into my branch later.

Additionally, Can you also include unit tests that cover the full range of Iceberg syntax?

[davidyuan1223]

Hi @davidyuan1223, thanks for your prompt response. I really need your help in coding this new patch. Please do this. Once you've made the necessary changes, I'll merge the new patch into my branch later.

Additionally, Can you also include unit tests that cover the full range of Iceberg syntax?

Of Course, But this work may need 2~3 weeks, I need to deal with other work recently, so I may not be able to look at this question until next week.

[baotran306]

Hi @davidyuan1223, thanks for your prompt response. I really need your help in coding this new patch. Please do this. Once you've made the necessary changes, I'll merge the new patch into my branch later. Additionally, Can you also include unit tests that cover the full range of Iceberg syntax?

Of Course, But this work may need 2~3 weeks, I need to deal with other work recently, so I may not be able to look at this question until next week.

Sounds good. I really appreciate you looking into this next week. Thanks.

[baotran306]

Hi @davidyuan1223, One more update from my side:

I've just tested all the DDL commands for Iceberg tables. I think this list will be a little helpful in reducing your effort. It seems that almost all ALTER TABLE commands behave similarly to ALTER TABLE RENAME(No require any permission). Thanks again.

[davidyuan1223]

@baotran306 #7066 Alter table sql extenstions, i have fixed, you need update your issue, you missing drop partition field, the add partition field is duplicated

[baotran306]

Hi @davidyuan1223 , I saw you have a new change (#7099) to support the ALTER TABLE command, and the reviewer has already approved the changes. I've linked the subtask to our checklist. Could you please rerun the CI fix (I noticed some tests failed due to an unreachable network) and merge it into master?

Additionally, could you prioritize checking for VIEW in the next step? Currently, neither tests nor permissions are required for the VIEW DDL command, which poses a significant risk(compare to others command, which only lack of test).

Thanks for your help!