Code of Conduct

• I agree to follow this project's Code of Conduct

Search before asking

• I have searched in the issues and found no similar issues.

Describe the bug

Describe the bug
I'm using Iceberg table version 1.9.0 and try to rename table using ALTER TABLE t1 rename to t2

In my current situation, despite having revoked all my permissions, I am still able to change my table name using the ALTER TABLE RENAME command. Furthermore, I can even move a table from one schema to another using a command like ALTER TABLE schema_a.my_table RENAME TO schema_bb.my_table without any apparent permissions.

I try to another ALTER TABLE command, for example ALTER TABLE ADD COLUMNS and it deny my command as our expectation.

However, the ALTER TABLE RENAME command appears to run regardless of whether the user has the ALTER permission or not. I believe this constitutes a critical security or data governance issue.

What happens here?

Affects Version(s)

master

Expectation

Ranger check support iceberg all operation permission check

Task list

Spark 3 Reference: https://iceberg.apache.org/docs/1.9.0/spark-getting-started/

• DDL: https://iceberg.apache.org/docs/1.9.0/spark-ddl/
• Queries: https://iceberg.apache.org/docs/1.9.0/spark-queries/
• Procedures: https://iceberg.apache.org/docs/1.9.0/spark-procedures/
• Write: https://iceberg.apache.org/docs/1.9.0/spark-writes/#writing-with-sql

DDL

• Create Table:

  • Create Table Partitioned By

• Create Table As Select:

• Replace Table As Select:

• Drop table:

  • Drop table

  • Drop table purge

• Alter table: [SubTask #7040] Ranger Support Check Iceberg Alter Table Command & Change Iceberg Test Use Jdbc Catalog #7099

  • Alter Table Rename To

  • Alter Table Set Properties

  • Alter Table Unset Properties

  • Alter Table Add Column

  • Alter Table Rename Column

  • Alter Table Alter Column

  • Alter Table Drop Column

• Alter Table SQL Extensions: [Subtask #7040] Iceberg support ALTER TABLE SQL EXTENSIONS Ranger check #7066

  • Alter Table Add Partition Field

  • Alter Table Drop Partition Field

  • Alter Table Replace Partition Field

  • Alter Table Write Ordered By

  • Alter Table Write Distributed By Partition

  • Alter Table Set Identifier Fields

  • Alter Table Drop Identifier Fields

• Branching and Tagging DDL: [SubTask #7040] Iceberg Branch and Tag DDL authz test #7068

  • Alter Table Create Branch

  • Alter Table Create Tag

  • Alter Table Replace Branch

  • Alter Table Replace Tag

  • Alter Table Drop Branch

  • Alter Table Drop Tag

• View:

  • Creating view

  • Creating view with properties

  • Dropping view

  • Replacing view

  • Setting and removing view properties

  • Showing views

  • Showing the CREATE statement of view

  • Displaying view details

Writing with SQL:

• Write to table:

  • Inserting into table

  • Inserting overwrite table

  • Updating table

  • Deleting from table

  • Merging into table

• Write to branch:

Procedures:

• Snapshot Management:

  • Rolling back to snapshot

  • Rolling back to timestamp

  • Setting current snapshot

  • Cherry picking snapshot

  • Publish change

  • Fast forward

• Metadata Management:

  • Expiring snapshot

  • Removing orphan files

  • Rewriting data files

  • Rewriting manifests

  • Rewriting position delete files

• Migration:

  • Snapshotting

  • Migrating

  • Adding files

  • Registering table

• Metadata information:

  • Ancestors of

• Change Data Capture:

  • Creating change log view

• Table Statistics:

  • Compute table stats

• Table Replication:

  • Rewrite table stats

Queries

• Select table

• Select view

• Time traveling

• Inspecting table:

Are you willing to submit PR?

• Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
• No. I cannot submit a PR at this time.