[Bug] [AUTHZ]ALTER operation to change the table name don't require any permission

[baotran306]

Code of Conduct

• I agree to follow this project's Code of Conduct

Search before asking

• I have searched in the issues and found no similar issues.

Describe the bug

Describe the bug
I'm using Iceberg table version 1.7.2 and try to rename table using ALTER TABLE t1 rename to t2

In my current situation, despite having revoked all my permissions, I am still able to change my table name using the ALTER TABLE RENAME command. Furthermore, I can even move a table from one schema to another using a command like ALTER TABLE schema_a.my_table RENAME TO schema_bb.my_table without any apparent permissions.

I try to another ALTER TABLE command, for example ALTER TABLE ADD COLUMNS and it deny my command as our expectation.

However, the ALTER TABLE RENAME command appears to run regardless of whether the user has the ALTER permission or not. I believe this constitutes a critical security or data governance issue.

What happens here?

Affects Version(s)

v1.10.1

Kyuubi Server Log Output

Kyuubi Engine Log Output

Kyuubi Server Configurations

Kyuubi Engine Configurations

Additional context

No response

Are you willing to submit PR?

• Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
• No. I cannot submit a PR at this time.

[github-actions]

Hello @baotran306,
Thanks for finding the time to report the issue!
We really appreciate the community's efforts to improve Apache Kyuubi.

[nqvuong1998]

cc @yaooqinn @turboFei @davidyuan1223 @developster

[davidyuan1223]

I think the test of iceberg ranger may not fully check all commands of spark. I did not find alter table command in this file.
https://github.com/apache/kyuubi/blob/branch-1.10/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/IcebergCatalogRangerSparkExtensionSuite.scala

[davidyuan1223]

If you need, I can check iceberg's alter table command for you. If there are code changes, you may need to merge a new patch into your branch. Do you need me to do this?
@baotran306

[baotran306]

Hi @davidyuan1223, thanks for your prompt response. I really need your help in coding this new patch. Please do this. Once you've made the necessary changes, I'll merge the new patch into my branch later.

Additionally, Can you also include unit tests that cover the full range of Iceberg syntax?

[davidyuan1223]

Hi @davidyuan1223, thanks for your prompt response. I really need your help in coding this new patch. Please do this. Once you've made the necessary changes, I'll merge the new patch into my branch later.

Additionally, Can you also include unit tests that cover the full range of Iceberg syntax?

Of Course, But this work may need 2~3 weeks, I need to deal with other work recently, so I may not be able to look at this question until next week.

[baotran306]

Hi @davidyuan1223, thanks for your prompt response. I really need your help in coding this new patch. Please do this. Once you've made the necessary changes, I'll merge the new patch into my branch later.
Additionally, Can you also include unit tests that cover the full range of Iceberg syntax?

Of Course, But this work may need 2~3 weeks, I need to deal with other work recently, so I may not be able to look at this question until next week.

Sounds good. I really appreciate you looking into this next week. Thanks.

[baotran306]

Hi @davidyuan1223, One more update from my side:

I've just tested all the DDL commands for Iceberg tables. I think this list will be a little helpful in reducing your effort. It seems that almost all ALTER TABLE commands behave similarly to ALTER TABLE RENAME(No require any permission). Thanks again.