SentryServiceUtil { public static void checkDbExplicitGrantsPermitted(Configuration conf, Set<TSentryPrivilege> privileges) throws SentryGrantDeniedException { Set<String> permittedGrants = getDbGrantsPermittedFromConf(conf); if (permittedGrants.isEmpty()) { return; } Set<String> deniedGrants = new HashSet<>(); for (TSentryPrivilege privilege : privileges) { String action = privilege.getAction(); if (action != null) { action = action.trim().toUpperCase(); if (!permittedGrants.contains(action)) { deniedGrants.add(action); } } } if (!deniedGrants.isEmpty()) { throw new SentryGrantDeniedException( String.format("GRANT privilege for %s not permitted.", deniedGrants)); } } private  SentryServiceUtil(); static TSentryPrivilege convertToTSentryPrivilege(String privilegeStr); static Set<TSentryAuthorizable> parseAuthorizables(String objects); static String getPrivilegeScope(TSentryPrivilege tSentryPrivilege); static String convertTSentryPrivilegeToStr(TSentryPrivilege tSentryPrivilege); static void shutdownAndAwaitTermination(ExecutorService pool, String poolName,
                       long timeout, TimeUnit unit, Logger logger); static boolean isHDFSSyncEnabled(Configuration conf); static boolean isHDFSSyncEnabledNoCache(Configuration conf); static boolean isSyncPolicyStoreEnabled(Configuration conf); static String getHiveMetastoreURI(); static String getAuthzObj(TSentryAuthorizable authorizable); static String getAuthzObj(String dbName, String tblName); static String getCurrentTimeStampWithMessage(String logMessage); static void checkDbExplicitGrantsPermitted(Configuration conf, Set<TSentryPrivilege> privileges);  }
@Test public void testCheckPermittedDbGrants() { Configuration conf = new Configuration(); try { SentryServiceUtil.checkDbExplicitGrantsPermitted(conf, Collections.emptySet()); } catch (SentryGrantDeniedException e) { fail("An empty permitted privileges configuration should not throw an exception"); } conf.set(SENTRY_DB_EXPLICIT_GRANTS_PERMITTED, "all,*,select,insert"); try { SentryServiceUtil.checkDbExplicitGrantsPermitted(conf, Sets.newHashSet( newTSentryPrivilege("select"), newTSentryPrivilege("insert"), newTSentryPrivilege("all"), newTSentryPrivilege("*") )); } catch (SentryGrantDeniedException e) { fail("ALL, *, SELECT and INSERT privileges should be permitted"); } try { SentryServiceUtil.checkDbExplicitGrantsPermitted(conf, Sets.newHashSet( newTSentryPrivilege("select"), newTSentryPrivilege("create"), newTSentryPrivilege("all") )); fail("CREATE privileges should not be permitted"); } catch (SentryGrantDeniedException e) { assertTrue("CREATE privileges should not be permitted", e.getMessage().contains("CREATE")); assertFalse("SELECT privileges should be permitted", e.getMessage().contains("SELECT")); assertFalse("ALL privileges should be permitted", e.getMessage().contains("ALL")); } conf.set(SENTRY_DB_EXPLICIT_GRANTS_PERMITTED, "select,insert,create"); try { SentryServiceUtil.checkDbExplicitGrantsPermitted(conf, Sets.newHashSet( newTSentryPrivilege("alter"), newTSentryPrivilege("create"), newTSentryPrivilege("drop") )); fail("ALTER and DROP privileges should not be permitted"); } catch (SentryGrantDeniedException e) { assertTrue("ALTER privileges should not be permitted", e.getMessage().contains("ALTER")); assertTrue("DROP privileges should not be permitted", e.getMessage().contains("DROP")); assertFalse("CREATE privileges should be permitted", e.getMessage().contains("CREATE")); } }