In T280175: Fix default ownership and permissions for Hive managed databases in /user/hive/warehouse we changed the permissions on the /user/hive/warehouse directory, expecting to take advantage of our HDFS fs.permissions.umask-mode setting, so that the following will hold:
- new databases in /user/hive/warehouse are writeable by owner, readable by analytics-privatedata-users group, and unreadable by other.
- all sub directories of /user/hive/warehouse inherit the same permissions.
However, in order to allow anyone to create new Hive databases (like we always have), we need to make /user/hive/warehouse writeable by the analytics-privatedata-users group. I had expected this to work if we set the permissions manually, however, our version of Hive has a hive.warehouse.subdir.inherit.perms setting that overrides the HDFS umask, and will cause any new sub directories to inherit the parent's.
We should set hive.warehouse.subdir.inherit.perms to false to avoid this behavior.
See
- https://support.datafabric.hpe.com/s/article/fs-permissions-umask-mode-doesn-t-work-on-hive?language=en_US
- https://cwiki.apache.org/confluence/display/Hive/Permission+Inheritance+in+Hive
- https://cwiki.apache.org/confluence/display/Hive/Configuration+Properties#ConfigurationProperties-hive.warehouse.subdir.inherit.perms