{"record":{"id":"44d01265c492c193","repo":"prestodb/presto","slug":"unsupported-privilege-name","errorCode":null,"errorMessage":"Unsupported privilege name: ","messagePattern":"Unsupported privilege name: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/ThriftMetastoreUtil.java","lineNumber":753,"sourceCode":"        String name = userGrant.getPrivilege().toUpperCase(ENGLISH);\n        PrestoPrincipal grantor = new PrestoPrincipal(fromMetastoreApiPrincipalType(userGrant.getGrantorType()), userGrant.getGrantor());\n        switch (name) {\n            case \"ALL\":\n                return Arrays.stream(HivePrivilegeInfo.HivePrivilege.values())\n                        .map(hivePrivilege -> new HivePrivilegeInfo(hivePrivilege, withGrantOption, grantor, grantee.orElse(grantor)))\n                        .collect(toImmutableSet());\n            case \"SELECT\":\n                return ImmutableSet.of(new HivePrivilegeInfo(SELECT, withGrantOption, grantor, grantee.orElse(grantor)));\n            case \"INSERT\":\n                return ImmutableSet.of(new HivePrivilegeInfo(INSERT, withGrantOption, grantor, grantee.orElse(grantor)));\n            case \"UPDATE\":\n                return ImmutableSet.of(new HivePrivilegeInfo(UPDATE, withGrantOption, grantor, grantee.orElse(grantor)));\n            case \"DELETE\":\n                return ImmutableSet.of(new HivePrivilegeInfo(DELETE, withGrantOption, grantor, grantee.orElse(grantor)));\n            case \"OWNERSHIP\":\n                return ImmutableSet.of(new HivePrivilegeInfo(OWNERSHIP, withGrantOption, grantor, grantee.orElse(grantor)));\n            default:\n                throw new IllegalArgumentException(\"Unsupported privilege name: \" + name);\n        }\n    }\n\n    public static ColumnStatisticsObj createMetastoreColumnStatistics(String columnName, HiveType columnType, HiveColumnStatistics statistics, OptionalLong rowCount)\n    {\n        TypeInfo typeInfo = columnType.getTypeInfo();\n        checkArgument(typeInfo.getCategory() == PRIMITIVE, \"unsupported type: %s\", columnType);\n        switch (((PrimitiveTypeInfo) typeInfo).getPrimitiveCategory()) {\n            case BOOLEAN:\n                return createBooleanStatistics(columnName, columnType, statistics);\n            case BYTE:\n            case SHORT:\n            case INT:\n            case LONG:\n                return createLongStatistics(columnName, columnType, statistics);\n            case FLOAT:\n            case DOUBLE:\n                return createDoubleStatistics(columnName, columnType, statistics);","sourceCodeStart":735,"sourceCodeEnd":771,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive-metastore/src/main/java/com/facebook/presto/hive/metastore/thrift/ThriftMetastoreUtil.java#L735-L771","documentation":"This mapping (part of fromMetastoreApiPrivilegeInfo) translates a Hive Metastore privilege name string into Presto HivePrivilegeInfo privileges. Only SELECT, UPDATE, DELETE, INSERT, OWNERSHIP (the set handled by the switch) are recognized; any other privilege name stored in the Metastore hits the default branch and throws IllegalArgumentException. This surfaces when reading grant entries from the Metastore that Presto does not model.","triggerScenarios":"Listing privileges for a table where the Metastore contains a privilege name outside the supported set (e.g. 'ALL', 'INDEX', 'ALTER', 'METADATA', or Ranger/custom privilege strings) — encountered during SHOW GRANTS or access-control checks that enumerate Metastore privileges.","commonSituations":"Privileges granted via Hive CLI with legacy names ('ALL', 'ALTER'); ACLs written by third-party authorization systems; Hive version with additional built-in privileges.","solutions":["Remove or rewrite unsupported privilege entries in the Metastore to supported ones (SELECT/INSERT/UPDATE/DELETE/OWNERSHIP)","Re-grant using standard Hive/SQL privileges recognized by Presto","Skip privilege listing for affected tables or filter at the security layer","Upgrade Presto to a version whose privilege mapping includes the offending name"],"exampleFix":"-- before (Hive legacy grant)\nGRANT ALL ON t TO USER bob;\n-- after\nGRANT SELECT ON t TO USER bob;\nGRANT INSERT ON t TO USER bob;","handlingStrategy":"try-catch","validationCode":"Set<String> SUPPORTED = ImmutableSet.of(\"SELECT\",\"INSERT\",\"UPDATE\",\"DELETE\",\"OWNERSHIP\");\n// filter metastore privilege entries before conversion\nif (!SUPPORTED.contains(name.toUpperCase(Locale.ROOT))) {\n    log.warn(\"Skipping unsupported privilege '%s' on %s\", name, tableName);\n    return ImmutableSet.of();\n}","typeGuard":"boolean isSupportedPrivilege(String name) {\n    return name != null && SUPPORTED_PRIVILEGES.contains(name.toUpperCase(Locale.ROOT));\n}","tryCatchPattern":"try {\n    grants = ThriftMetastoreUtil.fromMetastoreApiPrivilegeGrantInfo(info, ...);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Unsupported privilege name\")) {\n        log.warn(\"Ignoring metastore privilege not modeled by Presto: %s\", e.getMessage());\n        return ImmutableSet.of();\n    }\n    throw e;\n}","preventionTips":["Grant only standard privileges (SELECT/INSERT/UPDATE/DELETE/OWNERSHIP) via Hive CLI or Presto","Avoid legacy 'ALL'/'ALTER' grants on tables read by Presto","Audit Metastore privilege rows for non-standard names before onboarding"],"tags":["hive","security","privileges","authorization"],"backgroundTag":"unsupported-privilege-name","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}