The following command grants a role the SELECT privilege on a column:

GRANT SELECT(column_name) ON TABLE table_name TO ROLE role_name;

The following command can be used to revoke the SELECT privilege on a column:

REVOKE SELECT(column_name) ON TABLE table_name FROM ROLE role_name;

Any new columns added to a table will be inaccessible by default, until explicitly granted access.

Users whose roles have been granted the SELECT privilege on columns only, can perform operations which explicitly refer to those columns. Some examples are:

• SELECT column_name FROM TABLE table_name;

  In this case, Sentry will first check to see if the user has the required privileges to access the table. It will then further check to see whether the user has the SELECT privilege to access the column(s).

• SELECT COUNT(column_name) FROM TABLE table_name;

  Users are also allowed to use the COUNT function to return the number of values in the column.

• SELECT column_name FROM TABLE table_name WHERE column_name <operator> GROUP BY column_name;  

  The above command will work as long as you refer only to columns to which you already have access.
• To list the column(s) to which the current user has SELECT access:

  SHOW COLUMNS;

Exceptions:

• If a user has SELECT access to all columns in a table, the following command will work. Note that this is an exception, not the norm. In all other cases, SELECT on all columns does not allow you to perform table-level operations.

  SELECT * FROM TABLE table_name;

• The DESCRIBE table command differs from the others, in that it does not filter out columns for which the user does not have SELECT access.

  DESCRIBE (table_name);

• Column-level privileges can only be applied to tables and partitions, not views.
• HDFS-Sentry Sync: With HDFS-Sentry sync enabled, even if a user has been granted access to all columns of a table, they will not have access to the corresponding HDFS data files. This is because Sentry does not consider SELECT on all columns equivalent to explicitly being granted SELECT on the table.
• Column-level access control for access from Spark SQL is not supported by the HDFS-Sentry plug-in.

CREATE ROLE [role_name];

DROP ROLE [role_name];

GRANT ROLE role_name [, role_name]
    TO GROUP <groupName> [,GROUP <groupName>]

REVOKE ROLE role_name [, role_name]    
    FROM GROUP <groupName> [,GROUP <groupName>]

GRANT    
    <PRIVILEGE> [, <PRIVILEGE> ]    
    ON <OBJECT> <object_name>    
    TO ROLE <roleName> [,ROLE <roleName>]

Starting with CDH 5.5, you can grant the SELECT privilege on specific columns of a table. For example:

GRANT SELECT(column_name) ON TABLE table_name TO ROLE role_name;

GRANT ALL ON URI 'hdfs://namenode:XXX/path/to/table'
CREATE EXTERNAL TABLE foo LOCATION 'namenode:XXX/path/to/table'

GRANT ALL ON URI 'hdfs://namenode:XXX/path/to/table'
CREATE EXTERNAL TABLE foo LOCATION '/path/to/table'

Since Sentry supports both HDFS and Amazon S3, starting in CDH 5.8, Cloudera recommends that you specify the fully qualified URI in GRANT statements to avoid confusion. If the underlying storage is a mix of S3 and HDFS, the risk of granting the wrong privileges increases. The following are examples of fully qualified URIs:

• HDFS: hdfs://host:port/path/to/hdfs/table
• S3: s3a://host:port/path/to/s3/table

REVOKE    
    <PRIVILEGE> [, <PRIVILEGE> ]    
    ON <OBJECT> <object_name>    
    FROM ROLE <roleName> [,ROLE <roleName>]

You can also revoke any previously-granted SELECT privileges on specific columns of a table. For example:

REVOKE SELECT(column_name) ON TABLE table_name FROM ROLE role_name;

With CDH 5.2, you can delegate granting and revoking privileges to other roles. For example, a role that is granted a privilege WITH GRANT OPTION can GRANT/REVOKE the same privilege to/from other roles. Hence, if a role has the ALL privilege on a database and the WITH GRANT OPTION set, users granted that role can execute GRANT/REVOKE statements only for that database or child tables of the database.

GRANT
    <PRIVILEGE> 
    ON <OBJECT> <object_name>
    TO ROLE <roleName> 
    WITH GRANT OPTION

Only a role with GRANT option on a specific privilege or its parent privilege can revoke that privilege from other roles. Once the following statement is executed, all privileges with and without grant option are revoked.

REVOKE
    <PRIVILEGE>
    ON <OBJECT> <object_name>
    FROM ROLE <roleName>

Hive does not currently support revoking only the WITH GRANT OPTION from a privilege previously granted to a role. To remove the WITH GRANT OPTION, revoke the privilege and grant it again without the WITH GRANT OPTION flag.

• To list the database(s) for which the current user has database, table, or column-level access:

  SHOW DATABASES;

• To list the table(s) for which the current user has table or column-level access:

  SHOW TABLES;

• To list the column(s) to which the current user has SELECT access:

  SHOW COLUMNS;

• To list all the roles in the system (only for sentry admin users):

  SHOW ROLES;

• To list all the roles in effect for the current user session:

  SHOW CURRENT ROLES;

• To list all the roles assigned to the given <groupName> (only allowed for Sentry admin users and others users that are part of the group specified by <groupName>):

  SHOW ROLE GRANT GROUP <groupName>;

• The SHOW statement can also be used to list the privileges that have been granted to a role or all the grants given to a role for a particular object.

  To list all the grants for the given <roleName> (only allowed for Sentry admin users and other users that have been granted the role specified by <roleName>). The following command will also list any column-level privileges:

  SHOW GRANT ROLE <roleName>;

• To list all the grants for a role on the given <objectName> (only allowed for Sentry admin users and other users that have been granted the role specified by <roleName>). The following command will also list any column-level privileges:

  SHOW GRANT ROLE <roleName> on OBJECT <objectName>;