[CDH4] Add catalog APIs for adding/removing roles and privileges

Adds these APIs to the CatalogServiceCatalog so we can be sure that incrementing
the catalog version and the update happen atomically. Also moves the logic of
performing the incremental updates from Sentry out of the catalog and into a
new SentryServiceUpdater class.

CDH4 does not support Sentry Policy Service so all functionality is disabled.

Change-Id: I9c16cc48d1d10a0066bd04156db1433ba5d5d0e5
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/4165
Reviewed-by: Lenni Kuff <lskuff@cloudera.com>
Tested-by: jenkins
[CDH4] Add support for GRANT/REVOKE to Impala

This is a cherry-pick from CDH5. All GRANT/REVOKE statements are disabled since the
Sentry Service is not supported on CDH4. Analyzer tests have been modified to check that
the not supported error is returned for every statement.

This change adds support for GRANT/REVOKE to Impala via the Sentry Service. This includes
support for creating and dropping roles, granting and revoking roles to/from groups,
granting/revoking privileges to/from roles, and commands to view role metadata.

The specific statements that are added in this patch are:
CREATE/DROP ROLE <roleName>
SHOW ROLES
SHOW ROLE GRANT GROUP <groupName>
GRANT/REVOKE ROLE <roleName> TO/FROM GROUP <groupName>
GRANT/REVOKE <privilegeSpec> TO/FROM <roleName

It does not include some of the fancier bulk-op syntax like support for granting multiple
roles to multiple groups in one statement.

This patch does not add support for the WITH GRANT OPTION to delegate GRANT/REVOKE
privileges to other users.

TODO:
* Authorize these statements on the client side. The current Sentry Service design makes
  it difficult to authorize any GRANT/REVOKE statement on the client (Impala) side.
  Privilege checks are done within the Sentry Service itself. There are a few different
  options available to let Impala "fail fast" and those changes will come in a follow
  on patch.

Change-Id: Ic6bd19f5939d3290255222dcc1a42ce95bd345e2
[CDH4] Authorize SHOW ROLES statements and support SHOW CURRENT ROLES

This is a cherry-pick from CDH5. All GRANT/REVOKE statements have been disabled since
Sentry Service is not supported on CDH4.

This patch adds the necessary changes required to authorize SHOW ROLES statements.
This is not as easy as it could be because the Sentry Service doesn't currently
expose the metadata for who is/isn't authorized to execute these statements. To authorize
the statements, we need to first make an RPC to the Sentry Service (via the
Catalog Server) and then only proceed with the SHOW statement if the check succeeds.
We should consider revisiting this approach in the future when more metadata is available
from Sentry.

Additionally, this patch adds support for SHOW CURRENT ROLES which shows all roles
that are currently granted to the current user.

Change-Id: Ia01c20d58ab081f49a85566075836d8c6e25dbd4
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/4367
Reviewed-by: Lenni Kuff <lskuff@cloudera.com>
Tested-by: jenkins
[CDH4] Add support for WITH GRANT OPTION/REVOKE GRANT OPTION

This is a cherry-pick from CDH5. All GRANT/REVOKE statements have been disabled because
Sentry Service is not supported on CDH4.

This change adds support for GRANT <privilege> TO <role> WITH GRANT OPTION which allows
delegating GRANT/REVOKE authority to non-admin users. Specifically, it allows users who
have been granted the specified role to execute GRANT/REVOKE statements on all child
objects. For example, you can now do something like:
GRANT ALL ON DATABASE foo TO role1 WITH GRANT OPTION
and everyone granted role1 will be able to execute GRANT/REVOKE statements on database
foo OR any of the tables in the database.
It also adds support for REVOKE GRANT OPTION FOR <privilege> FROM <role> which allows
removing a previous WITH GRANT OPTION without actually deleting the privilege.
Similar to GRANT/REVOKE statements, the actual authorization checks on whether a user
should/should not have privileges to execute these options is done at the Sentry Service
level.

Change-Id: I8757569a3bdb68414e315ef37d6845b1859eb758
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/4377
Reviewed-by: Lenni Kuff <lskuff@cloudera.com>
Tested-by: jenkins
[CDH4] Add support for SHOW GRANT ROLE <roleName> [ON <privilege spec>]

This is a cherry-pick from CDH5. All GRANT/REVOKE statements have been disabled
because Sentry Service is not supported on CDH4.

Adds support for displaying all or a subset of the privileges granted to a role. Users
have privileges to execute this statement if they are already granted the role or if
they are an admin user on the Sentry Policy Service. The output includes:
* The target scope of the privilege
* The privilege level
* The target names in the object hierarchy
* Whether the privilege was granted using WITH GRANT OPTION
* The create time of the privilege

Examples:
-- Show all grants in role1
SHOW GRANT ROLE role1

-- Shows all grants in role1 on the database foo
SHOW GRANT ROLE role1 on DATABASE foo

Output looks like:
+----------+------------+-------+-----+-----------+--------------+-------------------------------+
| scope    | database   | table | uri | privilege | grant_option | create_time                   |
+----------+------------+-------+-----+-----------+--------------+-------------------------------+
| DATABASE | functional |       |     | ALL       | false        | Fri, Sep 19 2014 16:13:40.999 |
+----------+------------+-------+-----+-----------+--------------+-------------------------------+

Change-Id: I8ef1b87a4c22c8fba4228012668033d7f9d06fcb
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/4389
Reviewed-by: Lenni Kuff <lskuff@cloudera.com>
Tested-by: jenkins
Minor cleanup of test_spilling custom cluster test suite

Change-Id: If853893db082eae79a6ec22180e9ad5572c58f05