presto select query fails with permission denied for kerberized Hive metastore with hive metastore impersonation enabled.
select query fails when service user and doesn't has read permission to underlaying hdfs directory to hive table. service user can impersonate the actual user who owns the table and directory.
 acutal user is only user who has permissions to the directory.

### stack trace : 
`
presto> select * from hive.actual_user.test;        
        
        Query 20190925_123321_00004_p7gd2 failed: org.apache.hadoop.security.AccessControlException: Permission denied: user=service_user, access=EXECUTE, inode="/hive/userdbs/actual_user.db/test":actual_user:hadoop:drwxr-x---
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.check(FSPermissionChecker.java:353)
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkTraverse(FSPermissionChecker.java:292)
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:238)
                at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkDefaultEnforcer(RangerHdfsAuthorizer.java:428)
                at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkPermission(RangerHdfsAuthorizer.java:365)
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:190)
                at org.apache.hadoop.hdfs.server.namenode.FSDirectory.checkPermission(FSDirectory.java:1956)
                at org.apache.hadoop.hdfs.server.namenode.FSDirStatAndListingOp.getFileInfo(FSDirStatAndListingOp.java:108)
                at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.getFileInfo(FSNamesystem.java:4142)
                at org.apache.hadoop.hdfs.server.namenode.NameNodeRpcServer.getFileInfo(NameNodeRpcServer.java:1137)
                at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolServerSideTranslatorPB.getFileInfo(ClientNamenodeProtocolServerSideTranslatorPB.java:866)
                at org.apache.hadoop.hdfs.protocol.proto.ClientNamenodeProtocolProtos$ClientNamenodeProtocol$2.callBlockingMethod(ClientNamenodeProtocolProtos.java)
                at org.apache.hadoop.ipc.ProtobufRpcEngine$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine.java:640)
                at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:982)
                at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:2351)
                at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:2347)
                at java.security.AccessController.doPrivileged(Native Method)
                at javax.security.auth.Subject.doAs(Subject.java:422)
                at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1866)
                at org.apache.hadoop.ipc.Server$Handler.run(Server.java:2347)

        io.prestosql.spi.PrestoException: org.apache.hadoop.security.AccessControlException: Permission denied: user=service_user, access=EXECUTE, inode="/hive/userdbs/actual_user.db/test":actual_user:hadoop:drwxr-x---
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.check(FSPermissionChecker.java:353)
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkTraverse(FSPermissionChecker.java:292)
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:238)
                at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkDefaultEnforcer(RangerHdfsAuthorizer.java:428)
                at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkPermission(RangerHdfsAuthorizer.java:365)
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:190)
                at org.apache.hadoop.hdfs.server.namenode.FSDirectory.checkPermission(FSDirectory.java:1956)
                at org.apache.hadoop.hdfs.server.namenode.FSDirStatAndListingOp.getFileInfo(FSDirStatAndListingOp.java:108)
                at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.getFileInfo(FSNamesystem.java:4142)
                at org.apache.hadoop.hdfs.server.namenode.NameNodeRpcServer.getFileInfo(NameNodeRpcServer.java:1137)
                at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolServerSideTranslatorPB.getFileInfo(ClientNamenodeProtocolServerSideTranslatorPB.java:866)
                at org.apache.hadoop.hdfs.protocol.proto.ClientNamenodeProtocolProtos$ClientNamenodeProtocol$2.callBlockingMethod(ClientNamenodeProtocolProtos.java)
                at org.apache.hadoop.ipc.ProtobufRpcEngine$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine.java:640)
                at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:982)
                at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:2351)
                at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:2347)
                at java.security.AccessController.doPrivileged(Native Method)
                at javax.security.auth.Subject.doAs(Subject.java:422)
                at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1866)
                at org.apache.hadoop.ipc.Server$Handler.run(Server.java:2347)

                at io.prestosql.plugin.hive.metastore.thrift.ThriftHiveMetastore.getTable(ThriftHiveMetastore.java:261)
                at io.prestosql.plugin.hive.metastore.thrift.BridgingHiveMetastore.getTable(BridgingHiveMetastore.java:85)
                at io.prestosql.plugin.hive.metastore.cache.CachingHiveMetastore.loadTable(CachingHiveMetastore.java:293)
                at com.google.common.cache.CacheLoader$FunctionToCacheLoader.load(CacheLoader.java:165)
                at com.google.common.cache.CacheLoader$1.load(CacheLoader.java:188)
                at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3528)
                at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2277)
                at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2154)
                at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2044)
                at com.google.common.cache.LocalCache.get(LocalCache.java:3952)
                at com.google.common.cache.LocalCache.getOrLoad(LocalCache.java:3974)
                at com.google.common.cache.LocalCache$LocalLoadingCache.get(LocalCache.java:4958)
                at com.google.common.cache.LocalCache$LocalLoadingCache.getUnchecked(LocalCache.java:4964)
                at io.prestosql.plugin.hive.metastore.cache.CachingHiveMetastore.get(CachingHiveMetastore.java:236)
                at io.prestosql.plugin.hive.metastore.cache.CachingHiveMetastore.getTable(CachingHiveMetastore.java:282)
                at io.prestosql.plugin.hive.metastore.cache.CachingHiveMetastore.loadTable(CachingHiveMetastore.java:293)
                at com.google.common.cache.CacheLoader$FunctionToCacheLoader.load(CacheLoader.java:165)
                at com.google.common.cache.CacheLoader$1.load(CacheLoader.java:188)
                at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3528)
                at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2277)
                at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2154)
                at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2044)
                at com.google.common.cache.LocalCache.get(LocalCache.java:3952)
                at com.google.common.cache.LocalCache.getOrLoad(LocalCache.java:3974)
                at com.google.common.cache.LocalCache$LocalLoadingCache.get(LocalCache.java:4958)
                at com.google.common.cache.LocalCache$LocalLoadingCache.getUnchecked(LocalCache.java:4964)
                at io.prestosql.plugin.hive.metastore.cache.CachingHiveMetastore.get(CachingHiveMetastore.java:236)
                at io.prestosql.plugin.hive.metastore.cache.CachingHiveMetastore.getTable(CachingHiveMetastore.java:282)
                at io.prestosql.plugin.hive.metastore.SemiTransactionalHiveMetastore.getTable(SemiTransactionalHiveMetastore.java:153)
                at io.prestosql.plugin.hive.HiveMetadata.getView(HiveMetadata.java:1659)
                at io.prestosql.spi.connector.classloader.ClassLoaderSafeConnectorMetadata.getView(ClassLoaderSafeConnectorMetadata.java:442)
                at io.prestosql.metadata.MetadataManager.getView(MetadataManager.java:950)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.visitTable(StatementAnalyzer.java:879)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.visitTable(StatementAnalyzer.java:271)
                at io.prestosql.sql.tree.Table.accept(Table.java:53)
                at io.prestosql.sql.tree.AstVisitor.process(AstVisitor.java:27)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.process(StatementAnalyzer.java:286)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.analyzeFrom(StatementAnalyzer.java:1998)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.visitQuerySpecification(StatementAnalyzer.java:1091)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.visitQuerySpecification(StatementAnalyzer.java:271)
                at io.prestosql.sql.tree.QuerySpecification.accept(QuerySpecification.java:144)
                at io.prestosql.sql.tree.AstVisitor.process(AstVisitor.java:27)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.process(StatementAnalyzer.java:286)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.process(StatementAnalyzer.java:296)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.visitQuery(StatementAnalyzer.java:787)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.visitQuery(StatementAnalyzer.java:271)
                at io.prestosql.sql.tree.Query.accept(Query.java:107)
                at io.prestosql.sql.tree.AstVisitor.process(AstVisitor.java:27)
                at io.prestosql.sql.analyzer.StatementAnalyzer$Visitor.process(StatementAnalyzer.java:286)
                at io.prestosql.sql.analyzer.StatementAnalyzer.analyze(StatementAnalyzer.java:263)
                at io.prestosql.sql.analyzer.Analyzer.analyze(Analyzer.java:82)
                at io.prestosql.sql.analyzer.Analyzer.analyze(Analyzer.java:74)
                at io.prestosql.execution.SqlQueryExecution.analyze(SqlQueryExecution.java:218)
                at io.prestosql.execution.SqlQueryExecution.<init>(SqlQueryExecution.java:177)
                at io.prestosql.execution.SqlQueryExecution.<init>(SqlQueryExecution.java:94)
                at io.prestosql.execution.SqlQueryExecution$SqlQueryExecutionFactory.createQueryExecution(SqlQueryExecution.java:713)
                at io.prestosql.dispatcher.LocalDispatchQueryFactory.lambda$createDispatchQuery$0(LocalDispatchQueryFactory.java:118)
                at com.google.common.util.concurrent.TrustedListenableFutureTask$TrustedFutureInterruptibleTask.runInterruptibly(TrustedListenableFutureTask.java:125)
                at com.google.common.util.concurrent.InterruptibleTask.run(InterruptibleTask.java:57)
                at com.google.common.util.concurrent.TrustedListenableFutureTask.run(TrustedListenableFutureTask.java:78)
                at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
                at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
                at java.lang.Thread.run(Thread.java:748)
        Caused by: org.apache.hadoop.hive.metastore.api.MetaException: org.apache.hadoop.security.AccessControlException: Permission denied: user=service_user, access=EXECUTE, inode="/hive/userdbs/actual_user.db/test":actual_user:hadoop:drwxr-x---
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.check(FSPermissionChecker.java:353)
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkTraverse(FSPermissionChecker.java:292)
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:238)
                at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkDefaultEnforcer(RangerHdfsAuthorizer.java:428)
                at org.apache.ranger.authorization.hadoop.RangerHdfsAuthorizer$RangerAccessControlEnforcer.checkPermission(RangerHdfsAuthorizer.java:365)
                at org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkPermission(FSPermissionChecker.java:190)
                at org.apache.hadoop.hdfs.server.namenode.FSDirectory.checkPermission(FSDirectory.java:1956)
                at org.apache.hadoop.hdfs.server.namenode.FSDirStatAndListingOp.getFileInfo(FSDirStatAndListingOp.java:108)
                at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.getFileInfo(FSNamesystem.java:4142)
                at org.apache.hadoop.hdfs.server.namenode.NameNodeRpcServer.getFileInfo(NameNodeRpcServer.java:1137)
                at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolServerSideTranslatorPB.getFileInfo(ClientNamenodeProtocolServerSideTranslatorPB.java:866)
                at org.apache.hadoop.hdfs.protocol.proto.ClientNamenodeProtocolProtos$ClientNamenodeProtocol$2.callBlockingMethod(ClientNamenodeProtocolProtos.java)
                at org.apache.hadoop.ipc.ProtobufRpcEngine$Server$ProtoBufRpcInvoker.call(ProtobufRpcEngine.java:640)
                at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:982)
                at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:2351)
                at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:2347)
                at java.security.AccessController.doPrivileged(Native Method)
                at javax.security.auth.Subject.doAs(Subject.java:422)
                at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1866)
                at org.apache.hadoop.ipc.Server$Handler.run(Server.java:2347)

                at org.apache.hadoop.hive.metastore.api.ThriftHiveMetastore$get_table_result$get_table_resultStandardScheme.read(ThriftHiveMetastore.java)
                at org.apache.hadoop.hive.metastore.api.ThriftHiveMetastore$get_table_result$get_table_resultStandardScheme.read(ThriftHiveMetastore.java)
                at org.apache.hadoop.hive.metastore.api.ThriftHiveMetastore$get_table_result.read(ThriftHiveMetastore.java)
                at org.apache.thrift.TServiceClient.receiveBase(TServiceClient.java:86)
                at org.apache.hadoop.hive.metastore.api.ThriftHiveMetastore$Client.recv_get_table(ThriftHiveMetastore.java:1993)
                at org.apache.hadoop.hive.metastore.api.ThriftHiveMetastore$Client.get_table(ThriftHiveMetastore.java:1979)
                at io.prestosql.plugin.hive.metastore.thrift.ThriftHiveMetastoreClient.getTable(ThriftHiveMetastoreClient.java:159)
                at io.prestosql.plugin.hive.metastore.thrift.ThriftHiveMetastore.lambda$getTableFromMetastore$7(ThriftHiveMetastore.java:275)
                at io.prestosql.plugin.hive.metastore.thrift.ThriftHiveMetastore.alternativeCall(ThriftHiveMetastore.java:1394)
                at io.prestosql.plugin.hive.metastore.thrift.ThriftHiveMetastore.getTableFromMetastore(ThriftHiveMetastore.java:271)
                at io.prestosql.plugin.hive.metastore.thrift.ThriftHiveMetastore.lambda$getTable$4(ThriftHiveMetastore.java:250)
                at io.prestosql.plugin.hive.metastore.thrift.ThriftMetastoreApiStats.lambda$wrap$0(ThriftMetastoreApiStats.java:42)
                at io.prestosql.plugin.hive.util.RetryDriver.run(RetryDriver.java:130)
                at io.prestosql.plugin.hive.metastore.thrift.ThriftHiveMetastore.getTable(ThriftHiveMetastore.java:248)
                ... 62 more

`