protected void addEntities(String functionName, String className, boolean isTemporary,
      List<ResourceUri> resources) throws SemanticException {
    // If the function is being added under a database 'namespace', then add an entity representing
    // the database (only applicable to permanent/metastore functions).
    // We also add a second entity representing the function name.
    // The authorization api implementation can decide which entities it wants to use to
    // authorize the create/drop function call.

    // Add the relevant database 'namespace' as a WriteEntity
    Database database = null;

    // temporary functions don't have any database 'namespace' associated with it
    if (!isTemporary) {
      try {
        String[] qualifiedNameParts = FunctionUtils.getQualifiedFunctionNameParts(functionName);
        String databaseName = qualifiedNameParts[0];
        functionName = qualifiedNameParts[1];
        database = getDatabase(databaseName);
      } catch (HiveException e) {
        LOG.error("Failed to get database ", e);
        throw new SemanticException(e);
      }
    }
    if (database != null) {
      inputs.add(new ReadEntity(database));
      // Add the permanent function as a WriteEntity
      Function function;
      if (queryState.getHiveOperation().equals(HiveOperation.CREATEFUNCTION)) {
        function = new Function(functionName, database.getName(), className,
                SessionState.getUserFromAuthenticator(), PrincipalType.USER,
                (int) (System.currentTimeMillis() / 1000), FunctionType.JAVA, resources);
      } else {
        try {
          function = db.getFunction(database.getName(), functionName);
        } catch (HiveException e) {
          throw new RuntimeException(e);
        }
      }
      outputs.add(new WriteEntity(function, WriteEntity.WriteType.DDL_NO_LOCK));
    } else { // Temporary functions
      outputs.add(new WriteEntity(database, functionName, className, Type.FUNCTION, WriteEntity.WriteType.DDL_NO_LOCK));
    }

    if (resources != null) {
      for (ResourceUri resource : resources) {
        String uriPath = resource.getUri();
        outputs.add(toWriteEntity(uriPath));
      }
    }
  }
Add write entities to the semantic analyzer to restrict function creation to privileged users.
ql/src/java/org/apache/hadoop/hive/ql/ddl/function/AbstractFunctionAnalyzer.java