Apache
/
hbase
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HBASE-24345 [ACL] renameRSGroup should require Admin level permission (#1683) 

Signed-off-by: binlijin <binlijin@gmail.com>
Signed-off-by: Viraj Jasani <vjasani@apache.org>
This commit is contained in:
Reid Chan 2020-05-08 18:56:05 +08:00 committed by GitHub
parent 03e5a1402d
commit 0cd70ed89c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
View File

@ -2685,4 +2685,10 @@ public class AccessController implements MasterCoprocessor, RegionCoprocessor,
null, Permission.Action.ADMIN);
}
@Override
public void preRenameRSGroup(ObserverContext<MasterCoprocessorEnvironment> ctx, String oldName,
String newName) throws IOException {
accessChecker.requirePermission(getActiveUser(ctx), "renameRSGroup",
null, Permission.Action.ADMIN);
}
}

16
hbase-server/src/test/java/org/apache/hadoop/hbase/rsgroup/TestRSGroupsBase.java
View File

@ -331,6 +331,8 @@ public abstract class TestRSGroupsBase {
boolean postListTablesInRSGroupCalled = false;
boolean preGetConfiguredNamespacesAndTablesInRSGroupCalled = false;
boolean postGetConfiguredNamespacesAndTablesInRSGroupCalled = false;
boolean preRenameRSGroup = false;
boolean postRenameRSGroup = false;
public void resetFlags() {
preBalanceRSGroupCalled = false;
@ -361,6 +363,8 @@ public abstract class TestRSGroupsBase {
postListTablesInRSGroupCalled = false;
preGetConfiguredNamespacesAndTablesInRSGroupCalled = false;
postGetConfiguredNamespacesAndTablesInRSGroupCalled = false;
preRenameRSGroup = false;
postRenameRSGroup = false;
}
@Override
@ -523,5 +527,17 @@ public abstract class TestRSGroupsBase {
ObserverContext<MasterCoprocessorEnvironment> ctx, String groupName) throws IOException {
postGetConfiguredNamespacesAndTablesInRSGroupCalled = true;
}
@Override
public void preRenameRSGroup(ObserverContext<MasterCoprocessorEnvironment> ctx, String oldName,
String newName) throws IOException {
preRenameRSGroup = true;
}
@Override
public void postRenameRSGroup(ObserverContext<MasterCoprocessorEnvironment> ctx, String oldName,
String newName) throws IOException {
postRenameRSGroup = true;
}
}
}

10
hbase-server/src/test/java/org/apache/hadoop/hbase/rsgroup/TestRSGroupsWithACL.java
View File

@ -319,6 +319,16 @@ public class TestRSGroupsWithACL extends SecureTestUtil {
validateAdminPermissions(action);
}
@Test
public void testRenameRSGroup() throws Exception {
AccessTestAction action = () -> {
checkPermission("renameRSGroup");
return null;
};
validateAdminPermissions(action);
}
private void validateAdminPermissions(AccessTestAction action) throws Exception {
verifyAllowed(action, SUPERUSER, USER_ADMIN, USER_GROUP_ADMIN);
verifyDenied(action, USER_CREATE, USER_OWNER, USER_RW, USER_RO, USER_NONE, USER_GROUP_READ,