Apache
/
hbase
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HBASE-16724 Snapshot owner can't clone 

Signed-off-by: Ashish Singhi <ashishsinghi@apache.org>
This commit is contained in:
Pankaj Kumar 2016-10-13 17:20:52 +05:30 committed by Ashish Singhi
parent 90d83d5b38
commit c9c67d1a94
3 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
View File

@ -1341,7 +1341,16 @@ public class AccessController extends BaseMasterAndRegionObserver
public void preCloneSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx, public void preCloneSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor) final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor)
throws IOException { throws IOException {
requirePermission(getActiveUser(ctx), "cloneSnapshot " + snapshot.getName(), Action.ADMIN); User user = getActiveUser(ctx);
if (SnapshotDescriptionUtils.isSnapshotOwner(snapshot, user)
&& hTableDescriptor.getNameAsString().equals(snapshot.getTable())) {
// Snapshot owner is allowed to create a table with the same name as the snapshot he took
AuthResult result = AuthResult.allow("cloneSnapshot " + snapshot.getName(),
"Snapshot owner check allowed", user, null, hTableDescriptor.getTableName(), null);
logResult(result);
} else {
requirePermission(user, "cloneSnapshot " + snapshot.getName(), Action.ADMIN);
}
} }
@Override @Override

10
hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java
View File

@ -2124,15 +2124,13 @@ public class TestAccessController extends SecureTestUtil {
@Override @Override
public Object run() throws Exception { public Object run() throws Exception {
ACCESS_CONTROLLER.preCloneSnapshot(ObserverContext.createAndPrepare(CP_ENV, null), ACCESS_CONTROLLER.preCloneSnapshot(ObserverContext.createAndPrepare(CP_ENV, null),
snapshot, null); snapshot, htd);
return null; return null;
} }
}; };
// Clone by snapshot owner is not allowed , because clone operation creates a new table, verifyAllowed(cloneAction, SUPERUSER, USER_ADMIN, USER_GROUP_ADMIN, USER_OWNER);
// which needs global admin permission. verifyDenied(cloneAction, USER_CREATE, USER_RW, USER_RO, USER_NONE, USER_GROUP_READ,
verifyAllowed(cloneAction, SUPERUSER, USER_ADMIN, USER_GROUP_ADMIN); USER_GROUP_WRITE, USER_GROUP_CREATE);
verifyDenied(cloneAction, USER_CREATE, USER_RW, USER_RO, USER_NONE, USER_OWNER,
USER_GROUP_READ, USER_GROUP_WRITE, USER_GROUP_CREATE);
} }
@Test (timeout=180000) @Test (timeout=180000)

2
src/main/asciidoc/_chapters/appendix_acl_matrix.adoc
View File

@ -100,7 +100,7 @@ In case the table goes out of date, the unit tests which check for accuracy of p
| | stopMaster | superuser\|global(A) | | stopMaster | superuser\|global(A)
| | snapshot | superuser\|global(A)\|NS(A)\|TableOwner\|table(A) | | snapshot | superuser\|global(A)\|NS(A)\|TableOwner\|table(A)
| | listSnapshot | superuser\|global(A)\|SnapshotOwner | | listSnapshot | superuser\|global(A)\|SnapshotOwner
| | cloneSnapshot | superuser\|global(A) | | cloneSnapshot | superuser\|global(A)\|(SnapshotOwner & TableName matches)
| | restoreSnapshot | superuser\|global(A)\|SnapshotOwner & (NS(A)\|TableOwner\|table(A)) | | restoreSnapshot | superuser\|global(A)\|SnapshotOwner & (NS(A)\|TableOwner\|table(A))
| | deleteSnapshot | superuser\|global(A)\|SnapshotOwner | | deleteSnapshot | superuser\|global(A)\|SnapshotOwner
| | createNamespace | superuser\|global(A) | | createNamespace | superuser\|global(A)