Mailing-List: contact user-help@accumulo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@accumulo.apache.org
Received-SPF: pass (athena.apache.org: domain of tallirishllama@gmail.com
 designates 209.85.192.43 as permitted sender)
Message-ID: <53EEAFB5.4050104@gmail.com>
Date: Fri, 15 Aug 2014 18:11:17 -0700
From: Sean Hickey <tallirishllama@gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.0
MIME-Version: 1.0
To: user@accumulo.apache.org
Subject: Re: 1.6.0: Namespace.CREATE_TABLE not enforced?
References: 
 <CANgnf8OEmVJRFLp5frCVyabi-+v_kXvVM6Td7G_SnoLSasMBXg@mail.gmail.com>
 <53EEAAFE.9040601@gmail.com>
In-Reply-To: <53EEAAFE.9040601@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Yep, I think Josh is correct. System permissions override Namespace
permissions (so giving them System.CREATE_TABLE lets them create
tables in any namespace) and Namespace permissions override any
individual Table permissions. (at least that's how I implemented it
originally, I don't think the permissions model would've changed much
since then).

Sean

On 08/15/2014 05:51 PM, Josh Elser wrote:
> Looking at this, I'm guessing that System.CREATE_TABLE is
> overriding any permissions on the namespace 'foo'.
> 
> Because 'user' has the ability to create tables at the System
> level, I'm guessing it trumps the lack of CREATE_TABLE for user on
> that namespace.
> 
> Disclaimer: I haven't looked at the code to back up that guess.
> 
> On 8/15/14, 8:35 PM, Matthew Dailey wrote:
>> From a clean Accumulo 1.6.0 install, I created a new user, gave
>> them System.CREATE_TABLE, and created a new namespace, but did
>> not give that user any permissions to that namespace.  However, I
>> was then able to create a table under that namespace as the new
>> user.
>> 
>> Is there some default openness for namespaces?  My use case is
>> having a user able to make sandbox tables within their own
>> personal namespace.
>> 
>> Thanks, Matt
>> 
>> P.S.  Command dump follows:
>> 
>> root@accumulo> createuser user root@accumulo> grant -u user -s
>> System.CREATE_TABLE root@accumulo> createnamespace foo 
>> root@accumulo> user user
>> 
>> user@accumulo> createtable foo.bar user@accumulo foo.bar> insert
>> a b c d user@accumulo foo.bar> scan a b:c []    d user@accumulo
>> foo.bar> userpermissions System permissions: System.CREATE_TABLE
>> 
>> Namespace permissions (accumulo): Namespace.READ
>> 
>> Table permissions (accumulo.metadata): Table.READ Table
>> permissions (accumulo.root): Table.READ Table permissions
>> (foo.bar): Table.READ, Table.WRITE, Table.BULK_IMPORT, 
>> Table.ALTER_TABLE, Table.GRANT, Table.DROP_TABLE user@accumulo
>> foo.bar>