Mailing-List: contact common-dev-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Date: Thu, 7 Sep 2017 06:43:01 +0000 (UTC)
From: "Sivaguru Sankaridurg (JIRA)" <jira@apache.org>
To: common-dev@hadoop.apache.org
Message-ID: <JIRA.13100372.1504766523000.46916.1504766581617@Atlassian.JIRA>
In-Reply-To: <JIRA.13100372.1504766523000@Atlassian.JIRA>
References: <JIRA.13100372.1504766523000@Atlassian.JIRA> <JIRA.13100372.1504766523306@jira-lw-us.apache.org>
Subject: [jira] [Created] (HADOOP-14845) getFileStatus not making any auth
 checks
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Thu, 07 Sep 2017 06:43:11 -0000

Sivaguru Sankaridurg created HADOOP-14845:
---------------------------------------------

             Summary: getFileStatus not making any auth checks
                 Key: HADOOP-14845
                 URL: https://issues.apache.org/jira/browse/HADOOP-14845
             Project: Hadoop Common
          Issue Type: Bug
          Components: fs/azure
            Reporter: Sivaguru Sankaridurg


The HDFS spec requires only traverse checks for any file accessed via getFi=
leStatus ... and since WASB does not support traverse checks, removing this=
 call effectively removed all protections for the getFileStatus call. The r=
easoning at that time was that doing a performAuthCheck was the wrong thing=
 to do, since it was going against the spec....and that the correct fix to =
the getFileStatus issue was to implement traverse checks rather than go aga=
inst the spec by calling performAuthCheck. The side-effects of such a chang=
e were not fully clear at that time, but the thinking was that it was safer=
 to remain true to the spec, as far as possible.
The reasoning remains correct even today. But in view of the security hole =
introduced by this change (that anyone can load up any other user's data in=
 hive), and keeping in mind that WASB does not intend to implement traverse=
 checks, we propose a compromise.
We propose (re)introducing a read-access check to getFileStatus(), that wou=
ld check the existing ancestor for read-access whenever invoked. Although n=
ot perfect (in that it is a departure from the spec), we believe that it is=
 a good compromise between having no checks at all; and implementing full-b=
lown traverse checks.
For scenarios that deal with intermediate folders like mkdirs, the call wou=
ld check for read access against an existing ancestor (when invoked from sh=
ell) for intermediate non-existent folders =E2=80=93 {{ mkdirs /foo/bar, wh=
ere only "/" exists, would result in read-checks against "/" for "/","/foo"=
 and "/foo/bar" }}. This can be thought of, as being a close-enough substit=
ute for the traverse checks that hdfs does.
For other scenarios that don't deal with non-existent intermediate folders =
=E2=80=93 like read, delete etc, the check will happen against the parent. =
Once again, we can think of the read-check against the parent as a substitu=
te for the traverse check, which can be customized for various users with r=
anger policies.


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-dev-help@hadoop.apache.org