Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Date: Tue, 3 Oct 2017 09:26:01 +0000 (UTC)
From: "Steve Loughran (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: <JIRA.13100372.1504766523000.258945.1507022761812@Atlassian.JIRA>
In-Reply-To: <JIRA.13100372.1504766523000@Atlassian.JIRA>
References: <JIRA.13100372.1504766523000@Atlassian.JIRA> <JIRA.13100372.1504766523306@jira-lw-us.apache.org>
Subject: [jira] [Commented] (HADOOP-14845) Azure wasb: getFileStatus not
 making any auth checks
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Tue, 03 Oct 2017 09:26:09 -0000


    [ https://issues.apache.org/jira/browse/HADOOP-14845?page=3Dcom.atlassi=
an.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D16=
189447#comment-16189447 ]=20

Steve Loughran commented on HADOOP-14845:
-----------------------------------------

thanks. I've been doing some merge work internally too...its combination of=
 the (welcome) cleanup work in the other patch & the move to parallel test =
runs & needing to rename all tests against live endpoints ITest*.

> Azure wasb: getFileStatus not making any auth checks
> ----------------------------------------------------
>
>                 Key: HADOOP-14845
>                 URL: https://issues.apache.org/jira/browse/HADOOP-14845
>             Project: Hadoop Common
>          Issue Type: Sub-task
>          Components: fs/azure, security
>    Affects Versions: 2.8.0, 2.7.4
>            Reporter: Sivaguru Sankaridurg
>            Assignee: Sivaguru Sankaridurg
>              Labels: azure, fs, secure, wasb
>             Fix For: 2.9.0
>
>         Attachments: HADOOP-14845.001.patch, HADOOP-14845.002.patch, HADO=
OP-14845.003.patch, HADOOP-14845-branch-2-001.patch.txt, HADOOP-14845-branc=
h-2-002.patch, HADOOP-14845-branch-2-003.patch
>
>
> The HDFS spec requires only traverse checks for any file accessed via get=
FileStatus ... and since WASB does not support traverse checks, removing th=
is call effectively removed all protections for the getFileStatus call. The=
 reasoning at that time was that doing a performAuthCheck was the wrong thi=
ng to do, since it was going against the spec....and that the correct fix t=
o the getFileStatus issue was to implement traverse checks rather than go a=
gainst the spec by calling performAuthCheck. The side-effects of such a cha=
nge were not fully clear at that time, but the thinking was that it was saf=
er to remain true to the spec, as far as possible.
> The reasoning remains correct even today. But in view of the security hol=
e introduced by this change (that anyone can load up any other user's data =
in hive), and keeping in mind that WASB does not intend to implement traver=
se checks, we propose a compromise.
> We propose (re)introducing a read-access check to getFileStatus(), that w=
ould check the existing ancestor for read-access whenever invoked. Although=
 not perfect (in that it is a departure from the spec), we believe that it =
is a good compromise between having no checks at all; and implementing full=
-blown traverse checks.
> For scenarios that deal with intermediate folders like mkdirs, the call w=
ould check for read access against an existing ancestor (when invoked from =
shell) for intermediate non-existent folders =E2=80=93 {{ mkdirs /foo/bar, =
where only "/" exists, would result in read-checks against "/" for "/","/fo=
o" and "/foo/bar" }}. This can be thought of, as being a close-enough subst=
itute for the traverse checks that hdfs does.
> For other scenarios that don't deal with non-existent intermediate folder=
s =E2=80=93 like read, delete etc, the check will happen against the parent=
. Once again, we can think of the read-check against the parent as a substi=
tute for the traverse check, which can be customized for various users with=
 ranger policies.


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org