Mailing-List: contact hdfs-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: hdfs-issues@hadoop.apache.org
Date: Tue, 11 Feb 2014 21:55:19 +0000 (UTC)
From: "Haohui Mai (JIRA)" <jira@apache.org>
To: hdfs-issues@hadoop.apache.org
Message-ID: <JIRA.12694410.1392085292006.26648.1392155719939@arcas>
In-Reply-To: <JIRA.12694410.1392085292006@arcas>
References: <JIRA.12694410.1392085292006@arcas>
Subject: [jira] [Commented] (HDFS-5923) Do not persist the ACL bit in the
 FsPermission
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/HDFS-5923?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13898370#comment-13898370 ] 

Haohui Mai commented on HDFS-5923:
----------------------------------

The v0 patch takes a more aggressive approach, which removes the ACL bit completely. The rationale is the following:

# Some applications might assume that {{FsPermission}} stay within the range of 0~0777. Changing {{FsPermission}} might lead to unexpected issues.
# There are not many users care about whether the file has ACL except for ls. Since ls is not in the critical path, ls can make a separate {{getAclStatus()}} call to calculate the ACL bit.

> Do not persist the ACL bit in the FsPermission
> ----------------------------------------------
>
>                 Key: HDFS-5923
>                 URL: https://issues.apache.org/jira/browse/HDFS-5923
>             Project: Hadoop HDFS
>          Issue Type: Sub-task
>          Components: hdfs-client, namenode, security
>            Reporter: Haohui Mai
>            Assignee: Haohui Mai
>         Attachments: HDFS-5923.000.patch
>
>
> The current implementation persists and ACL bit in FSImage and editlogs. Moreover, the security decisions also depend on whether the bit is set.
> The problem here is that we have to maintain the implicit invariant, which is the ACL bit is set if and only if the the inode has AclFeature. The invariant has to be maintained everywhere otherwise it can lead to a security vulnerability. In the worst case, an attacker can toggle the bit and bypass the ACL checks.
> The jira proposes to treat the ACL bit as a transient bit. The bit should not be persisted onto the disk, neither it should affect any security decisions.


--
This message was sent by Atlassian JIRA
(v6.1.5#6160)