hbase-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From abhishek kr <abhishek...@huawei.com>
Subject RE: CreateTableHandler: postCreateTableHanler coprocessor runs as RemoteRpcUser privileged action.
Date Tue, 05 May 2015 05:42:35 GMT
sure, created JIRA HBASE-13619.

Regards,
Abhishek

-----Original Message-----
From: Andrew Purtell [mailto:apurtell@apache.org] 
Sent: 04 May 2015 22:41
To: dev@hbase.apache.org
Subject: Re: CreateTableHandler: postCreateTableHanler coprocessor runs as RemoteRpcUser privileged
action.

I think at this point we can't change the behavior, that would be a regression. Could be better
documented. We can include advice on using User.runAsLoginUser.
Would you like to file an issue for the documentation improvement?


On Mon, May 4, 2015 at 5:14 AM, abhishek kr <abhishek.kr@huawei.com> wrote:

> Hi,
> We have a custom written coprocessor for CreateTableHandler which does 
> some hdfs related stuff in postCreateTableHandler, and it was working 
> fine till HBASE-11886 got merged. It seems that post HBASE-11886 
> merge, our coprocessor code is getting executed with remote rpc user 
> privileges instead of master privileges:
> //  --START--
>     this.activeUser.runAs(new PrivilegedExceptionAction<Void>() {
>           @Override
>           public Void run() throws Exception {
>             cpHost.postCreateTableHandler(hTableDescriptor, newRegions);
>             return null;
>           }
>         });
> // --END--
>
> As per HBASE-11886,  these changes were done to handle table ACL 
> related issue ,  however it does this by reducing the default 
> privileges coprocessor runs under.
> We can get around this by using User.runAsLoginUser in our coprocessor 
> code but I think  by default coprocessors should continue to run with 
> master/region server identity and HBASE-11886 can be handled in some 
> other way, for example using InheritedThreadLocal for RequestContext, 
> as suggested in comments by Anoop in HBASE-11886,  pls let us know ur 
> views on this, thanks.
>
>
> Regards,
> Abhishek
>
>


--
Best regards,

   - Andy

Problems worthy of attack prove their worth by hitting back. - Piet Hein (via Tom White)
Mime
View raw message