hbase-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From abhishek kr <abhishek...@huawei.com>
Subject RE: CreateTableHandler: postCreateTableHanler coprocessor runs as RemoteRpcUser privileged action.
Date Tue, 05 May 2015 05:42:35 GMT
sure, created JIRA HBASE-13619.


-----Original Message-----
From: Andrew Purtell [mailto:apurtell@apache.org] 
Sent: 04 May 2015 22:41
To: dev@hbase.apache.org
Subject: Re: CreateTableHandler: postCreateTableHanler coprocessor runs as RemoteRpcUser privileged

I think at this point we can't change the behavior, that would be a regression. Could be better
documented. We can include advice on using User.runAsLoginUser.
Would you like to file an issue for the documentation improvement?

On Mon, May 4, 2015 at 5:14 AM, abhishek kr <abhishek.kr@huawei.com> wrote:

> Hi,
> We have a custom written coprocessor for CreateTableHandler which does 
> some hdfs related stuff in postCreateTableHandler, and it was working 
> fine till HBASE-11886 got merged. It seems that post HBASE-11886 
> merge, our coprocessor code is getting executed with remote rpc user 
> privileges instead of master privileges:
> //  --START--
>     this.activeUser.runAs(new PrivilegedExceptionAction<Void>() {
>           @Override
>           public Void run() throws Exception {
>             cpHost.postCreateTableHandler(hTableDescriptor, newRegions);
>             return null;
>           }
>         });
> // --END--
> As per HBASE-11886,  these changes were done to handle table ACL 
> related issue ,  however it does this by reducing the default 
> privileges coprocessor runs under.
> We can get around this by using User.runAsLoginUser in our coprocessor 
> code but I think  by default coprocessors should continue to run with 
> master/region server identity and HBASE-11886 can be handled in some 
> other way, for example using InheritedThreadLocal for RequestContext, 
> as suggested in comments by Anoop in HBASE-11886,  pls let us know ur 
> views on this, thanks.
> Regards,
> Abhishek

Best regards,

   - Andy

Problems worthy of attack prove their worth by hitting back. - Piet Hein (via Tom White)
View raw message