hbase-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Marcelo Vanzin (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HBASE-6386) Audit log messages do not include column family / qualifier information consistently
Date Thu, 23 Aug 2012 01:42:42 GMT

    [ https://issues.apache.org/jira/browse/HBASE-6386?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13439995#comment-13439995
] 

Marcelo Vanzin commented on HBASE-6386:
---------------------------------------

With my current patch that information is lost. That's a tricky case, because since the code
bails out at the first offense, you don't know if any of the other families would also cause
a permission error. There's also no good way to convey that in a single audit message; an
option would be to create one audit message per column family / qualifier, at the expense
of more overhead and more noise in the logs.

If that's a problem I can revert that particular portion of the patch.
                
> Audit log messages do not include column family / qualifier information consistently
> ------------------------------------------------------------------------------------
>
>                 Key: HBASE-6386
>                 URL: https://issues.apache.org/jira/browse/HBASE-6386
>             Project: HBase
>          Issue Type: Improvement
>          Components: security
>    Affects Versions: 0.96.0
>            Reporter: Marcelo Vanzin
>         Attachments: hbase-6386-v1.patch
>
>
> The code related to this issue is in AccessController.java:permissionGranted().
> When creating audit logs, that method will do one of the following:
> * grant access, create audit log with table name only
> * deny access because of table permission, create audit log with table name only
> * deny access because of column family / qualifier permission, create audit log with
specific family / qualifier
> So, in the case where more than one column family and/or qualifier are in the same request,
there will be a loss of information. Even in the case where only one column family and/or
qualifier is involved, information may be lost.
> It would be better if this behavior consistently included all the information in the
request; regardless of access being granted or denied, and regardless which permission caused
the denial, the column family and qualifier info should be part of the audit log message.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

        

Mime
View raw message