hbase-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "stack (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HBASE-10322) Strip tags from KV while sending back to client on reads
Date Wed, 15 Jan 2014 01:02:21 GMT

    [ https://issues.apache.org/jira/browse/HBASE-10322?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13871455#comment-13871455
] 

stack commented on HBASE-10322:
-------------------------------

bq. 1. Send back tags in missing cases also. But sending back visibility expression/ cell
ACL is not correct.

This is tough.  The Visibility tags are managed by CPs.  When they are not present, you'd
like to not return them?  Are tags grouped?  Don't send back system tags?

bq. 2. Don't send back tags in any case. This will a problem when a tool like ExportTool use
the scan to export the table data. We will miss exporting the cell visibility/ACL.

Can we check perms of the client doing the export?  If they have access to 'system' tags,
export them?  We'd have a ACLCheckingCodec?

bq. 3. Send back tags based on some condition. It has to be per scan basis. Simplest way is
pass some kind of attribute in Scan which says whether to send back tags or not. But believing
some thing what scan specifies might not be correct IMO. Then comes the way of checking the
user who is doing the scan. When a HBase super user doing the scan then only send back tags.
So when a case comes like Export Tool's the execution should happen from a super user.

Should be super user or some super user-like group if they want tags; else they don't get
them?

> Strip tags from KV while sending back to client on reads
> --------------------------------------------------------
>
>                 Key: HBASE-10322
>                 URL: https://issues.apache.org/jira/browse/HBASE-10322
>             Project: HBase
>          Issue Type: Bug
>    Affects Versions: 0.98.0
>            Reporter: Anoop Sam John
>            Assignee: Anoop Sam John
>            Priority: Blocker
>             Fix For: 0.98.0, 0.99.0
>
>         Attachments: HBASE-10322.patch
>
>
> Right now we have some inconsistency wrt sending back tags on read. We do this in scan
when using Java client(Codec based cell block encoding). But during a Get operation or when
a pure PB based Scan comes we are not sending back the tags.  So any of the below fix we have
to do
> 1. Send back tags in missing cases also. But sending back visibility expression/ cell
ACL is not correct.
> 2. Don't send back tags in any case. This will a problem when a tool like ExportTool
use the scan to export the table data. We will miss exporting the cell visibility/ACL.
> 3. Send back tags based on some condition. It has to be per scan basis. Simplest way
is pass some kind of attribute in Scan which says whether to send back tags or not. But believing
some thing what scan specifies might not be correct IMO. Then comes the way of checking the
user who is doing the scan. When a HBase super user doing the scan then only send back tags.
So when a case comes like Export Tool's the execution should happen from a super user.
> So IMO we should go with #3.
> Patch coming soon.



--
This message was sent by Atlassian JIRA
(v6.1.5#6160)

Mime
View raw message