Mailing-List: contact issues-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Date: Tue, 10 Jun 2014 13:45:04 +0000 (UTC)
From: "Liu Shaohui (JIRA)" <jira@apache.org>
To: issues@hbase.apache.org
Message-ID: <JIRA.12718622.1401973352049.101340.1402407904322@arcas>
In-Reply-To: <JIRA.12718622.1401973352049@arcas>
References: <JIRA.12718622.1401973352049@arcas>
Subject: [jira] [Commented] (HBASE-11300) Wrong permission check for
 checkAndPut in AccessController
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/HBASE-11300?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14026444#comment-14026444 ] 

Liu Shaohui commented on HBASE-11300:
-------------------------------------

Sorry for ignoring HBASE-11117.
Write permissions are checked in later prePut/Delete hook with Put/Delete mutation.

> Wrong permission check for checkAndPut in AccessController
> ----------------------------------------------------------
>
>                 Key: HBASE-11300
>                 URL: https://issues.apache.org/jira/browse/HBASE-11300
>             Project: HBase
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 0.99.0
>            Reporter: Liu Shaohui
>            Assignee: Liu Shaohui
>            Priority: Minor
>
> For the checkAndPut operation, the AccessController only checks the read and write permission for the family and qualifier to check, but ignores the write permission for the family map of "put". What's more,  we don't need the write permission for the family and qualifier to check.
> See the code AccessController.java #1538
> {code}
>     Map<byte[],? extends Collection<byte[]>> families = makeFamilyMap(family, qualifier);
>     User user = getActiveUser();
>     AuthResult authResult = permissionGranted(OpType.CHECK_AND_PUT, user, env, families,
>       Action.READ, Action.WRITE);
> {code}
> Same problem for checkAndDelete operation.


--
This message was sent by Atlassian JIRA
(v6.2#6252)