hbase-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Sean Busbey (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HBASE-12823) Visibility label security at limited localized level
Date Thu, 15 Jan 2015 03:10:34 GMT

    [ https://issues.apache.org/jira/browse/HBASE-12823?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14278175#comment-14278175

Sean Busbey commented on HBASE-12823:

You might have cases where someone has A/C but not R on a table (like a DBA who can tune parameters
on the table but isn't allowed to actually inspect the data). In practice I haven't seen this
very often in key/value store deployments.

If we're going to allow someone with table-level A to bypass visibility protections in that
table, then we need a way to force enforcement at the global level. My knee-jerk reaction
is that someone with table level alter (and not global) should definitely not be able to bypass
visibility protection, but I think if end users can effectively opt-out of table/cf level
configuration then it's fine to have it as an option.

> Visibility label security at limited localized level
> ----------------------------------------------------
>                 Key: HBASE-12823
>                 URL: https://issues.apache.org/jira/browse/HBASE-12823
>             Project: HBase
>          Issue Type: Improvement
>          Components: security
>    Affects Versions: 1.0.0, 2.0.0, 0.98.10
>            Reporter: Jerry He
>             Fix For: 2.0.0
> Currently, if visibility label security is enabled for a HBase instance, after VisibilityController
is configured, the cell level visibility label filtering will kick in across the HBase instance.
> Cell level visibility label filtering has non-negligible performance impact.
> On the other hand, in many use cases, only a small portion of the overall data needs
visibility label protection.
> If we can support  visibility label security at a limited and localized level, we will
broaden the use cases and the adoption of this feature.
> We should be able to support visibility label security at per table or per column family
level. This is quite common in many other HBase features.
> Cell level visibility label filtering will only be enabled and kick in for the tables
or column families that the user designates.

This message was sent by Atlassian JIRA

View raw message