hbase-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Matteo Bertozzi (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (HBASE-14347) Add a switch to DynamicClassLoader to disable it and make that the default
Date Fri, 02 Oct 2015 17:01:26 GMT

    [ https://issues.apache.org/jira/browse/HBASE-14347?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14941392#comment-14941392

Matteo Bertozzi commented on HBASE-14347:

[~esteban] in theory we are already supposed to do the "remote" load. the problem is the code
that copies those "remote" locally. I think that was done because it was the easy way to load
the class form remote since you have the friendly API that loads the class by using addUrl()
where url is expected to be something that java understand and hdfs is not.

Looking at the classLoader API there is a defineClass() that takes an array of bytes. In theory
we can leverage that to open the hdfs stream (the jar we want to load) and add the class to
our class loader and avoid the copy-to-local step. In that way we can get even rid of the
tmp dir.
I'll let [~huaxiang] look into that, if it is something possible or not.

> Add a switch to DynamicClassLoader to disable it and make that the default
> --------------------------------------------------------------------------
>                 Key: HBASE-14347
>                 URL: https://issues.apache.org/jira/browse/HBASE-14347
>             Project: HBase
>          Issue Type: Bug
>          Components: Client, defaults, regionserver
>    Affects Versions: 2.0.0, 1.2.0, 1.1.2, 0.98.15, 1.0.3
>            Reporter: Esteban Gutierrez
>            Assignee: huaxiang sun
>         Attachments: HBASE-14347-v001.patch
> Since HBASE-1936 we have the option to load jars dynamically by default from HDFS or
the local filesystem, however hbase.dynamic.jars.dir points to a directory that could be world
writable it potentially opens a security problem in both the client side and the RS. We should
consider to have a switch to enable or disable this option and it should be off by default.

This message was sent by Atlassian JIRA

View raw message