Mailing-List: contact issues-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Date: Thu, 21 Jan 2016 04:02:39 +0000 (UTC)
From: "Matteo Bertozzi (JIRA)" <jira@apache.org>
To: issues@hbase.apache.org
Message-ID: <JIRA.12932961.1453345997000.166554.1453348959897@Atlassian.JIRA>
In-Reply-To: <JIRA.12932961.1453345997000@Atlassian.JIRA>
References: <JIRA.12932961.1453345997000@Atlassian.JIRA>
 <JIRA.12932961.1453345997855@arcas>
Subject: [jira] [Commented] (HBASE-15147) Shell should use
 Admin.listTableNames() instead of Admin.listTables()
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/HBASE-15147?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15110001#comment-15110001 ] 

Matteo Bertozzi commented on HBASE-15147:
-----------------------------------------

+1 on the list patch

{quote}We check for Table R or W, not CF I think{quote}
yeah, I was saying to change the check to for each HTD filter the information based on the user. If the user has not A or C, We can lookup from the acl cache which cfs the user can see and strip the HTD of all the information that the user is not supposed to see

> Shell should use Admin.listTableNames() instead of Admin.listTables() 
> ----------------------------------------------------------------------
>
>                 Key: HBASE-15147
>                 URL: https://issues.apache.org/jira/browse/HBASE-15147
>             Project: HBase
>          Issue Type: Bug
>            Reporter: Enis Soztutar
>            Assignee: Enis Soztutar
>             Fix For: 2.0.0, 1.2.0, 1.3.0, 1.1.4
>
>         Attachments: hbase-15147_v1.patch
>
>
> It seems that getTableDescriptors() in master checks for A and C permissions while getTableNames() checks for any privilege on the table. The reasoning is explained here: https://issues.apache.org/jira/browse/HBASE-12564?focusedCommentId=14234504&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-14234504 
> We should change the shell command for {{list}} to use the getTableNames() version because of this. Otherwise a user having only R or W cannot list the table name. 
> This has been reported from a user here: https://community.hortonworks.com/questions/10742/why-does-a-user-need-create-permission-for-list-co.html#comment-11000. 
> While we are at it, should we revisit the fact that you cannot get a table descriptor if you have only R or W? It seems strange that you cannot even know the CF names of a table that you can read from. I could not find info about the "describe" privileges on SQL databases. However, if there are use cases where Table descriptor might contain sensitive info, the current semantics seems fine. cc [~apurtell] and [~mbertozzi]. 


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)