Mailing-List: contact user-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@zookeeper.apache.org
Date: Thu, 18 May 2017 13:42:21 +0000 (UTC)
From: joe smith <water4u99@yahoo.com.INVALID>
Reply-To: joe smith <water4u99@yahoo.com>
To: "user@zookeeper.apache.org" <user@zookeeper.apache.org>
Message-ID: <1789705161.736016.1495114941422@mail.yahoo.com>
In-Reply-To: <CAC==nPRKryO_0o9HNzPXKhGZODnfiA55HuXTaqbgBC+7mHZqGg@mail.gmail.com>
References: <1653547492.654737.1493728802170.ref@mail.yahoo.com> <1653547492.654737.1493728802170@mail.yahoo.com> <BLUPR14MB0259DDCB83AEF0F99BCB974EAE170@BLUPR14MB0259.namprd14.prod.outlook.com> <1359416476.1280034.1493760264577@mail.yahoo.com> <CAC==nPR13jwng=L1ptsfvdd4x4mcgb7haHFBC235eqvtowRcdw@mail.gmail.com> <CAKR25EQ+MmgeaYsAU+cLDxrz4XvyWthf39H4G=ffpE+MNjsSFQ@mail.gmail.com> <CAC==nPRKryO_0o9HNzPXKhGZODnfiA55HuXTaqbgBC+7mHZqGg@mail.gmail.com>
Subject: Re: Acl block detete not working
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_736015_34920198.1495114941418"
archived-at: Thu, 18 May 2017 13:42:43 -0000

------=_Part_736015_34920198.1495114941418
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Edward, Benjamin,
Thank you both for the clarification. =C2=A0I see where the confusion came =
from: READ/WRITE are on the node but CREATE/DELETE applies only to the node=
's children.
Thanks again for the help/input!
=20

    On Saturday, May 13, 2017 8:05 AM, Edward Ribeiro <edward.ribeiro@gmail=
.com> wrote:
=20

 Excuse me, should have looked first on docs. Interesting behaviour...


Thanks Ben!

Em 13 de mai de 2017 5:30 AM, "Benjamin Reed" <breed@apache.org> escreveu:

please check out
http://zookeeper.apache.org/doc/r3.5.3-beta/zookeeperProgram
mers.html#sc_ACLPermissions.
DELETE prevents deletion of children (like CREATE prevents the
creation of children). it does not prevent the deletion of the znode
itself.

ben

On Fri, May 12, 2017 at 10:53 PM, Edward Ribeiro
<edward.ribeiro@gmail.com> wrote:
> Hey, Joe and Martin,
>
> A quick explanation: the code Martin posted on the mailing list is the
> client side one. In those snippets the setACL is setting/changing the ACL
> so it needs to pass this in the call to the server: zk.setACL(path, acl,
> version). OTOH, the delete command doesn't need to pass the ACL
credentials
> because those are already stored in the corresponding znode (or its
parent)
> so it only needs to pass the path and version: zk.delete(path, version).
>
> What you really want to look at is here:
> https://github.com/apache/zookeeper/blob/branch-3.4/src/java
/main/org/apache/zookeeper/server/PrepRequestProcessor.java#L392
>
> See? The delete is checking the ACL of the parent znode, but not the znod=
e
> that we are trying to delete.
>
> Well, I opened a PR https://github.com/apache/zookeeper/pull/252 to see i=
f
> we can fix this.
>
> Best regards,
> Edward
>
>
>
>
>
>
> On Tue, May 2, 2017 at 6:24 PM, joe smith <water4u99@yahoo.com.invalid>
> wrote:
>
>> Hi Martin,
>> Thanks for the reply.=C2=A0 I've create a bug report:
>> https://issues.apache.org/jira/browse/ZOOKEEPER-2772
>> Regards,-j
>>
>>
>>=C2=A0 =C2=A0 On Tuesday, May 2, 2017 2:16 PM, Martin Gainty <mgainty@hot=
mail.com>
>> wrote:
>>
>>
>>=C2=A0 #yiv6303704777 #yiv6303704777 -- P {margin-top:0;margin-bottom:0;
>> }#yiv6303704777
>> From: joe smith <water4u99@yahoo.com.INVALID>
>> Sent: Tuesday, May 2, 2017 8:40 AM
>> To: user@zookeeper.apache.org
>> Subject: Acl block detete not working Hi,
>> I'm using 3.4.10 and setting custom aol to block deletion of a znode.
>> However, I'm able to delete the node even after I've set acl from cdrwa
to
>> crwa.
>> Can anyone point out if I missed some step.
>> Thanks for the help
>>
>> Here is the trace:
>> [zk: localhost:2181(CONNECTED) 0] ls /
>> [zookeeper]
>>
>> [zk: localhost:2181(CONNECTED) 1] create /test "data"Created /test
>>
>> [zk: localhost:2181(CONNECTED) 2] ls /[zookeeper, test]
>>
>> [zk: localhost:2181(CONNECTED) 3] addauth myfqdn localhost
>> [zk: localhost:2181(CONNECTED) 4] setAcl /test myfqdn:localhost:cracZxid
=3D
>> 0x2
>> ctime =3D Tue May 02 08:28:42 EDT 2017
>> mZxid =3D 0x2
>> mtime =3D Tue May 02 08:28:42 EDT 2017
>> pZxid =3D 0x2
>> cversion =3D 0
>> dataVersion =3D 0
>> aclVersion =3D 1
>> ephemeralOwner =3D 0x0
>> dataLength =3D 4
>> numChildren =3D 0
>>
>> MG>in SetAclCommand you can see the acl being parsed and acl being set b=
y
>> setAcl into zk object
>>=C2=A0 =C2=A0 List<ACL> acl =3D AclParser.parse(aclStr);=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 int version;
if
>> (cl.hasOption("v")) {=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 version =
=3D Integer.parseInt(cl.getOptionV
alue("v"));
>>=C2=A0 =C2=A0 =C2=A0 } else {=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ve=
rsion =3D -1;=C2=A0 =C2=A0 =C2=A0 =C2=A0 }=C2=A0 =C2=A0 =C2=A0 =C2=A0 try {
>> Stat stat =3D zk.setACL(path, acl, version);
>> MG>later on in DeleteCommand there is no check for aforementioned acl
>> parameter=C2=A0 public boolean exec() throws KeeperException,
>> InterruptedException {=C2=A0 =C2=A0 =C2=A0 =C2=A0 String path =3D args[1=
];=C2=A0 =C2=A0 =C2=A0 =C2=A0 int version;
>>=C2=A0 =C2=A0 if (cl.hasOption("v")) {=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 version =3D
Integer.parseInt(cl.getOptionValue("v"));
>>=C2=A0 =C2=A0 =C2=A0 } else {=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ve=
rsion =3D -1;=C2=A0 =C2=A0 =C2=A0 =C2=A0 }=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 try {
>>=C2=A0 zk.delete(path, version);=C2=A0 =C2=A0 =C2=A0 =C2=A0 } catch(Keepe=
rException.BadVersi
onException
>> ex) {=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 err.println(ex.getMessage=
());=C2=A0 =C2=A0 =C2=A0 =C2=A0 }=C2=A0 =C2=A0 =C2=A0 =C2=A0 return
false;
>> MG>as seen here the testCase works properly saving the Zookeeper object
>>=C2=A0 LsCommand entity =3D new LsCommand();=C2=A0 =C2=A0 =C2=A0 =C2=A0 e=
ntity.setZk(zk);
>>
>> MG>but setACL does not save the zookeeper object anywhere but instead
>> seems to discard zookeeper object with accompanying ACLsMG>can you repor=
t
>> this bug to Zookeeper?
>> https://issues.apache.org/jira/browse/ZOOKEEPER/?
>> selectedTab=3Dcom.atlassian.jira.jira-projects-plugin:summary-panel
>>
>> | ZooKeeper - ASF JIRA - issues.apache.orgissues.apache.orgApache
>> ZooKeeper is a service for coordinating processes of distributed
>> applications. Versions: Unreleased. Name Release date; Unreleased 3.2.3 =
:
>> Unreleased 3.3.7 |
>>
>> MG>Thanks Joe!
>>
>> [zk: localhost:2181(CONNECTED) 5] getAcl /test'myfqdn,'localhost
>> : cra
>>
>> [zk: localhost:2181(CONNECTED) 6] get /testdata
>> cZxid =3D 0x2
>> ctime =3D Tue May 02 08:28:42 EDT 2017
>> mZxid =3D 0x2
>> mtime =3D Tue May 02 08:28:42 EDT 2017
>> pZxid =3D 0x2
>> cversion =3D 0
>> dataVersion =3D 0
>> aclVersion =3D 1
>> ephemeralOwner =3D 0x0
>> dataLength =3D 4
>> numChildren =3D 0
>>
>> [zk: localhost:2181(CONNECTED) 7] set /test "testwrite"Authentication is
>> not valid : /test
>>
>> [zk: localhost:2181(CONNECTED) 8] delete /test
>> [zk: localhost:2181(CONNECTED) 9] ls /[zookeeper]
>>
>> [zk: localhost:2181(CONNECTED) 10]
>> The auth provider imple is here: http://s000.tinyupload.com/?
>> file_id=3D42827186839577179157
>> | TinyUpload.com - best file hosting solution, with no limits, totaly
>> frees000.tinyupload.comTinyUpload.com - solution for tiny file hosting.
>> No download limits, no upload limit. Totaly free. |
>>
>>
>>
>>
>>
>>
>>
>> |=C2=A0 |
>>
>>
>>
>>
>>


  =20
------=_Part_736015_34920198.1495114941418--