Mailing-List: contact dev-help@kafka.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@kafka.apache.org
From: Flavio Junqueira <fpj@apache.org>
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_5B481778-017E-4F57-8D6D-182D4F8EC349"
Message-Id: <4E068D8C-1C24-44D1-9A5A-B828980FFDA0@apache.org>
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\))
Subject: Re: ZkSecurityMigrator incorrectly applies ACLs to entire ZooKeeper
 tree?
Date: Wed, 6 Jan 2016 09:34:39 +0000
References: <B12145DB897A714485B50E25C54F0C88013A4AB399@XMB101ACNC.rim.net>
To: dev@kafka.apache.org
In-Reply-To: <B12145DB897A714485B50E25C54F0C88013A4AB399@XMB101ACNC.rim.net>

--Apple-Mail=_5B481778-017E-4F57-8D6D-182D4F8EC349
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Hi Matthew,

If you're sharing a ZK ensemble and you have a specific path for the =
Kafka znodes, then you need to use a chroot for this. Just pass it along =
with the connect string:

=
http://zookeeper.apache.org/doc/r3.4.6/zookeeperProgrammers.html#ch_zkSess=
ions =
<http://zookeeper.apache.org/doc/r3.4.6/zookeeperProgrammers.html#ch_zkSes=
sions>

If we don't protected the root of the Kafka sub-tree, then an =
unauthorized user will be able to delete child nodes under the sub-tree =
root:

=
http://zookeeper.apache.org/doc/r3.4.6/zookeeperProgrammers.html#sc_ACLPer=
missions =
<http://zookeeper.apache.org/doc/r3.4.6/zookeeperProgrammers.html#sc_ACLPe=
rmissions>

-Flavio

> On 05 Jan 2016, at 21:09, Matthew Bruce <mbruce@blackberry.com> wrote:
>=20
> Hi,
>=20
> I'm running through some 0.8.2 to 0.9.0 upgrade testing that involves =
moving to a secured cluster - While running the =
zookeeper-security-migration.sh script, I noticed that it modifies ACLs =
for non-Kafka specific znodes/trees also.
>=20
> Looking at the code it seems like the intention is to only set the =
ACLs on specific branches, but then it recursively applies them to all =
of '/' anyway:
>=20
> private def run(): Unit =3D {
>     try {
>           for (path <- zkUtils.securePersistentZkPaths) {
>                debug("Going to set ACL for %s".format(path))
>                zkUtils.makeSurePersistentPathExists(path)
>           }
>     setAclsRecursively("/")
>     .
>     .
>     .
>=20
>=20
> Am I missing something here, or should the setAclsRecursively call be =
moved into the loop and be called against each specific path?
>=20
> Thanks,
> Matthew Bruce
> mbruce@blackbery.com


--Apple-Mail=_5B481778-017E-4F57-8D6D-182D4F8EC349--