phoenix-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Karan Mehta (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (PHOENIX-4529) Users should only require RX access to SYSTEM.SEQUENCE table
Date Mon, 05 Feb 2018 20:27:00 GMT

    [ https://issues.apache.org/jira/browse/PHOENIX-4529?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16352887#comment-16352887
] 

Karan Mehta commented on PHOENIX-4529:
--------------------------------------

[~tdsilva] [~jamestaylor]
To write the rows in SYSTEM.SEQUENCE with the ACL's itself needs the permissions, either at
namespace or table level. Otherwise the first puts will be rejected directly. Either we do
it on the server side as login user or implement AccessController HBase class to accommodate
for this use case.
Once we have the rows in SYSTEM.SEQUENCE for a particular sequence, the ACL's can be easily
modified as required. Since the cell level ACL's are only limited to that version of the cell,
we need to limit the number of cell-versions to 1.

> Users should only require RX access to SYSTEM.SEQUENCE table
> ------------------------------------------------------------
>
>                 Key: PHOENIX-4529
>                 URL: https://issues.apache.org/jira/browse/PHOENIX-4529
>             Project: Phoenix
>          Issue Type: Bug
>            Reporter: Karan Mehta
>            Assignee: Thomas D'Silva
>            Priority: Major
>
> Currently, users don't need to have Write access to {{SYSTEM.CATALOG}} and other tables,
since the code is run on the server side as login user. However for {{SYSTEM.SEQUENCE}}, write
permission is still needed. This is a potential security concern, since it allows anyone to
modify the sequences created by others. This JIRA is to discuss how we can improve the security
of this table. 
> Potential options include
> 1. Usage of HBase Cell Level Permissions (works only with HFile version 3 and above)
> 2. AccessControl at Phoenix Layer by addition of user column in the {{SYSTEM.SEQUENCE}}
table and use it for access control (Can be error-prone for complex scenarios like sequence
sharing)
> Please advice.
> [~tdsilva] [~jamestaylor] [~apurtell] [~ankit@apache.org] [~elserj]



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message