[GitHub] [accumulo] dlmarion commented on issue #3010: Unable to get table configuration after #2994

[GitBox <gi...@apache.org>]

dlmarion commented on issue #3010:
URL: https://github.com/apache/accumulo/issues/3010#issuecomment-1272041559

   Looking at [this](https://github.com/apache/accumulo/blob/main/shell/src/main/java/org/apache/accumulo/shell/commands/ConfigCommand.java#L155) ConfigCommand in the Shell retrieves the Site, System, Namespace, and Table configurations to print out the table configuration. Also, looking at the list of permissions ALTER_NAMESPACE was missing for the root user on the default namespace and the accumulo namespace. We didn't add the ALTER_NAMESPACE permission in the tests for the default namespace in #2994, but I think I assume that the ALTER_NAMESPACE permission would be their for the accumulo namespace. 
   
   I added those permissions and things worked:
   ```
   root@accumulo-testing> grant Namespace.ALTER_NAMESPACE -ns "" -u root
   root@accumulo-testing> grant Namespace.ALTER_NAMESPACE -ns accumulo -u root
   root@accumulo-testing> config -t ci
   -----------+---------------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
   SCOPE      | NAME                                        | VALUE
   -----------+---------------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
   default    | table.balancer ............................ | org.apache.accumulo.core.spi.balancer.SimpleLoadBalancer
   ```
   
   I feel like two things should happen from this:
   
   1. The root user should get the ALTER_NAMESPACE permission (and maybe others) on the `accumulo` namespace.
   2. The logic for getting the different configuration information in ConfigCommand should be moved server-side. If we leave it in the Shell, then we need to back out the changes in #2994. However, if we leave it in the shell, then we are exposing information about the site and system configuration to *all* users.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@accumulo.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org