You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hbase.apache.org by "Lars Hofhansl (JIRA)" <ji...@apache.org> on 2011/08/27 06:40:29 UTC
[jira] [Created] (HBASE-4263) Prevent RegionObservers from
interfering with system tables.
Prevent RegionObservers from interfering with system tables.
------------------------------------------------------------
Key: HBASE-4263
URL: https://issues.apache.org/jira/browse/HBASE-4263
Project: HBase
Issue Type: Bug
Components: coprocessors
Affects Versions: 0.92.0
Reporter: Lars Hofhansl
Priority: Minor
Fix For: 0.92.0
It turns out that a RegionObserver can interfere with -ROOT- and .META.
That seems weird and should be prevented.
(The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly string use case).
I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Hudson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13095199#comment-13095199 ]
Hudson commented on HBASE-4263:
-------------------------------
Integrated in HBase-TRUNK #2168 (See [https://builds.apache.org/job/HBase-TRUNK/2168/])
HBASE-4263 New config property for user-table only RegionObservers
stack :
Files :
* /hbase/trunk/CHANGES.txt
* /hbase/trunk/src/main/java/org/apache/hadoop/hbase/coprocessor/CoprocessorHost.java
* /hbase/trunk/src/main/java/org/apache/hadoop/hbase/regionserver/RegionCoprocessorHost.java
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Assignee: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HBASE-4263) Prevent RegionObservers from
interfering with system tables.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lars Hofhansl updated HBASE-4263:
---------------------------------
Description:
It turns out that a RegionObserver can interfere with - ROOT - and .META.
That seems weird and should be prevented.
(The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
I'll attach a patch as soon as I get to it.
was:
It turns out that a RegionObserver can interfere with - ROOT - and .META.
That seems weird and should be prevented.
(The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly string use case).
I'll attach a patch as soon as I get to it.
> Prevent RegionObservers from interfering with system tables.
> ------------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092305#comment-13092305 ]
Lars Hofhansl commented on HBASE-4263:
--------------------------------------
So just to sure, you are against another config option for user-table only region observers?
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lars Hofhansl updated HBASE-4263:
---------------------------------
Issue Type: Improvement (was: Bug)
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13093088#comment-13093088 ]
Lars Hofhansl commented on HBASE-4263:
--------------------------------------
I picked hbase.coprocessor.user.region.classes in analogy to the existing hbase.coprocessor.region.classes and because the RegionObservers are loaded per region.
hbase.coprocessor.user.table.classes works too and might be easier to understand.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Assigned] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lars Hofhansl reassigned HBASE-4263:
------------------------------------
Assignee: Lars Hofhansl
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Assignee: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Andrew Purtell (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092222#comment-13092222 ]
Andrew Purtell commented on HBASE-4263:
---------------------------------------
Security is a strong use case, end of story.
I'm -1 on this issue, it should be resolved as invalid.
Otherwise we don't have RegionObservers, we have SometimesRegionObservers, or NotUsefulToTheContributorsOfCoprocessorsRegionObservers.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "stack (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13095129#comment-13095129 ]
stack commented on HBASE-4263:
------------------------------
@Lars Just waiting for Andrew's take after a few above argue the patch reasonable.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Assignee: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "stack (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13093072#comment-13093072 ]
stack commented on HBASE-4263:
------------------------------
Patch looks innocuous to me. Seems reasonable having a catalog/user -space divide.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Ted Yu (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13093077#comment-13093077 ]
Ted Yu commented on HBASE-4263:
-------------------------------
Would hbase.coprocessor.user.table.classes be a better name for this new config ?
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HBASE-4263) Prevent RegionObservers from
interfering with system tables.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lars Hofhansl updated HBASE-4263:
---------------------------------
Description:
It turns out that a RegionObserver can interfere with - ROOT - and .META.
That seems weird and should be prevented.
(The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly string use case).
I'll attach a patch as soon as I get to it.
was:
It turns out that a RegionObserver can interfere with {noformat}-ROOT-{noformat} and .META.
That seems weird and should be prevented.
(The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly string use case).
I'll attach a patch as soon as I get to it.
> Prevent RegionObservers from interfering with system tables.
> ------------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly string use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13093302#comment-13093302 ]
Lars Hofhansl commented on HBASE-4263:
--------------------------------------
Thanks Gary.
"a short-cut to enabling a coprocessor per-table on each user table"... That exactly what we're going to use it for.
I also agree or the too-many-options-are-confusing bit.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HBASE-4263) Prevent RegionObservers from
interfering with system tables.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lars Hofhansl updated HBASE-4263:
---------------------------------
Description:
It turns out that a RegionObserver can interfere with {noformat}-ROOT-{noformat} and .META.
That seems weird and should be prevented.
(The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly string use case).
I'll attach a patch as soon as I get to it.
was:
It turns out that a RegionObserver can interfere with -ROOT- and .META.
That seems weird and should be prevented.
(The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly string use case).
I'll attach a patch as soon as I get to it.
> Prevent RegionObservers from interfering with system tables.
> ------------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with {noformat}-ROOT-{noformat} and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly string use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Andrew Purtell (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092224#comment-13092224 ]
Andrew Purtell commented on HBASE-4263:
---------------------------------------
Apologies for the double post. A cab ride in Taipei can cause key jitter. :-)
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "stack (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
stack resolved HBASE-4263.
--------------------------
Resolution: Fixed
Hadoop Flags: [Reviewed]
Committed to TRUNK.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Assignee: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) Prevent RegionObservers from
interfering with system tables.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092199#comment-13092199 ]
Lars Hofhansl commented on HBASE-4263:
--------------------------------------
Gary points out on the mailing list that access control *is* an important use case for coprocessors on ROOT and META and we should not unduly cripple coprocessors.
So the question is should system coprocessor (at least RegionObservers) be loaded for the system tables.
> Prevent RegionObservers from interfering with system tables.
> ------------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Andrew Purtell (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092231#comment-13092231 ]
Andrew Purtell commented on HBASE-4263:
---------------------------------------
Coprocessors in architecture and implementation are exactly like loadable kernel modules. I think this moots considerations for restricting them.
We did discuss code weaving in security policy earlier, but I'm not sure how fruitful pursuing that would be, given the complexity involved and the murky assurance that would be the result.
We can distinguish between external and internal coprocessors with HBASE-4047. If you want to pursue a direction where coprocessors can meaningfully be treated with some suspicion or restriction, adding security policies for "external" coprocessors makes sense. How policy is implemented there should be pluggable and stackable. It should be possible to supply a basic set of options for users, and allow system integrators to add their own, and stack them in order of desired authority.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13094623#comment-13094623 ]
Lars Hofhansl commented on HBASE-4263:
--------------------------------------
Does anybody feel like committing this? :)
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Assignee: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) Prevent RegionObservers from
interfering with system tables.
Posted by "Gary Helmling (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092202#comment-13092202 ]
Gary Helmling commented on HBASE-4263:
--------------------------------------
Sure, I can see the benefit of another config parameter for ease of use. Thanks Lars.
> Prevent RegionObservers from interfering with system tables.
> ------------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Gary Helmling (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13093093#comment-13093093 ]
Gary Helmling commented on HBASE-4263:
--------------------------------------
The patch seems fine to me. I view the additional config property as just a short-cut to enabling a coprocessor per-table on each user table.
I do think that too many configuration properties can become confusing, but I don't think one more will kill us.
For naming, I prefer hbase.coprocessor.user.region.classes for consistency with terminology throughout other coprocessor code/configs. If we name break that consistency, let's have a good reason.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lars Hofhansl updated HBASE-4263:
---------------------------------
Attachment: 4263.txt
For what's it worth, here's a patch.
It just adds a new config option: hbase.coprocessor.user.region.classes, for coprocessor classes to be only loaded for user tables.
For the record, I am not trying to cripple coprocessors or have any other agenda, nor am I saying anything about the coprocessor architecture in general (the fact that this patch is only 7 lines speaks for the thought-out design).
It's a great feature that we are planning to use extensively.
I think this a fair and simple enhancement. Nobody has to use the new config option.
For us it would be helpful.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Ted Yu (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13094944#comment-13094944 ]
Ted Yu commented on HBASE-4263:
-------------------------------
@Lars:
Why did you ask question you knew the answer :-)
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Assignee: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13093871#comment-13093871 ]
Lars Hofhansl commented on HBASE-4263:
--------------------------------------
Andrew, are you still opposed after seeing the patch?
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Andrew Purtell (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092223#comment-13092223 ]
Andrew Purtell commented on HBASE-4263:
---------------------------------------
Security is a strong use case, end of story.
I'm -1 on this issue, it should be resolved as invalid.
Otherwise we don't have RegionObservers, we have SometimesRegionObservers, or NotUsefulToTheContributorsOfCoprocessorsRegionObservers.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "stack (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13095130#comment-13095130 ]
stack commented on HBASE-4263:
------------------------------
oh, nvm, Andrew responded above.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Assignee: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Lars Hofhansl updated HBASE-4263:
---------------------------------
Summary: New config property for user-table only RegionObservers. (was: Prevent RegionObservers from interfering with system tables.)
Changed title.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) Prevent RegionObservers from
interfering with system tables.
Posted by "Gary Helmling (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092200#comment-13092200 ]
Gary Helmling commented on HBASE-4263:
--------------------------------------
See:
HBASE-1697
HBASE-3025
HBASE-1712
I completely disagree about access control not being a "strong" use case. And I'm sure it's not the only possible or valid use case.
I also disagree that this would be a desirable restriction and I think the downsides are far worse than the benefits. There are still countless ways a coprocessor can crash a server. What are we buying here?
If the underlying need is to have an easy way for users to load RegionObservers on all *user* tables, then I think it would be easy to add another configuration property to enable that. Coprocessors loaded through that property could just skip loading on -ROOT- and .META. If that's the issue, then let's fix it.
But removing the current property that allows loading RegionObservers on *all* tables or restricting the ability to run RegionObservers on -ROOT- and .META. severely undermines coprocessors as an extension mechanism and I'll be -1 on changes in that direction.
> Prevent RegionObservers from interfering with system tables.
> ------------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) Prevent RegionObservers from
interfering with system tables.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092197#comment-13092197 ]
Lars Hofhansl commented on HBASE-4263:
--------------------------------------
I think it is still OK to load per table coprocessors for - ROOT - and .META. as those are (presumably) specifically targeted to those tables.
> Prevent RegionObservers from interfering with system tables.
> ------------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly string use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) Prevent RegionObservers from
interfering with system tables.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13092201#comment-13092201 ]
Lars Hofhansl commented on HBASE-4263:
--------------------------------------
(Comment overlap)
Fair enough :)
I think another config parameter is a good idea. If there are no objections I'll prepare a patch for that.
> Prevent RegionObservers from interfering with system tables.
> ------------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Bug
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Lars Hofhansl (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13095051#comment-13095051 ]
Lars Hofhansl commented on HBASE-4263:
--------------------------------------
Sigh :)
If nobody's feels comfortable committing this, might as well close it.
How about I contact you guys offline via email to resolve this?
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Assignee: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (HBASE-4263) New config property for user-table
only RegionObservers.
Posted by "Andrew Purtell (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/HBASE-4263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13095127#comment-13095127 ]
Andrew Purtell commented on HBASE-4263:
---------------------------------------
@Lars, sorry for the delayed response. My objection is to the initial proposal, the patch is fine. Let me change my vote here to +0.
> New config property for user-table only RegionObservers.
> --------------------------------------------------------
>
> Key: HBASE-4263
> URL: https://issues.apache.org/jira/browse/HBASE-4263
> Project: HBase
> Issue Type: Improvement
> Components: coprocessors
> Affects Versions: 0.92.0
> Reporter: Lars Hofhansl
> Assignee: Lars Hofhansl
> Priority: Minor
> Fix For: 0.92.0
>
> Attachments: 4263.txt
>
>
> It turns out that a RegionObserver can interfere with - ROOT - and .META.
> That seems weird and should be prevented.
> (The one use case for this that I could come up with is access control by Region by intercepting actions on .META., and I don't think that's a particularly strong use case).
> I'll attach a patch as soon as I get to it.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira