You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hbase.apache.org by ap...@apache.org on 2012/07/06 05:02:03 UTC
svn commit: r1358029 - in /hbase/trunk/hbase-server/src:
main/java/org/apache/hadoop/hbase/security/access/AccessController.java
test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java
Author: apurtell
Date: Fri Jul 6 03:02:03 2012
New Revision: 1358029
URL: http://svn.apache.org/viewvc?rev=1358029&view=rev
Log:
HBASE-6253. Do not allow user to disable or drop ACL table (Gopinathan)
Modified:
hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
hbase/trunk/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java
Modified: hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
URL: http://svn.apache.org/viewvc/hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java?rev=1358029&r1=1358028&r2=1358029&view=diff
==============================================================================
--- hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java (original)
+++ hbase/trunk/hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java Fri Jul 6 03:02:03 2012
@@ -664,6 +664,10 @@ public class AccessController extends Ba
@Override
public void preDisableTable(ObserverContext<MasterCoprocessorEnvironment> c, byte[] tableName)
throws IOException {
+ if (Bytes.equals(tableName, AccessControlLists.ACL_GLOBAL_NAME)) {
+ throw new AccessDeniedException("Not allowed to disable "
+ + AccessControlLists.ACL_TABLE_NAME_STR + " table.");
+ }
requirePermission(tableName, null, null, Action.ADMIN, Action.CREATE);
}
Modified: hbase/trunk/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java
URL: http://svn.apache.org/viewvc/hbase/trunk/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java?rev=1358029&r1=1358028&r2=1358029&view=diff
==============================================================================
--- hbase/trunk/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java (original)
+++ hbase/trunk/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java Fri Jul 6 03:02:03 2012
@@ -306,8 +306,19 @@ public class TestAccessController {
}
};
+ PrivilegedExceptionAction disableAclTable = new PrivilegedExceptionAction() {
+ public Object run() throws Exception {
+ ACCESS_CONTROLLER.preDisableTable(ObserverContext.createAndPrepare(CP_ENV, null),
+ AccessControlLists.ACL_TABLE_NAME);
+ return null;
+ }
+ };
+
verifyAllowed(disableTable, SUPERUSER, USER_ADMIN, USER_CREATE, USER_OWNER);
verifyDenied(disableTable, USER_RW, USER_RO, USER_NONE);
+
+ // No user should be allowed to disable _acl_ table
+ verifyDenied(disableAclTable, SUPERUSER, USER_ADMIN, USER_CREATE, USER_OWNER, USER_RW, USER_RO);
}
@Test