[
https://issues.apache.org/jira/browse/HADOOP-10758?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16100446#comment-16100446
]
Lars Francke commented on HADOOP-10758:
---------------------------------------
Thanks for the reply [~xiaochen] but I don't think it answers my question.
I've looked at the code and that looks like this:
{code:title=KMS.java}
Map<String, String> attributes = (Map<String, String>)
jsonKey.get(KMSRESTConstants.ATTRIBUTES_FIELD);
...
KeyProvider.Options options = new
KeyProvider.Options(KMSWebApp.getConfiguration());
...
options.setAttributes(attributes);
{code}
As you can see the {{attributes}} can be set by the user by just adding an
{{attributes}} object to the JSON payload.
Further along this {{options}} object is used as follows:
{code:title=KeyAuthorizationKeyProvider.java}
Map<String, String> attributes = options.getAttributes();
String aclName = attributes.get(KEY_ACL_NAME);
{code}
So, a user can actually dictate the which ACL is used. He could for example
point it at another key for which he has the necessary ACLs.
> KMS: add ACLs on per key basis.
> -------------------------------
>
> Key: HADOOP-10758
> URL: https://issues.apache.org/jira/browse/HADOOP-10758
> Project: Hadoop Common
> Issue Type: Improvement
> Components: security
> Affects Versions: 3.0.0-alpha1
> Reporter: Alejandro Abdelnur
> Assignee: Arun Suresh
> Fix For: 2.6.0
>
> Attachments: HADOOP-10758.1.patch, HADOOP-10758.2.patch,
> HADOOP-10758.3.patch, HADOOP-10758.4.patch, HADOOP-10758.5.patch,
> HADOOP-10758.6.patch, HADOOP-10758.7.patch, HADOOP-10758.8.patch,
> HADOOP-10758.9.patch
>
>
> The KMS server should enforce ACLs on per key basis.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
