vyommani commented on code in PR #1201:
URL: https://github.com/apache/ranger/pull/1201#discussion_r4012004458
##########
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java:
##########
@@ -1434,13 +1434,34 @@ boolean canSkipAccessCheck(User user, final String
operation, String access, fin
/* ---- EndpointObserver implementation ---- */
- boolean isAccessForMetadataRead(String access, String table) {
+ boolean isAccessForMetadataRead(String access, String table, User user) {
if (authUtils.isReadAccess(access) && isSpecialTable(table)) {
- LOG.debug("isAccessForMetadataRead: Metadata tables read: access
allowed!");
+ if (StringUtils.equals(table, "hbase:acl")) {
+ if (user == null) {
+ return false;
+ }
+ boolean isSystemOrSuperUser = userUtils.isSuperUser(user);
+ if (!isSystemOrSuperUser) {
+ try {
+ User currentUser = User.getCurrent();
+ if (currentUser != null) {
+ isSystemOrSuperUser =
Objects.equals(currentUser.getShortName(), user.getShortName());
+ }
+ } catch (IOException e) {
+ LOG.warn("Unable to obtain the current user", e);
+ }
+ }
+ if (!isSystemOrSuperUser) {
+ return false;
+ }
+ }
+ LOG.debug("isAccessForMetadataRead: Metadata tables read: access
allowed for user: {}!", (user != null ? user.getShortName() : ""));
Review Comment:
This now fires for every access to every non-special table (each
Get/Put/Scan on user tables), and the message says "Metadata tables read: not
access allowed" even when the table isn't a metadata table. Please move it
inside the isSpecialTable branch or drop it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
