[
https://issues.apache.org/jira/browse/HADOOP-2514?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12556783#action_12556783
]
Sanjay Radia commented on HADOOP-2514:
--------------------------------------
Option 3: Extra permission checking for stuff moved to trash.
I think option 2 is acceptable for 0.16; option 3 can be considered for 0.17
release if the
violation of option 2 is not acceptable.
The issue is that delete and rename have different permission checking
- Both require Write perm on parent
- Deleting a directory recursively requires that one has write permissions
on ALL subdirectories.
There are three ways of moving files to trash
a) shell: rm /foo/bar_dir (implemented as (c))
b) shell: mv /foo/bar_dir ~/.trash
c) FileSystem.rename(/foo/dir_bar, /user/<u>/.trash/dir_bar)
(a) and (b) can both do extra checks for write permission on all subdirs of
/foo/dir_bar but that
does not help because a user can programatically do (c).
To fix this there are two alternatives:
i) have the trash compacter su to each user.
Advantage: NN does not treat trash as special
Disadvantage: files that cannot be deleted, remain in trash to be
cleaned-up manually.
ii) change the NN's rename operation to check for moves to trash.
Disadvantage: NN treats trash as special
- One could argue that the trash compacter is part of NN and
hence trash is special.
Advantage: no garbage is left in trash and that the user notified of the
violation when he issues the violating operation.
> Trash and permissions don't mix
> -------------------------------
>
> Key: HADOOP-2514
> URL: https://issues.apache.org/jira/browse/HADOOP-2514
> Project: Hadoop
> Issue Type: New Feature
> Components: dfs
> Affects Versions: 0.16.0
> Reporter: Robert Chansler
> Fix For: 0.16.0
>
>
> Shell command "rm" is really "mv" to trash with the expectation that the
> server will at some point really delete the contents of trash. With the
> advent of permissions, a user can "mv" folders that the user cannot "rm". The
> present trash feature as implemented would allow the user to suborn the
> server into deleting a folder in violation of the permissions model.
> A related issue is that if anybody can mv a folder to the trash anybody else
> can mv that same folder from the trash. This may be contrary to the
> expectations of the user.
> What is a better model for trash?
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
