[ https://issues.apache.org/jira/browse/HDDS-2966?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17029144#comment-17029144 ]
Hanisha Koneru commented on HDDS-2966: -------------------------------------- Hi [~cxorm], I think irrespective of DB operations, it is a race condition. We are doing a check and acquiring the lock later. So between the check and acquiring the lock, it is possible that the ACLs have changed and the check is no longer valid. Its's a "Time of check to Time of use" problem. > ACL checks should be done after acquiring lock > ---------------------------------------------- > > Key: HDDS-2966 > URL: https://issues.apache.org/jira/browse/HDDS-2966 > Project: Hadoop Distributed Data Store > Issue Type: Sub-task > Components: HA > Reporter: Hanisha Koneru > Priority: Major > > Currently in OMClientRequests#validateAndUpdateCache, we perform ACL checks > before acquiring the required object lock. This could lead to race condition. > The ACL check should be done after acquiring the lock. > For example, in OMKeyCreateRequest: > {code:java} > // check Acl > checkKeyAcls(ozoneManager, volumeName, bucketName, keyName, > IAccessAuthorizer.ACLType.CREATE, OzoneObj.ResourceType.KEY); > acquireLock = omMetadataManager.getLock().acquireWriteLock(BUCKET_LOCK, > volumeName, bucketName); > {code} -- This message was sent by Atlassian Jira (v8.3.4#803005) --------------------------------------------------------------------- To unsubscribe, e-mail: ozone-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: ozone-issues-h...@hadoop.apache.org