34
34
import org .apache .hadoop .hbase .HBaseInterfaceAudience ;
35
35
import org .apache .hadoop .hbase .NamespaceDescriptor ;
36
36
import org .apache .hadoop .hbase .TableName ;
37
+ import org .apache .hadoop .hbase .TableNotFoundException ;
37
38
import org .apache .hadoop .hbase .client .Admin ;
38
39
import org .apache .hadoop .hbase .client .ColumnFamilyDescriptorBuilder ;
39
40
import org .apache .hadoop .hbase .client .Delete ;
56
57
import org .apache .hadoop .hbase .master .MasterServices ;
57
58
import org .apache .hadoop .hbase .security .User ;
58
59
import org .apache .hadoop .hbase .security .UserProvider ;
59
- import org .apache .hadoop .hbase .security .access .HDFSAclHelper .PathHelper ;
60
60
import org .apache .hadoop .hbase .security .access .Permission .Action ;
61
+ import org .apache .hadoop .hbase .security .access .SnapshotScannerHDFSAclHelper .PathHelper ;
61
62
import org .apache .hadoop .hbase .util .Bytes ;
62
63
import org .apache .yetus .audience .InterfaceAudience ;
63
64
import org .slf4j .Logger ;
94
95
*/
95
96
@ CoreCoprocessor
96
97
@ InterfaceAudience .LimitedPrivate (HBaseInterfaceAudience .CONFIG )
97
- public class HDFSAclController implements MasterCoprocessor , MasterObserver {
98
- private static final Logger LOG = LoggerFactory .getLogger (HDFSAclController .class );
98
+ public class SnapshotScannerHDFSAclController implements MasterCoprocessor , MasterObserver {
99
+ private static final Logger LOG = LoggerFactory .getLogger (SnapshotScannerHDFSAclController .class );
99
100
100
- private HDFSAclHelper hdfsAclHelper = null ;
101
+ private SnapshotScannerHDFSAclHelper hdfsAclHelper = null ;
101
102
private PathHelper pathHelper = null ;
102
103
private FileSystem fs = null ;
103
104
/** Provider for mapping principal names to Users */
@@ -117,8 +118,8 @@ public void preMasterInitialization(final ObserverContext<MasterCoprocessorEnvir
117
118
throw new IOException ("Does not implement HMasterServices" );
118
119
}
119
120
MasterServices masterServices = ((HasMasterServices ) mEnv ).getMasterServices ();
120
- hdfsAclHelper =
121
- new HDFSAclHelper ( masterServices . getConfiguration (), masterServices .getConnection ());
121
+ hdfsAclHelper = new SnapshotScannerHDFSAclHelper ( masterServices . getConfiguration (),
122
+ masterServices .getConnection ());
122
123
pathHelper = hdfsAclHelper .getPathHelper ();
123
124
fs = pathHelper .getFileSystem ();
124
125
hdfsAclHelper .setCommonDirPermission ();
@@ -132,14 +133,20 @@ public void postStartMaster(ObserverContext<MasterCoprocessorEnvironment> ctx)
132
133
if (admin .tableExists (PermissionStorage .ACL_TABLE_NAME )) {
133
134
// check if hbase:acl table has 'm' CF
134
135
TableDescriptor tableDescriptor = admin .getDescriptor (PermissionStorage .ACL_TABLE_NAME );
135
- boolean containHdfsAclFamily = Arrays .stream (tableDescriptor .getColumnFamilies ())
136
- . anyMatch ( family -> Bytes .equals (family .getName (), HDFSAclStorage .HDFS_ACL_FAMILY ));
136
+ boolean containHdfsAclFamily = Arrays .stream (tableDescriptor .getColumnFamilies ()). anyMatch (
137
+ family -> Bytes .equals (family .getName (), SnapshotScannerHDFSAclStorage .HDFS_ACL_FAMILY ));
137
138
if (!containHdfsAclFamily ) {
138
- TableDescriptorBuilder builder =
139
- TableDescriptorBuilder . newBuilder ( tableDescriptor ). setColumnFamily (
140
- ColumnFamilyDescriptorBuilder .newBuilder (HDFSAclStorage .HDFS_ACL_FAMILY ).build ());
139
+ TableDescriptorBuilder builder = TableDescriptorBuilder . newBuilder ( tableDescriptor )
140
+ . setColumnFamily (ColumnFamilyDescriptorBuilder
141
+ .newBuilder (SnapshotScannerHDFSAclStorage .HDFS_ACL_FAMILY ).build ());
141
142
admin .modifyTable (builder .build ());
142
143
}
144
+ } else {
145
+ LOG .error ("Table {} is not yet created. {} should be configured after the {} Coprocessor" ,
146
+ PermissionStorage .ACL_TABLE_NAME , getClass ().getSimpleName (),
147
+ AccessController .class .getSimpleName ());
148
+ throw new TableNotFoundException (
149
+ "Table " + PermissionStorage .ACL_TABLE_NAME + " is not yet created" );
143
150
}
144
151
}
145
152
this .userProvider = UserProvider .instantiate (ctx .getEnvironment ().getConfiguration ());
@@ -171,7 +178,7 @@ public void postCompletedCreateTableAction(ObserverContext<MasterCoprocessorEnvi
171
178
hdfsAclHelper .addTableAcl (desc .getTableName (), owner );
172
179
try (Table aclTable =
173
180
c .getEnvironment ().getConnection ().getTable (PermissionStorage .ACL_TABLE_NAME )) {
174
- HDFSAclStorage .addUserTableHdfsAcl (aclTable , owner , desc .getTableName ());
181
+ SnapshotScannerHDFSAclStorage .addUserTableHdfsAcl (aclTable , owner , desc .getTableName ());
175
182
}
176
183
}
177
184
}
@@ -217,10 +224,10 @@ public void postDeleteTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
217
224
Set <String > removeUsers = new HashSet <>();
218
225
try (Table aclTable =
219
226
ctx .getEnvironment ().getConnection ().getTable (PermissionStorage .ACL_TABLE_NAME )) {
220
- List <String > users = HDFSAclStorage .getTableUsers (aclTable , tableName );
221
- HDFSAclStorage .deleteTableHdfsAcl (aclTable , tableName );
227
+ List <String > users = SnapshotScannerHDFSAclStorage .getTableUsers (aclTable , tableName );
228
+ SnapshotScannerHDFSAclStorage .deleteTableHdfsAcl (aclTable , tableName );
222
229
for (String user : users ) {
223
- List <byte []> userEntries = HDFSAclStorage .getUserEntries (aclTable , user );
230
+ List <byte []> userEntries = SnapshotScannerHDFSAclStorage .getUserEntries (aclTable , user );
224
231
boolean remove = true ;
225
232
for (byte [] entry : userEntries ) {
226
233
if (PermissionStorage .isGlobalEntry (entry )) {
@@ -253,7 +260,7 @@ public void postDeleteNamespace(ObserverContext<MasterCoprocessorEnvironment> ct
253
260
if (hdfsAclHelper != null ) {
254
261
try (Table aclTable =
255
262
ctx .getEnvironment ().getConnection ().getTable (PermissionStorage .ACL_TABLE_NAME )) {
256
- HDFSAclStorage .deleteNamespaceHdfsAcl (aclTable , namespace );
263
+ SnapshotScannerHDFSAclStorage .deleteNamespaceHdfsAcl (aclTable , namespace );
257
264
}
258
265
Path tmpNsDir = pathHelper .getTmpNsDir (namespace );
259
266
if (fs .exists (tmpNsDir )) {
@@ -279,7 +286,8 @@ public void postGrant(ObserverContext<MasterCoprocessorEnvironment> c,
279
286
case GLOBAL :
280
287
UserPermission perm = getUserGlobalPermission (conf , userName );
281
288
if (containReadPermission (perm )) {
282
- List <byte []> userEntries = HDFSAclStorage .getUserEntries (aclTable , userName );
289
+ List <byte []> userEntries =
290
+ SnapshotScannerHDFSAclStorage .getUserEntries (aclTable , userName );
283
291
Set <String > skipNamespaces = new HashSet <>();
284
292
Set <TableName > skipTables = new HashSet <>();
285
293
for (byte [] entry : userEntries ) {
@@ -290,7 +298,7 @@ public void postGrant(ObserverContext<MasterCoprocessorEnvironment> c,
290
298
}
291
299
}
292
300
hdfsAclHelper .grantAcl (userPermission , skipNamespaces , skipTables );
293
- HDFSAclStorage .addUserGlobalHdfsAcl (aclTable , userName );
301
+ SnapshotScannerHDFSAclStorage .addUserGlobalHdfsAcl (aclTable , userName );
294
302
} else {
295
303
revokeUserGlobalPermission (aclTable , userName , userPermission );
296
304
}
@@ -300,8 +308,9 @@ public void postGrant(ObserverContext<MasterCoprocessorEnvironment> c,
300
308
((NamespacePermission ) userPermission .getPermission ()).getNamespace ();
301
309
UserPermission nsPerm = getUserNamespacePermission (conf , userName , namespace );
302
310
if (containReadPermission (nsPerm )) {
303
- if (!HDFSAclStorage .hasUserGlobalHdfsAcl (aclTable , userName )) {
304
- List <byte []> userEntries = HDFSAclStorage .getUserEntries (aclTable , userName );
311
+ if (!SnapshotScannerHDFSAclStorage .hasUserGlobalHdfsAcl (aclTable , userName )) {
312
+ List <byte []> userEntries =
313
+ SnapshotScannerHDFSAclStorage .getUserEntries (aclTable , userName );
305
314
Set <TableName > skipTables = new HashSet <>();
306
315
for (byte [] entry : userEntries ) {
307
316
if (!PermissionStorage .isNamespaceEntry (entry )
@@ -311,7 +320,7 @@ public void postGrant(ObserverContext<MasterCoprocessorEnvironment> c,
311
320
}
312
321
hdfsAclHelper .grantAcl (userPermission , new HashSet <>(0 ), skipTables );
313
322
}
314
- HDFSAclStorage .addUserNamespaceHdfsAcl (aclTable , userName , namespace );
323
+ SnapshotScannerHDFSAclStorage .addUserNamespaceHdfsAcl (aclTable , userName , namespace );
315
324
} else {
316
325
revokeUserNamespacePermission (aclTable , userName , namespace , userPermission );
317
326
}
@@ -324,11 +333,12 @@ public void postGrant(ObserverContext<MasterCoprocessorEnvironment> c,
324
333
break ;
325
334
}
326
335
if (containReadPermission (tPerm )) {
327
- if (!HDFSAclStorage .hasUserGlobalHdfsAcl (aclTable , userName ) && !HDFSAclStorage
328
- .hasUserNamespaceHdfsAcl (aclTable , userName , tableName .getNamespaceAsString ())) {
336
+ if (!SnapshotScannerHDFSAclStorage .hasUserGlobalHdfsAcl (aclTable , userName )
337
+ && !SnapshotScannerHDFSAclStorage .hasUserNamespaceHdfsAcl (aclTable , userName ,
338
+ tableName .getNamespaceAsString ())) {
329
339
hdfsAclHelper .grantAcl (userPermission , new HashSet <>(0 ), new HashSet <>(0 ));
330
340
}
331
- HDFSAclStorage .addUserTableHdfsAcl (aclTable , userName , tableName );
341
+ SnapshotScannerHDFSAclStorage .addUserTableHdfsAcl (aclTable , userName , tableName );
332
342
} else {
333
343
revokeUserTablePermission (aclTable , userName , tableName , userPermission );
334
344
}
@@ -378,7 +388,7 @@ private void revokeUserGlobalPermission(Table aclTable, String userName,
378
388
// remove user global acls but reserve ns and table acls
379
389
Set <String > skipNamespaces = new HashSet <>();
380
390
Set <TableName > skipTables = new HashSet <>();
381
- List <byte []> userEntries = HDFSAclStorage .getUserEntries (aclTable , userName );
391
+ List <byte []> userEntries = SnapshotScannerHDFSAclStorage .getUserEntries (aclTable , userName );
382
392
for (byte [] entry : userEntries ) {
383
393
if (PermissionStorage .isNamespaceEntry (entry )) {
384
394
skipNamespaces .add (Bytes .toString (PermissionStorage .fromNamespaceEntry (entry )));
@@ -393,33 +403,34 @@ private void revokeUserGlobalPermission(Table aclTable, String userName,
393
403
}
394
404
}
395
405
hdfsAclHelper .revokeAcl (userPermission , skipNamespaces , filterTableNames );
396
- HDFSAclStorage .deleteUserGlobalHdfsAcl (aclTable , userName );
406
+ SnapshotScannerHDFSAclStorage .deleteUserGlobalHdfsAcl (aclTable , userName );
397
407
}
398
408
399
409
private void revokeUserNamespacePermission (Table aclTable , String userName , String namespace ,
400
410
UserPermission userPermission ) throws IOException {
401
411
// remove user ns acls but reserve table acls
402
- if (!HDFSAclStorage .hasUserGlobalHdfsAcl (aclTable , userName )) {
412
+ if (!SnapshotScannerHDFSAclStorage .hasUserGlobalHdfsAcl (aclTable , userName )) {
403
413
Set <TableName > skipTables = new HashSet <>();
404
- List <byte []> userEntries = HDFSAclStorage .getUserEntries (aclTable , userName );
414
+ List <byte []> userEntries = SnapshotScannerHDFSAclStorage .getUserEntries (aclTable , userName );
405
415
for (byte [] entry : userEntries ) {
406
416
if (!PermissionStorage .isNamespaceEntry (entry ) && !PermissionStorage .isGlobalEntry (entry )) {
407
417
skipTables .add (TableName .valueOf (entry ));
408
418
}
409
419
}
410
420
hdfsAclHelper .revokeAcl (userPermission , new HashSet <>(), skipTables );
411
421
}
412
- HDFSAclStorage .deleteUserNamespaceHdfsAcl (aclTable , userName , namespace );
422
+ SnapshotScannerHDFSAclStorage .deleteUserNamespaceHdfsAcl (aclTable , userName , namespace );
413
423
}
414
424
415
425
private void revokeUserTablePermission (Table aclTable , String userName , TableName tableName ,
416
426
UserPermission userPermission ) throws IOException {
417
- if (!HDFSAclStorage .hasUserGlobalHdfsAcl (aclTable , userName ) && !HDFSAclStorage
418
- .hasUserNamespaceHdfsAcl (aclTable , userName , tableName .getNamespaceAsString ())) {
427
+ if (!SnapshotScannerHDFSAclStorage .hasUserGlobalHdfsAcl (aclTable , userName )
428
+ && !SnapshotScannerHDFSAclStorage .hasUserNamespaceHdfsAcl (aclTable , userName ,
429
+ tableName .getNamespaceAsString ())) {
419
430
// remove table acls
420
431
hdfsAclHelper .revokeAcl (userPermission , new HashSet <>(0 ), new HashSet <>(0 ));
421
432
}
422
- HDFSAclStorage .deleteUserTableHdfsAcl (aclTable , userName , tableName );
433
+ SnapshotScannerHDFSAclStorage .deleteUserTableHdfsAcl (aclTable , userName , tableName );
423
434
}
424
435
425
436
private boolean containReadPermission (UserPermission userPermission ) {
@@ -461,11 +472,11 @@ private UserPermission getUserTablePermission(Configuration conf, String userNam
461
472
}
462
473
463
474
private boolean isHdfsAclEnabled (Configuration configuration ) {
464
- return configuration .getBoolean (HDFSAclHelper . HDFS_ACL_ENABLE , false );
475
+ return configuration .getBoolean (SnapshotScannerHDFSAclHelper . USER_SCAN_SNAPSHOT_ENABLE , false );
465
476
}
466
477
467
- protected static final class HDFSAclStorage {
468
- public static final byte [] HDFS_ACL_FAMILY = Bytes .toBytes ("m" );
478
+ protected static final class SnapshotScannerHDFSAclStorage {
479
+ static final byte [] HDFS_ACL_FAMILY = Bytes .toBytes ("m" );
469
480
private static final byte [] HDFS_ACL_VALUE = Bytes .toBytes ("R" );
470
481
471
482
static void addUserGlobalHdfsAcl (Table aclTable , String user ) throws IOException {
0 commit comments