[HBASE-13780] Default to 700 for HDFS root dir permissions for secure deployments

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.98.13, 1.0.2, 1.2.0, 1.1.1, 2.0.0
• Component/s: Operability, security
• Hadoop Flags: Reviewed
• Assignee: Enis Soztutar
• Reporter: Enis Soztutar
• Created: 26/May/15 21:41
• Updated: 18/Dec/15 05:11
• Resolved: 27/May/15 20:38

Description

Secure mode deployments should protect the files under HDFS root dir. We should check and set the root dirs permissions on a kerberos setup so that users does not have to.

We have hbase.data.umask.enable and hbase.data.umask for data files, but those are not that useful since we should protect dir listing, and access to WAL files, snapshot files, etc.

See HBASE-13768 which has an integration test for this.