[HDFS-11392] FSPermissionChecker#checkSubAccess should support inodeattribute provider

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 2.7.0
• Component/s: namenode
• Target Version/s: 3.5.0
• Assignee: Unassigned
• Reporter: John Zhuge
• Created: 06/Feb/17 20:07
• Updated: 04/Jan/24 07:43

Description

HDFS-6826 added this TODO in FSPermissionChecker#checkSubAccess:

FSPermissionChecker#checkSubAccess

        //TODO have to figure this out with inodeattribute provider
        INodeAttributes inodeAttr =
            getINodeAttrs(components, pathIdx, d, snapshotId);

If inodeattribute provider in play, it always incorrectly returns the root attr of the subtree even when it descends multiple levels down the sub tree, because the components array is for the root .

FSPermissionChecker#getINodeAttrs

  private INodeAttributes getINodeAttrs(byte[][] pathByNameArr, int pathIdx,
      INode inode, int snapshotId) {
    INodeAttributes inodeAttrs = inode.getSnapshotINode(snapshotId);
    if (getAttributesProvider() != null) {
      String[] elements = new String[pathIdx + 1];
      for (int i = 0; i < elements.length; i++) {
        elements[i] = DFSUtil.bytes2String(pathByNameArr[i]);
      }
      inodeAttrs = getAttributesProvider().getAttributes(elements, inodeAttrs);
    }
    return inodeAttrs;
  }

Issue Links

• is broken by: HDFS-6826 Plugin interface to enable delegation of HDFS authorization assertions