Uploaded image for project: 'Accumulo'
  1. Accumulo
  2. ACCUMULO-2806

Accumulo init should ensure wals and tables are not world readable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 1.5.0, 1.5.1, 1.6.0
    • Fix Version/s: 1.9.0, 2.0.0
    • Component/s: None
    • Labels:
      None

      Description

      Just did an init on a new 1.6.1-SNAP cluster, and noticed the following permissions:

      dfs -ls /
      Found 4 items
      drwxr-xr-x   - accumulo supergroup          0 2014-05-14 09:48 /accumulo
      drwxr-xr-x   - hdfs     supergroup          0 2014-05-14 08:10 /jobtracker
      drwxrwxrwx   - hdfs     supergroup          0 2014-05-14 08:10 /tmp
      drwxr-xr-x   - hdfs     supergroup          0 2014-05-14 09:48 /user
      -bash-4.1$ hdfs dfs -ls /accumulo
      Found 3 items
      drwxr-xr-x   - accumulo supergroup          0 2014-05-14 09:55 /accumulo/instance_id
      drwxr-xr-x   - accumulo supergroup          0 2014-05-14 09:55 /accumulo/tables
      drwxr-xr-x   - accumulo supergroup          0 2014-05-14 09:55 /accumulo/version
      

      I previously set up /accumulo as 755, under the understanding that clients need access to /accumulo/instance_id

      things to fix

      1. make init chmod tables and wals to 700, as a defensive measure to avoid data leaks
      2. maybe also make sure if the trash is enabled that our user directory is also not world readable
      3. If clients don't need access to instance_id, include a check that the data dir is not world readable

      Workaround: manually change permissions after init

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                milleruntime Michael Miller
                Reporter:
                busbey Sean Busbey
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 2h 10m
                  2h 10m