[HADOOP-11322] key based ACL check in KMS always check KeyOpType.MANAGEMENT even actual KeyOpType is not MANAGEMENT

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.7.0
• Component/s: security
• Target Version/s: 2.7.0
• Hadoop Flags: Reviewed
• Assignee: Dian Fu
• Reporter: Dian Fu
• Created: 20/Nov/14 06:29
• Updated: 10/Apr/15 20:04
• Resolved: 25/Nov/14 02:07

Description

In the method checkAccess of class KeyAuthorizationKeyProvider, there is following code:

private void checkAccess(String aclName, UserGroupInformation ugi,
      KeyOpType opType) throws AuthorizationException {
    Preconditions.checkNotNull(aclName, "Key ACL name cannot be null");
    Preconditions.checkNotNull(ugi, "UserGroupInformation cannot be null");
    if (acls.isACLPresent(aclName, KeyOpType.MANAGEMENT) &&
        (acls.hasAccessToKey(aclName, ugi, opType)
            || acls.hasAccessToKey(aclName, ugi, KeyOpType.ALL))) {
      return;
    }
...
}

Seems that

acls.isACLPresent(aclName, KeyOpType.MANAGEMENT) 

should be replaced with

acls.isACLPresent(aclName, opType)