Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-15763 Über-JIRA: abfs phase II: Hadoop 3.3 features & fixes
  3. HADOOP-15969

ABFS: getNamespaceEnabled can fail blocking user access thru ACLs

    XMLWordPrintableJSON

Details

    • Sub-task
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 3.2.0
    • 3.3.0, 3.2.1
    • fs/azure
    • None

    Description

      The Get Filesystem Properties operation requires Read permission to the Filesystem.  Read permission to the Filesystem can only be granted thru RBAC, Shared Key, or SAS.  This prevents giving low privilege users access to specific files or directories within the filesystem.  An administrator should be able to set an ACL on a file granting read permission to a user, without giving them read permission to the entire Filesystem.

      Fortunately there is another way to determine if HNS is enabled.  The Get Path Access Control (getAclStatus) operation only requires traversal access, and for the root folder / all authenticated users have traversal access.

      Attachments

        1. HADOOP-15969-001.patch
          2 kB
          Da Zhou
        2. HADOOP-15969-002.patch
          8 kB
          Da Zhou
        3. HADOOP-15969-003.patch
          8 kB
          Da Zhou

        Activity

          People

            DanielZhou Da Zhou
            DanielZhou Da Zhou
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: