[HBASE-15132] Master region merge RPC should authorize user request

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.3.0, 2.0.0
• Hadoop Flags: Reviewed
• Assignee: Ted Yu
• Reporter: Ted Yu
• Created: 20/Jan/16 02:48
• Updated: 26/Jan/16 19:04
• Resolved: 24/Jan/16 15:53

Description

The normal flow for region merge is:
1. client sends a master RPC for dispatch merge regions
2. master moves the regions to the same regionserver
3. master calls mergeRegions RPC on the regionserver.

For user initiated region merge, MasterRpcServices#dispatchMergingRegions() is called by HBaseAdmin.

There is no coprocessor invocation in step 1.
Step 3 is carried out in the "hbase" user context.

This leaves potential security hole - any user without proper authorization can merge regions of any table.

Thanks to Enis who spotted this flaw first.

Issue Links

• is related to: HBASE-15173 Execute mergeRegions RPC call as the request user