[HBASE-20185] Fix ACL check for MasterRpcServices#execProcedure

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0
• Assignee: Apekshit Sharma
• Reporter: Apekshit Sharma
• Created: 13/Mar/18 11:41
• Updated: 01/Aug/18 06:23
• Resolved: 15/Mar/18 06:09

Description

Mailing thread ref: http://mail-archives.apache.org/mod_mbox/hbase-dev/201803.mbox/%3CCAAjhxrriGy_UXpC4iHCSyBB18iAbjU3Y2%2BnjQ-66i9kPPCrPRQ%40mail.gmail.com%3E

TLDR; HBASE-19400 messed up perms required for flushing a table.

---

Looks like flush and snapshot procedures are already doing permissions check as part of preTableFlush/preSnapshot hooks. However, LogRollMasterProcedureManager is missing access checks (elserj, can someone look at it?)
 
With that, it makes no sense to put an ADMIN perm requirement which was added by me in HBASE-19400. Removing it.
However, to make things better for future, i have made few design changes which will ensure 1) perm checks don't slip by mistake, 2) a suitable placeholder for checks for flush & snapshot when we remove AccessController for good.
 

Issue Links

• is related to: HBASE-19400 Add missing security checks in MasterRpcServices
• is related to: HBASE-20199 Add test to prevent further permission regression around table flush and snapshot