[HBASE-21481] [acl] Superuser's permissions should not be granted or revoked by any non-su global admin

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.2.0, 2.3.0
• Labels: ACL security-issue

Release Note

HBASE-21481 improves the quality of access control, by strengthening the protection of super users's privileges.

• Assignee: Reid Chan
• Reporter: Reid Chan
• Created: 15/Nov/18 06:07
• Updated: 02/Mar/19 07:35
• Resolved: 01/Mar/19 15:50

Description

Superusers are hbase.superuser listed in configuration and plus the one who start master process, these two may be overlap.

A superuser must be a global admin, but a global admin may not be a superuser, possibly granted afterwards.

For now, an non-su global admin with a Global.ADMIN permission can grant or revoke any superuser's permission, accidentally or deliberately.

The purpose of this issue is to ban this action.

Issue Links

• links to: Review Board