[HBASE-6086] Admin operations on a table should be authorized against table permissions instead of global permissions.

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 0.94.0
• Component/s: security
• Labels: acl security
• Tags: Huawei security
• Assignee: Unassigned
• Reporter: Laxman
• Created: 24/May/12 04:55
• Updated: 13/Jun/22 16:34
• Resolved: 25/May/12 04:53

Description

Still some inconsistency exists after HBASE-6061. We actually need to authorize against table permissions instead of global permissions here.

+  private void requireTableAdminPermission(MasterCoprocessorEnvironment e,
+      byte[] tableName) throws IOException {
+    if (isActiveUserTableOwner(e, tableName)) {
+      requirePermission(Permission.Action.CREATE);
+    } else {
+      requirePermission(Permission.Action.ADMIN);
+    }
+  }

Issue Links

• duplicates: HBASE-5372 Table mutation operations should check table level rights, not global rights
• relates to: HBASE-6068 Secure HBase cluster : Client not able to call some admin APIs