[HBASE-8692] [AccessController] Restrict HTableDescriptor enumeration

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.98.0, 0.95.1, 0.94.9
• Fix Version/s: 0.98.0, 0.95.2, 0.94.10
• Component/s: Coprocessors, security

Release Note

This change adds support for restricting access to table schema. Only a user with GLOBAL ADMIN privilege can enumerate the full list of table schemas. If passed a list of specific tables, the AccessController will check that the user has either GLOBAL ADMIN privs, or TABLE ADMIN or TABLE CREATE privs for all of the listed tables before allowing the request.

• Assignee: Andrew Kyle Purtell
• Reporter: Andrew Kyle Purtell
• Created: 05/Jun/13 09:29
• Updated: 25/Apr/14 00:38
• Resolved: 24/Jun/13 22:22

Description

Some users are concerned about having table schema exposed to every user and would like it protected, similar to the rest of the admin operations for schema.

This used to be hopeless because META would leak HTableDescriptors in HRegionInfo, but that is no longer the case in 0.94+.

Consider adding CP hooks in the master for intercepting HMasterInterface#getHTableDescriptors and HMasterInterface#getHTableDescriptors(List<String>). Add support in the AccessController for only allowing GLOBAL ADMIN to the first method. Add support in the AccessController for allowing access to the descriptors for the table names in the list of the second method only if the user has TABLE ADMIN privilege for all of the listed table names.

Then, fix the code in HBaseAdmin (and elsewhere) that expects to be able to enumerate all table descriptors e.g. in deleteTable. A TABLE ADMIN can delete a table but won’t have GLOBAL ADMIN privilege to enumerate the total list. So a minor fixup is needed here, and in other places like this which make the same assumption.

Issue Links

• relates to: HBASE-8799 TestAccessController#testBulkLoad failing on trunk/0.95
• relates to: HBASE-9182 Allow non-admin users to list all table names
• relates to: HBASE-11043 Users with table's read/write permission can't get table's description