Uploaded image for project: 'Hadoop HDFS'
  1. Hadoop HDFS
  2. HDFS-13668

FSPermissionChecker may throws AIOOE when check inode permission

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 3.1.0, 2.10.0, 2.7.7
    • Fix Version/s: 3.2.0, 3.0.4, 3.1.2
    • Component/s: namenode
    • Labels:
      None
    • Hadoop Flags:
      Reviewed

      Description

      FSPermissionChecker may throw ArrayIndexOutOfBoundsException:0 when check if has permission, since it only check inode's aclFeature if null or not but not check it's entry size. When it meets aclFeature not null but it's entry size equal to 0, it will throw AIOOE.

      private boolean hasPermission(INodeAttributes inode, FsAction access) {
        ......
        final AclFeature aclFeature = inode.getAclFeature();
        if (aclFeature != null) {
          // It's possible that the inode has a default ACL but no access ACL.
          int firstEntry = aclFeature.getEntryAt(0);
          if (AclEntryStatusFormat.getScope(firstEntry) == AclEntryScope.ACCESS) {
            return hasAclPermission(inode, access, mode, aclFeature);
          }
        }
        ......
      }
      

      Actually if use default INodeAttributeProvider, it can ensure that when inode's aclFeature is not null and it's entry size also will be greater than 0, but INodeAttributeProvider is a public interface, we could not ensure external implement (e.g. Apache Sentry, Apache Ranger) also has the similar constraint.

        Attachments

        1. HDFS-13668-trunk.003.patch
          5 kB
          He Xiaoqiao
        2. HDFS-13668-trunk.002.patch
          5 kB
          He Xiaoqiao
        3. HDFS-13668-trunk.001.patch
          5 kB
          He Xiaoqiao

          Activity

            People

            • Assignee:
              hexiaoqiao He Xiaoqiao
              Reporter:
              hexiaoqiao He Xiaoqiao
            • Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: