[HDFS-5923] Do not persist the ACL bit in the FsPermission

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: HDFS ACLs (HDFS-4685)
• Fix Version/s: HDFS ACLs (HDFS-4685)
• Component/s: hdfs-client, namenode, security
• Target Version/s: HDFS ACLs (HDFS-4685)
• Hadoop Flags: Reviewed
• Assignee: Haohui Mai
• Reporter: Haohui Mai
• Created: 11/Feb/14 02:21
• Updated: 14/Nov/14 17:55
• Resolved: 12/Feb/14 22:58

Description

The current implementation persists and ACL bit in FSImage and editlogs. Moreover, the security decisions also depend on whether the bit is set.

The problem here is that we have to maintain the implicit invariant, which is the ACL bit is set if and only if the the inode has AclFeature. The invariant has to be maintained everywhere otherwise it can lead to a security vulnerability. In the worst case, an attacker can toggle the bit and bypass the ACL checks.

The jira proposes to treat the ACL bit as a transient bit. The bit should not be persisted onto the disk, neither it should affect any security decisions.

Issue Links

• is depended upon by: HDFS-5933 Optimize the FSImage layout for ACLs
• is related to: HADOOP-10354 TestWebHDFS fails after merge of HDFS-4685 to trunk
• is related to: HADOOP-10361 Correct alignment in CLI output for ACLs.
• is related to: HDFS-5621 NameNode: add indicator in web UI file system browser if a file has an ACL.
• is related to: HDFS-7384 'getfacl' command and 'getAclStatus' output should be in sync
• is required by: HDFS-5932 Ls should display the ACL bit
• is required by: HDFS-5937 Fix TestOfflineEditsViewer on HDFS-4685 branch.
• relates to: HDFS-4685 Implementation of ACLs in HDFS