001/* 002 * Licensed to the Apache Software Foundation (ASF) under one 003 * or more contributor license agreements. See the NOTICE file 004 * distributed with this work for additional information 005 * regarding copyright ownership. The ASF licenses this file 006 * to you under the Apache License, Version 2.0 (the 007 * "License"); you may not use this file except in compliance 008 * with the License. You may obtain a copy of the License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software 013 * distributed under the License is distributed on an "AS IS" BASIS, 014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 015 * See the License for the specific language governing permissions and 016 * limitations under the License. 017 */ 018package org.apache.hadoop.hbase.security.access; 019 020import static org.apache.hadoop.hbase.security.access.Permission.Action.READ; 021import static org.apache.hadoop.hbase.security.access.Permission.Action.WRITE; 022import static org.apache.hadoop.hbase.security.access.SnapshotScannerHDFSAclController.SnapshotScannerHDFSAclStorage.hasUserGlobalHdfsAcl; 023import static org.apache.hadoop.hbase.security.access.SnapshotScannerHDFSAclController.SnapshotScannerHDFSAclStorage.hasUserNamespaceHdfsAcl; 024import static org.apache.hadoop.hbase.security.access.SnapshotScannerHDFSAclController.SnapshotScannerHDFSAclStorage.hasUserTableHdfsAcl; 025import static org.junit.Assert.assertEquals; 026import static org.junit.Assert.assertFalse; 027import static org.junit.Assert.assertTrue; 028 029import java.io.IOException; 030import java.util.List; 031import org.apache.hadoop.conf.Configuration; 032import org.apache.hadoop.fs.FileSystem; 033import org.apache.hadoop.fs.Path; 034import org.apache.hadoop.fs.permission.AclEntry; 035import org.apache.hadoop.fs.permission.AclEntryScope; 036import org.apache.hadoop.fs.permission.FsPermission; 037import org.apache.hadoop.hbase.HBaseClassTestRule; 038import org.apache.hadoop.hbase.HBaseTestingUtility; 039import org.apache.hadoop.hbase.NamespaceDescriptor; 040import org.apache.hadoop.hbase.TableName; 041import org.apache.hadoop.hbase.client.Admin; 042import org.apache.hadoop.hbase.client.Table; 043import org.apache.hadoop.hbase.client.TableDescriptor; 044import org.apache.hadoop.hbase.client.TableDescriptorBuilder; 045import org.apache.hadoop.hbase.coprocessor.CoprocessorHost; 046import org.apache.hadoop.hbase.master.cleaner.HFileCleaner; 047import org.apache.hadoop.hbase.security.User; 048import org.apache.hadoop.hbase.testclassification.LargeTests; 049import org.apache.hadoop.hbase.testclassification.SecurityTests; 050import org.apache.hadoop.hbase.util.FSUtils; 051import org.apache.hadoop.hbase.util.HFileArchiveUtil; 052import org.apache.hadoop.hbase.util.Threads; 053import org.junit.AfterClass; 054import org.junit.BeforeClass; 055import org.junit.ClassRule; 056import org.junit.Rule; 057import org.junit.Test; 058import org.junit.experimental.categories.Category; 059import org.junit.rules.TestName; 060import org.slf4j.Logger; 061import org.slf4j.LoggerFactory; 062 063@Category({ SecurityTests.class, LargeTests.class }) 064public class TestSnapshotScannerHDFSAclController { 065 @ClassRule 066 public static final HBaseClassTestRule CLASS_RULE = 067 HBaseClassTestRule.forClass(TestSnapshotScannerHDFSAclController.class); 068 @Rule 069 public TestName name = new TestName(); 070 private static final Logger LOG = 071 LoggerFactory.getLogger(TestSnapshotScannerHDFSAclController.class); 072 073 private static final String UN_GRANT_USER = "un_grant_user"; 074 private static HBaseTestingUtility TEST_UTIL = new HBaseTestingUtility(); 075 private static Configuration conf = TEST_UTIL.getConfiguration(); 076 private static Admin admin = null; 077 private static FileSystem FS = null; 078 private static Path rootDir = null; 079 private static User unGrantUser = null; 080 private static SnapshotScannerHDFSAclHelper helper; 081 private static Table aclTable; 082 083 @BeforeClass 084 public static void setupBeforeClass() throws Exception { 085 // enable hdfs acl and set umask to 027 086 conf.setBoolean("dfs.namenode.acls.enabled", true); 087 conf.set("fs.permissions.umask-mode", "027"); 088 // enable hbase hdfs acl feature 089 conf.setBoolean(SnapshotScannerHDFSAclHelper.ACL_SYNC_TO_HDFS_ENABLE, true); 090 // enable secure 091 conf.set(User.HBASE_SECURITY_CONF_KEY, "simple"); 092 conf.set(SnapshotScannerHDFSAclHelper.SNAPSHOT_RESTORE_TMP_DIR, 093 SnapshotScannerHDFSAclHelper.SNAPSHOT_RESTORE_TMP_DIR_DEFAULT); 094 SecureTestUtil.enableSecurity(conf); 095 // add SnapshotScannerHDFSAclController coprocessor 096 conf.set(CoprocessorHost.MASTER_COPROCESSOR_CONF_KEY, 097 conf.get(CoprocessorHost.MASTER_COPROCESSOR_CONF_KEY) + "," 098 + SnapshotScannerHDFSAclController.class.getName()); 099 100 TEST_UTIL.startMiniCluster(); 101 SnapshotScannerHDFSAclController coprocessor = TEST_UTIL.getHBaseCluster().getMaster() 102 .getMasterCoprocessorHost().findCoprocessor(SnapshotScannerHDFSAclController.class); 103 TEST_UTIL.waitFor(30000, () -> coprocessor.checkInitialized("check initialized")); 104 TEST_UTIL.waitTableAvailable(PermissionStorage.ACL_TABLE_NAME); 105 106 admin = TEST_UTIL.getAdmin(); 107 rootDir = TEST_UTIL.getDefaultRootDirPath(); 108 FS = rootDir.getFileSystem(conf); 109 unGrantUser = User.createUserForTesting(conf, UN_GRANT_USER, new String[] {}); 110 helper = new SnapshotScannerHDFSAclHelper(conf, admin.getConnection()); 111 112 // set hbase directory permission 113 FsPermission commonDirectoryPermission = 114 new FsPermission(conf.get(SnapshotScannerHDFSAclHelper.COMMON_DIRECTORY_PERMISSION, 115 SnapshotScannerHDFSAclHelper.COMMON_DIRECTORY_PERMISSION_DEFAULT)); 116 Path path = rootDir; 117 while (path != null) { 118 FS.setPermission(path, commonDirectoryPermission); 119 path = path.getParent(); 120 } 121 // set restore directory permission 122 Path restoreDir = new Path(SnapshotScannerHDFSAclHelper.SNAPSHOT_RESTORE_TMP_DIR_DEFAULT); 123 if (!FS.exists(restoreDir)) { 124 FS.mkdirs(restoreDir); 125 FS.setPermission(restoreDir, 126 new FsPermission( 127 conf.get(SnapshotScannerHDFSAclHelper.SNAPSHOT_RESTORE_DIRECTORY_PERMISSION, 128 SnapshotScannerHDFSAclHelper.SNAPSHOT_RESTORE_DIRECTORY_PERMISSION_DEFAULT))); 129 } 130 path = restoreDir.getParent(); 131 while (path != null) { 132 FS.setPermission(path, commonDirectoryPermission); 133 path = path.getParent(); 134 } 135 aclTable = admin.getConnection().getTable(PermissionStorage.ACL_TABLE_NAME); 136 } 137 138 @AfterClass 139 public static void tearDownAfterClass() throws Exception { 140 TEST_UTIL.shutdownMiniCluster(); 141 } 142 143 private void snapshotAndWait(final String snapShotName, final TableName tableName) 144 throws Exception { 145 admin.snapshot(snapShotName, tableName); 146 LOG.info("Sleep for one second, waiting for HDFS Acl setup"); 147 Threads.sleep(3000); 148 } 149 150 @Test 151 public void testGrantGlobal1() throws Exception { 152 final String grantUserName = name.getMethodName(); 153 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 154 String namespace = name.getMethodName(); 155 TableName table = TableName.valueOf(namespace, name.getMethodName()); 156 String snapshot1 = namespace + "s1"; 157 String snapshot2 = namespace + "s2"; 158 159 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 160 snapshotAndWait(snapshot1, table); 161 // grant G(R) 162 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 163 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 164 assertTrue(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 165 // grant G(W) with merging existing permissions 166 admin.grant( 167 new UserPermission(grantUserName, Permission.newBuilder().withActions(WRITE).build()), true); 168 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 169 assertTrue(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 170 // grant G(W) without merging 171 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, WRITE); 172 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, -1); 173 assertFalse(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 174 // grant G(R) 175 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 176 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 177 // take a snapshot and ACLs are inherited automatically 178 snapshotAndWait(snapshot2, table); 179 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot2, 6); 180 assertTrue(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 181 deleteTable(table); 182 } 183 184 @Test 185 public void testGrantGlobal2() throws Exception { 186 final String grantUserName = name.getMethodName(); 187 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 188 String namespace1 = name.getMethodName(); 189 TableName table1 = TableName.valueOf(namespace1, name.getMethodName() + ".1"); 190 String namespace2 = namespace1 + "2"; 191 TableName table2 = TableName.valueOf(namespace2, name.getMethodName() + ".2"); 192 String snapshot1 = namespace1 + "s1"; 193 String snapshot2 = namespace2 + "s2"; 194 195 // grant G(R), grant namespace1(R) 196 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 197 // create table in namespace1 and snapshot 198 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table1); 199 snapshotAndWait(snapshot1, table1); 200 admin.grant(new UserPermission(grantUserName, 201 Permission.newBuilder(namespace1).withActions(READ).build()), false); 202 // grant G(W) 203 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, WRITE); 204 // create table in namespace2 and snapshot 205 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table2); 206 snapshotAndWait(snapshot2, table2); 207 // check scan snapshot 208 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 209 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot2, -1); 210 assertFalse(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 211 assertTrue(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace1)); 212 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace2)); 213 checkUserAclEntry(FS, helper.getGlobalRootPaths(), grantUserName, false, false); 214 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace1), grantUserName, true, true); 215 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace2), grantUserName, false, false); 216 deleteTable(table1); 217 deleteTable(table2); 218 } 219 220 @Test 221 public void testGrantGlobal3() throws Exception { 222 final String grantUserName = name.getMethodName(); 223 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 224 String namespace = name.getMethodName(); 225 TableName table1 = TableName.valueOf(namespace, name.getMethodName() + ".1"); 226 TableName table2 = TableName.valueOf(namespace, name.getMethodName() + ".2"); 227 String snapshot1 = namespace + "s1"; 228 String snapshot2 = namespace + "s2"; 229 // grant G(R) 230 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 231 // grant table1(R) 232 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table1); 233 snapshotAndWait(snapshot1, table1); 234 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table1, READ); 235 // grant G(W) 236 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, WRITE); 237 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table2); 238 snapshotAndWait(snapshot2, table2); 239 // check scan snapshot 240 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 241 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot2, -1); 242 assertFalse(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 243 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 244 assertTrue(hasUserTableHdfsAcl(aclTable, grantUserName, table1)); 245 assertFalse(hasUserTableHdfsAcl(aclTable, grantUserName, table2)); 246 checkUserAclEntry(FS, helper.getGlobalRootPaths(), grantUserName, false, false); 247 checkUserAclEntry(FS, helper.getTableRootPaths(table2, false), grantUserName, false, false); 248 checkUserAclEntry(FS, helper.getTableRootPaths(table1, false), grantUserName, true, true); 249 deleteTable(table1); 250 deleteTable(table2); 251 } 252 253 @Test 254 public void testGrantNamespace1() throws Exception { 255 final String grantUserName = name.getMethodName(); 256 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 257 String namespace = name.getMethodName(); 258 TableName table1 = TableName.valueOf(namespace, name.getMethodName() + ".1"); 259 TableName table2 = TableName.valueOf(namespace, name.getMethodName() + ".2"); 260 String snapshot1 = namespace + "s1"; 261 String snapshot2 = namespace + "s2"; 262 263 // create table1 and snapshot 264 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table1); 265 snapshotAndWait(snapshot1, table1); 266 // grant N(R) 267 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 268 // create table2 and snapshot, ACLs can be inherited automatically 269 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table2); 270 snapshotAndWait(snapshot2, table2); 271 // check scan snapshot 272 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 273 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot2, 6); 274 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, unGrantUser, snapshot1, -1); 275 assertTrue(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 276 assertFalse(hasUserTableHdfsAcl(aclTable, grantUserName, table1)); 277 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, true, true); 278 // grant N(W) 279 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, WRITE); 280 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, -1); 281 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 282 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, false, false); 283 deleteTable(table1); 284 deleteTable(table2); 285 } 286 287 @Test 288 public void testGrantNamespace2() throws Exception { 289 final String grantUserName = name.getMethodName(); 290 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 291 String namespace = name.getMethodName(); 292 TableName table1 = TableName.valueOf(namespace, name.getMethodName()); 293 String snapshot1 = namespace + "s1"; 294 295 // create table1 and snapshot 296 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table1); 297 snapshotAndWait(snapshot1, table1); 298 299 // grant N(R) 300 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 301 // grant table1(R) 302 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table1, READ); 303 // grant N(W) 304 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, WRITE); 305 // check scan snapshot 306 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 307 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 308 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, true, false); 309 assertTrue(hasUserTableHdfsAcl(aclTable, grantUserName, table1)); 310 checkUserAclEntry(FS, helper.getTableRootPaths(table1, false), grantUserName, true, true); 311 deleteTable(table1); 312 } 313 314 @Test 315 public void testGrantNamespace3() throws Exception { 316 final String grantUserName = name.getMethodName(); 317 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 318 String namespace = name.getMethodName(); 319 TableName table = TableName.valueOf(namespace, name.getMethodName()); 320 String snapshot = namespace + "t1"; 321 322 // create table1 and snapshot 323 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 324 snapshotAndWait(snapshot, table); 325 // grant namespace(R) 326 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 327 // grant global(R) 328 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 329 // grant namespace(W) 330 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, WRITE); 331 // check scan snapshot 332 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 333 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 334 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, true, true); 335 assertTrue(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 336 checkUserAclEntry(FS, helper.getGlobalRootPaths(), grantUserName, true, true); 337 deleteTable(table); 338 } 339 340 @Test 341 public void testGrantTable() throws Exception { 342 final String grantUserName = name.getMethodName(); 343 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 344 345 String namespace = name.getMethodName(); 346 TableName table1 = TableName.valueOf(namespace, name.getMethodName()); 347 String snapshot1 = namespace + "s1"; 348 String snapshot2 = namespace + "s2"; 349 350 LOG.info("Create table"); 351 try (Table t = TestHDFSAclHelper.createTable(TEST_UTIL, table1)) { 352 TestHDFSAclHelper.put(t); 353 snapshotAndWait(snapshot1, table1); 354 // table owner can scan table snapshot 355 LOG.info("Scan snapshot"); 356 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, 357 User.createUserForTesting(conf, "owner", new String[] {}), snapshot1, 6); 358 // grant table1 family(R) 359 SecureTestUtil.grantOnTable(TEST_UTIL, grantUserName, table1, TestHDFSAclHelper.COLUMN1, null, 360 READ); 361 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, -1); 362 363 // grant table1(R) 364 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table1, READ); 365 TestHDFSAclHelper.put2(t); 366 snapshotAndWait(snapshot2, table1); 367 368 // check scan snapshot 369 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 370 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot2, 10); 371 assertTrue(hasUserTableHdfsAcl(aclTable, grantUserName, table1)); 372 checkUserAclEntry(FS, helper.getTableRootPaths(table1, false), grantUserName, true, true); 373 } 374 375 // grant table1(W) with merging existing permissions 376 admin.grant( 377 new UserPermission(grantUserName, Permission.newBuilder(table1).withActions(WRITE).build()), 378 true); 379 assertTrue(hasUserTableHdfsAcl(aclTable, grantUserName, table1)); 380 checkUserAclEntry(FS, helper.getTableRootPaths(table1, false), grantUserName, true, true); 381 382 // grant table1(W) without merging existing permissions 383 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table1, WRITE); 384 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, -1); 385 assertFalse(hasUserTableHdfsAcl(aclTable, grantUserName, table1)); 386 checkUserAclEntry(FS, helper.getTableRootPaths(table1, false), grantUserName, false, false); 387 deleteTable(table1); 388 } 389 390 @Test 391 public void testGrantMobTable() throws Exception { 392 final String grantUserName = name.getMethodName(); 393 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 394 String namespace = name.getMethodName(); 395 TableName table = TableName.valueOf(namespace, name.getMethodName()); 396 String snapshot = namespace + "s1"; 397 398 try (Table t = TestHDFSAclHelper.createMobTable(TEST_UTIL, table)) { 399 TestHDFSAclHelper.put(t); 400 snapshotAndWait(snapshot, table); 401 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table, READ); 402 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 403 assertTrue(hasUserTableHdfsAcl(aclTable, grantUserName, table)); 404 checkUserAclEntry(FS, helper.getTableRootPaths(table, false), grantUserName, true, true); 405 } 406 deleteTable(table); 407 } 408 409 @Test 410 public void testRevokeGlobal1() throws Exception { 411 final String grantUserName = name.getMethodName(); 412 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 413 String namespace = name.getMethodName(); 414 TableName table1 = TableName.valueOf(namespace, name.getMethodName()); 415 String snapshot1 = namespace + "t1"; 416 417 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table1); 418 snapshotAndWait(snapshot1, table1); 419 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 420 SecureTestUtil.revokeGlobal(TEST_UTIL, grantUserName, READ); 421 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, -1); 422 assertFalse(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 423 checkUserAclEntry(FS, helper.getGlobalRootPaths(), grantUserName, false, false); 424 deleteTable(table1); 425 } 426 427 @Test 428 public void testRevokeGlobal2() throws Exception { 429 final String grantUserName = name.getMethodName(); 430 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 431 432 String namespace = name.getMethodName(); 433 String snapshot1 = namespace + "s1"; 434 TableName table1 = TableName.valueOf(namespace, name.getMethodName()); 435 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table1); 436 snapshotAndWait(snapshot1, table1); 437 438 // grant G(R), grant N(R), grant T(R) -> revoke G(R) 439 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 440 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 441 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table1, READ); 442 SecureTestUtil.revokeGlobal(TEST_UTIL, grantUserName, READ); 443 // check scan snapshot 444 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 445 assertFalse(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 446 checkUserAclEntry(FS, helper.getGlobalRootPaths(), grantUserName, false, false); 447 assertTrue(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 448 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, true, true); 449 deleteTable(table1); 450 } 451 452 @Test 453 public void testRevokeGlobal3() throws Exception { 454 final String grantUserName = name.getMethodName(); 455 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 456 457 String namespace = name.getMethodName(); 458 TableName table1 = TableName.valueOf(namespace, name.getMethodName()); 459 String snapshot1 = namespace + "t1"; 460 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table1); 461 snapshotAndWait(snapshot1, table1); 462 463 // grant G(R), grant T(R) -> revoke G(R) 464 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 465 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table1, READ); 466 SecureTestUtil.revokeGlobal(TEST_UTIL, grantUserName, READ); 467 // check scan snapshot 468 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 469 assertFalse(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 470 checkUserAclEntry(FS, helper.getGlobalRootPaths(), grantUserName, false, false); 471 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 472 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, true, false); 473 assertTrue(hasUserTableHdfsAcl(aclTable, grantUserName, table1)); 474 checkUserAclEntry(FS, helper.getTableRootPaths(table1, false), grantUserName, true, true); 475 deleteTable(table1); 476 } 477 478 @Test 479 public void testRevokeNamespace1() throws Exception { 480 String grantUserName = name.getMethodName(); 481 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 482 String namespace = name.getMethodName(); 483 TableName table1 = TableName.valueOf(namespace, name.getMethodName()); 484 String snapshot1 = namespace + "s1"; 485 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table1); 486 snapshotAndWait(snapshot1, table1); 487 488 // revoke N(R) 489 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 490 admin.revoke(new UserPermission(grantUserName, Permission.newBuilder(namespace).build())); 491 // check scan snapshot 492 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, -1); 493 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 494 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, false, false); 495 496 // grant N(R), grant G(R) -> revoke N(R) 497 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 498 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 499 admin.revoke(new UserPermission(grantUserName, Permission.newBuilder(namespace).build())); 500 // check scan snapshot 501 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot1, 6); 502 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 503 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, true, true); 504 deleteTable(table1); 505 } 506 507 @Test 508 public void testRevokeNamespace2() throws Exception { 509 String grantUserName = name.getMethodName(); 510 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 511 String namespace = name.getMethodName(); 512 TableName table = TableName.valueOf(namespace, name.getMethodName()); 513 String snapshot = namespace + "s1"; 514 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 515 snapshotAndWait(snapshot, table); 516 517 // grant N(R), grant T(R) -> revoke N(R) 518 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 519 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table, READ); 520 SecureTestUtil.revokeFromNamespace(TEST_UTIL, grantUserName, namespace, READ); 521 // check scan snapshot 522 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 523 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 524 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, true, false); 525 assertTrue(hasUserTableHdfsAcl(aclTable, grantUserName, table)); 526 checkUserAclEntry(FS, helper.getTableRootPaths(table, false), grantUserName, true, true); 527 deleteTable(table); 528 } 529 530 @Test 531 public void testRevokeTable1() throws Exception { 532 final String grantUserName = name.getMethodName(); 533 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 534 String namespace = name.getMethodName(); 535 TableName table = TableName.valueOf(namespace, name.getMethodName()); 536 String snapshot = namespace + "t1"; 537 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 538 snapshotAndWait(snapshot, table); 539 540 // grant T(R) -> revoke table family 541 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table, READ); 542 SecureTestUtil.revokeFromTable(TEST_UTIL, grantUserName, table, TestHDFSAclHelper.COLUMN1, null, 543 READ); 544 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 545 546 // grant T(R) -> revoke T(R) 547 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table, READ); 548 admin.revoke(new UserPermission(grantUserName, Permission.newBuilder(table).build())); 549 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, -1); 550 assertFalse(hasUserTableHdfsAcl(aclTable, grantUserName, table)); 551 checkUserAclEntry(FS, helper.getTableRootPaths(table, false), grantUserName, false, false); 552 deleteTable(table); 553 } 554 555 @Test 556 public void testRevokeTable2() throws Exception { 557 final String grantUserName = name.getMethodName(); 558 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 559 String namespace = name.getMethodName(); 560 TableName table = TableName.valueOf(namespace, name.getMethodName()); 561 String snapshot = namespace + "t1"; 562 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 563 snapshotAndWait(snapshot, table); 564 565 // grant T(R), grant N(R) -> revoke T(R) 566 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table, READ); 567 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 568 admin.revoke(new UserPermission(grantUserName, Permission.newBuilder(table).build())); 569 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 570 assertFalse(hasUserTableHdfsAcl(aclTable, grantUserName, table)); 571 checkUserAclEntry(FS, helper.getTableRootPaths(table, false), grantUserName, true, true); 572 assertTrue(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 573 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, true, true); 574 deleteTable(table); 575 } 576 577 @Test 578 public void testRevokeTable3() throws Exception { 579 final String grantUserName = name.getMethodName(); 580 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 581 String namespace = name.getMethodName(); 582 TableName table = TableName.valueOf(namespace, name.getMethodName()); 583 String snapshot = namespace + "t1"; 584 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 585 snapshotAndWait(snapshot, table); 586 587 // grant T(R), grant G(R) -> revoke T(R) 588 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table, READ); 589 SecureTestUtil.grantGlobal(TEST_UTIL, grantUserName, READ); 590 admin.revoke(new UserPermission(grantUserName, Permission.newBuilder(table).build())); 591 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 592 assertFalse(hasUserTableHdfsAcl(aclTable, grantUserName, table)); 593 checkUserAclEntry(FS, helper.getTableRootPaths(table, false), grantUserName, true, true); 594 assertTrue(hasUserGlobalHdfsAcl(aclTable, grantUserName)); 595 checkUserAclEntry(FS, helper.getGlobalRootPaths(), grantUserName, true, true); 596 deleteTable(table); 597 } 598 599 @Test 600 public void testTruncateTable() throws Exception { 601 String grantUserName = name.getMethodName(); 602 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 603 String grantUserName2 = grantUserName + "2"; 604 User grantUser2 = User.createUserForTesting(conf, grantUserName2, new String[] {}); 605 606 String namespace = name.getMethodName(); 607 TableName tableName = TableName.valueOf(namespace, name.getMethodName()); 608 String snapshot = namespace + "s1"; 609 String snapshot2 = namespace + "s2"; 610 try (Table t = TestHDFSAclHelper.createTable(TEST_UTIL, tableName)) { 611 TestHDFSAclHelper.put(t); 612 // snapshot 613 snapshotAndWait(snapshot, tableName); 614 // grant user2 namespace permission 615 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName2, namespace, READ); 616 // grant user table permission 617 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, tableName, READ); 618 // truncate table 619 admin.disableTable(tableName); 620 admin.truncateTable(tableName, true); 621 TestHDFSAclHelper.put2(t); 622 // snapshot 623 snapshotAndWait(snapshot2, tableName); 624 // check scan snapshot 625 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 626 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser2, snapshot, 6); 627 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot2, 9); 628 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser2, snapshot2, 9); 629 assertTrue(hasUserNamespaceHdfsAcl(aclTable, grantUserName2, namespace)); 630 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName2, true, true); 631 assertTrue(hasUserTableHdfsAcl(aclTable, grantUserName, tableName)); 632 checkUserAclEntry(FS, helper.getTableRootPaths(tableName, false), grantUserName, true, true); 633 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName, true, false); 634 } 635 deleteTable(tableName); 636 } 637 638 @Test 639 public void testDeleteTable() throws Exception { 640 String namespace = name.getMethodName(); 641 String grantUserName1 = namespace + "1"; 642 String grantUserName2 = namespace + "2"; 643 User grantUser1 = User.createUserForTesting(conf, grantUserName1, new String[] {}); 644 User grantUser2 = User.createUserForTesting(conf, grantUserName2, new String[] {}); 645 TableName table = TableName.valueOf(namespace, name.getMethodName()); 646 String snapshot1 = namespace + "t1"; 647 648 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 649 // snapshot 650 snapshotAndWait(snapshot1, table); 651 // grant user table permission 652 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName1, table, READ); 653 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName2, namespace, READ); 654 // delete table 655 admin.disableTable(table); 656 admin.deleteTable(table); 657 // grantUser2 should have data/ns acl 658 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser1, snapshot1, -1); 659 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser2, snapshot1, 6); 660 assertTrue(hasUserNamespaceHdfsAcl(aclTable, grantUserName2, namespace)); 661 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), grantUserName2, true, true); 662 assertFalse(hasUserTableHdfsAcl(aclTable, grantUserName1, table)); 663 checkUserAclEntry(FS, helper.getPathHelper().getDataTableDir(table), grantUserName1, false, 664 false); 665 checkUserAclEntry(FS, helper.getPathHelper().getMobTableDir(table), grantUserName1, false, 666 false); 667 checkUserAclEntry(FS, helper.getPathHelper().getArchiveTableDir(table), grantUserName1, true, 668 false); 669 670 // check tmp table directory does not exist 671 Path tmpTableDir = helper.getPathHelper().getTmpTableDir(table); 672 assertFalse(FS.exists(tmpTableDir)); 673 deleteTable(table); 674 } 675 676 @Test 677 public void testDeleteTable2() throws Exception { 678 String namespace1 = name.getMethodName() + "1"; 679 String namespace2 = name.getMethodName() + "2"; 680 String grantUser = name.getMethodName(); 681 TableName table = TableName.valueOf(namespace1, name.getMethodName()); 682 683 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 684 // grant user table permission 685 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUser, table, READ); 686 // grant user other namespace permission 687 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUser, namespace2, READ); 688 // delete table 689 admin.disableTable(table); 690 admin.deleteTable(table); 691 // grantUser should have namespace2's acl 692 assertFalse(hasUserTableHdfsAcl(aclTable, grantUser, table)); 693 assertTrue(hasUserNamespaceHdfsAcl(aclTable, grantUser, namespace2)); 694 } 695 696 @Test 697 public void testDeleteNamespace() throws Exception { 698 String grantUserName = name.getMethodName(); 699 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 700 String namespace = name.getMethodName(); 701 TableName table = TableName.valueOf(namespace, name.getMethodName()); 702 String snapshot = namespace + "t1"; 703 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 704 // snapshot 705 snapshotAndWait(snapshot, table); 706 // grant namespace permission 707 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 708 // delete table 709 admin.disableTable(table); 710 admin.deleteTable(table); 711 // delete namespace 712 admin.deleteNamespace(namespace); 713 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 714 assertFalse(hasUserNamespaceHdfsAcl(aclTable, grantUserName, namespace)); 715 checkUserAclEntry(FS, helper.getPathHelper().getArchiveNsDir(namespace), grantUserName, true, 716 false); 717 718 // check tmp namespace dir does not exist 719 assertFalse(FS.exists(helper.getPathHelper().getTmpNsDir(namespace))); 720 assertFalse(FS.exists(helper.getPathHelper().getDataNsDir(namespace))); 721 // assertFalse(fs.exists(FS, helper.getPathHelper().getMobDataNsDir(namespace))); 722 deleteTable(table); 723 } 724 725 @Test 726 public void testCleanArchiveTableDir() throws Exception { 727 final String grantUserName = name.getMethodName(); 728 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 729 String namespace = name.getMethodName(); 730 TableName table = TableName.valueOf(namespace, name.getMethodName()); 731 String snapshot = namespace + "t1"; 732 733 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 734 snapshotAndWait(snapshot, table); 735 TestHDFSAclHelper.grantOnTable(TEST_UTIL, grantUserName, table, READ); 736 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 737 738 // HFileCleaner will not delete archive table directory even if it's a empty directory 739 HFileCleaner cleaner = TEST_UTIL.getHBaseCluster().getMaster().getHFileCleaner(); 740 cleaner.choreForTesting(); 741 Path archiveTableDir = HFileArchiveUtil.getTableArchivePath(rootDir, table); 742 assertTrue(FS.exists(archiveTableDir)); 743 checkUserAclEntry(FS, helper.getTableRootPaths(table, false), grantUserName, true, true); 744 745 // Check SnapshotScannerHDFSAclCleaner method 746 assertTrue(SnapshotScannerHDFSAclCleaner.isArchiveTableDir(archiveTableDir)); 747 assertTrue(SnapshotScannerHDFSAclCleaner.isArchiveNamespaceDir(archiveTableDir.getParent())); 748 assertTrue( 749 SnapshotScannerHDFSAclCleaner.isArchiveDataDir(archiveTableDir.getParent().getParent())); 750 assertFalse(SnapshotScannerHDFSAclCleaner 751 .isArchiveDataDir(archiveTableDir.getParent().getParent().getParent())); 752 deleteTable(table); 753 } 754 755 @Test 756 public void testModifyTable1() throws Exception { 757 String namespace = name.getMethodName(); 758 TableName table = TableName.valueOf(namespace, name.getMethodName()); 759 String snapshot = namespace + "t1"; 760 761 String tableUserName = name.getMethodName(); 762 User tableUser = User.createUserForTesting(conf, tableUserName, new String[] {}); 763 String tableUserName2 = tableUserName + "2"; 764 User tableUser2 = User.createUserForTesting(conf, tableUserName2, new String[] {}); 765 String tableUserName3 = tableUserName + "3"; 766 User tableUser3 = User.createUserForTesting(conf, tableUserName3, new String[] {}); 767 String nsUserName = tableUserName + "-ns"; 768 User nsUser = User.createUserForTesting(conf, nsUserName, new String[] {}); 769 String globalUserName = tableUserName + "-global"; 770 User globalUser = User.createUserForTesting(conf, globalUserName, new String[] {}); 771 String globalUserName2 = tableUserName + "-global-2"; 772 User globalUser2 = User.createUserForTesting(conf, globalUserName2, new String[] {}); 773 774 SecureTestUtil.grantGlobal(TEST_UTIL, globalUserName, READ); 775 TestHDFSAclHelper.createNamespace(TEST_UTIL, namespace); 776 SecureTestUtil.grantOnNamespace(TEST_UTIL, nsUserName, namespace, READ); 777 TableDescriptor td = TestHDFSAclHelper.createUserScanSnapshotDisabledTable(TEST_UTIL, table); 778 snapshotAndWait(snapshot, table); 779 SecureTestUtil.grantGlobal(TEST_UTIL, globalUserName2, READ); 780 TestHDFSAclHelper.grantOnTable(TEST_UTIL, tableUserName, table, READ); 781 SecureTestUtil.grantOnTable(TEST_UTIL, tableUserName2, table, TestHDFSAclHelper.COLUMN1, null, 782 READ); 783 TestHDFSAclHelper.grantOnTable(TEST_UTIL, tableUserName3, table, WRITE); 784 785 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, tableUser, snapshot, -1); 786 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, tableUser2, snapshot, -1); 787 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, tableUser3, snapshot, -1); 788 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, nsUser, snapshot, -1); 789 // Global permission is set before table is created, the acl is inherited 790 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, globalUser, snapshot, 6); 791 // Global permission is set after table is created, the table dir acl is skip 792 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, globalUser2, snapshot, -1); 793 794 // enable user scan snapshot 795 admin.modifyTable(TableDescriptorBuilder.newBuilder(td) 796 .setValue(SnapshotScannerHDFSAclHelper.ACL_SYNC_TO_HDFS_ENABLE, "true").build()); 797 // check scan snapshot 798 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, tableUser, snapshot, 6); 799 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, tableUser2, snapshot, -1); 800 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, tableUser3, snapshot, -1); 801 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, nsUser, snapshot, 6); 802 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, globalUser, snapshot, 6); 803 // check acl table storage and ACLs in dirs 804 assertTrue(hasUserGlobalHdfsAcl(aclTable, globalUserName)); 805 checkUserAclEntry(FS, helper.getGlobalRootPaths(), globalUserName, true, true); 806 assertTrue(hasUserNamespaceHdfsAcl(aclTable, nsUserName, namespace)); 807 checkUserAclEntry(FS, helper.getNamespaceRootPaths(namespace), nsUserName, true, true); 808 assertTrue(hasUserTableHdfsAcl(aclTable, tableUserName, table)); 809 checkUserAclEntry(FS, helper.getTableRootPaths(table, false), tableUserName, true, true); 810 for (String user : new String[] { tableUserName2, tableUserName3 }) { 811 assertFalse(hasUserTableHdfsAcl(aclTable, user, table)); 812 checkUserAclEntry(FS, helper.getTableRootPaths(table, false), user, false, false); 813 } 814 deleteTable(table); 815 } 816 817 @Test 818 public void testModifyTable2() throws Exception { 819 String namespace = name.getMethodName(); 820 TableName table = TableName.valueOf(namespace, name.getMethodName() + ".1"); 821 String snapshot = namespace + "t1"; 822 TableName table2 = TableName.valueOf(namespace, name.getMethodName() + ".2"); 823 824 String tableUserName = name.getMethodName(); 825 User tableUser = User.createUserForTesting(conf, tableUserName, new String[] {}); 826 String tableUserName2 = tableUserName + "2"; 827 User tableUser2 = User.createUserForTesting(conf, tableUserName2, new String[] {}); 828 String tableUserName3 = tableUserName + "3"; 829 User tableUser3 = User.createUserForTesting(conf, tableUserName3, new String[] {}); 830 String nsUserName = tableUserName + "-ns"; 831 User nsUser = User.createUserForTesting(conf, nsUserName, new String[] {}); 832 String globalUserName = tableUserName + "-global"; 833 User globalUser = User.createUserForTesting(conf, globalUserName, new String[] {}); 834 String globalUserName2 = tableUserName + "-global-2"; 835 User globalUser2 = User.createUserForTesting(conf, globalUserName2, new String[] {}); 836 837 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 838 SecureTestUtil.grantGlobal(TEST_UTIL, globalUserName, READ); 839 SecureTestUtil.grantGlobal(TEST_UTIL, globalUserName2, READ); 840 SecureTestUtil.grantOnNamespace(TEST_UTIL, nsUserName, namespace, READ); 841 TestHDFSAclHelper.grantOnTable(TEST_UTIL, tableUserName, table, READ); 842 SecureTestUtil.grantOnTable(TEST_UTIL, tableUserName2, table, TestHDFSAclHelper.COLUMN1, null, 843 READ); 844 TestHDFSAclHelper.grantOnTable(TEST_UTIL, tableUserName3, table, WRITE); 845 846 SecureTestUtil.grantOnNamespace(TEST_UTIL, tableUserName2, namespace, READ); 847 TestHDFSAclHelper.createTable(TEST_UTIL, table2); 848 TestHDFSAclHelper.grantOnTable(TEST_UTIL, tableUserName3, table2, READ); 849 // disable user scan snapshot 850 admin.modifyTable(TableDescriptorBuilder.newBuilder(admin.getDescriptor(table)) 851 .setValue(SnapshotScannerHDFSAclHelper.ACL_SYNC_TO_HDFS_ENABLE, "false").build()); 852 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, tableUser, snapshot, -1); 853 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, tableUser2, snapshot, -1); 854 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, tableUser3, snapshot, -1); 855 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, nsUser, snapshot, -1); 856 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, globalUser, snapshot, -1); 857 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, globalUser2, snapshot, -1); 858 // check access 859 String[] users = new String[] { globalUserName, globalUserName2, nsUserName, tableUserName, 860 tableUserName2, tableUserName3 }; 861 for (Path path : helper.getTableRootPaths(table, false)) { 862 for (String user : users) { 863 checkUserAclEntry(FS, path, user, false, false); 864 } 865 } 866 String[] nsUsers = new String[] { globalUserName, globalUserName2, nsUserName }; 867 for (Path path : helper.getNamespaceRootPaths(namespace)) { 868 checkUserAclEntry(FS, path, tableUserName, false, false); 869 checkUserAclEntry(FS, path, tableUserName2, true, true); 870 checkUserAclEntry(FS, path, tableUserName3, true, false); 871 for (String user : nsUsers) { 872 checkUserAclEntry(FS, path, user, true, true); 873 } 874 } 875 assertTrue(hasUserNamespaceHdfsAcl(aclTable, nsUserName, namespace)); 876 assertTrue(hasUserNamespaceHdfsAcl(aclTable, tableUserName2, namespace)); 877 assertFalse(hasUserTableHdfsAcl(aclTable, tableUserName, table)); 878 deleteTable(table); 879 deleteTable(table2); 880 } 881 882 @Test 883 public void testRestartMaster() throws Exception { 884 final String grantUserName = name.getMethodName(); 885 User grantUser = User.createUserForTesting(conf, grantUserName, new String[] {}); 886 String namespace = name.getMethodName(); 887 TableName table = TableName.valueOf(namespace, name.getMethodName() + ".1"); 888 TableName table2 = TableName.valueOf(namespace, name.getMethodName() + ".2"); 889 String snapshot = namespace + "t1"; 890 admin.createNamespace(NamespaceDescriptor.create(namespace).build()); 891 892 // create table2 893 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table2); 894 // make some region files in tmp dir and check if master archive these region correctly 895 Path tmpTableDir = helper.getPathHelper().getTmpTableDir(table2); 896 // make a empty region dir, this is an error region 897 FS.mkdirs(new Path(tmpTableDir, "1")); 898 // copy regions from data dir, this is a valid region 899 for (Path regionDir : FSUtils.getRegionDirs(FS, 900 helper.getPathHelper().getDataTableDir(table2))) { 901 FSUtils.copyFilesParallel(FS, regionDir, FS, 902 new Path(tmpTableDir, regionDir.getName() + "abc"), conf, 1); 903 } 904 assertEquals(4, FS.listStatus(tmpTableDir).length); 905 906 // grant N(R) 907 SecureTestUtil.grantOnNamespace(TEST_UTIL, grantUserName, namespace, READ); 908 // restart cluster and tmp directory will not be deleted 909 TEST_UTIL.getMiniHBaseCluster().shutdown(); 910 TEST_UTIL.restartHBaseCluster(1); 911 TEST_UTIL.waitUntilNoRegionsInTransition(); 912 913 // reset the cached configs after restart 914 conf = TEST_UTIL.getConfiguration(); 915 admin = TEST_UTIL.getAdmin(); 916 helper = new SnapshotScannerHDFSAclHelper(conf, admin.getConnection()); 917 918 Path tmpNsDir = helper.getPathHelper().getTmpNsDir(namespace); 919 assertTrue(FS.exists(tmpNsDir)); 920 // check all regions in tmp table2 dir are archived 921 assertEquals(0, FS.listStatus(tmpTableDir).length); 922 923 // create table1 and snapshot 924 TestHDFSAclHelper.createTableAndPut(TEST_UTIL, table); 925 aclTable = TEST_UTIL.getConnection().getTable(PermissionStorage.ACL_TABLE_NAME); 926 snapshotAndWait(snapshot, table); 927 TestHDFSAclHelper.canUserScanSnapshot(TEST_UTIL, grantUser, snapshot, 6); 928 deleteTable(table); 929 deleteTable(table2); 930 } 931 932 static void checkUserAclEntry(FileSystem fs, List<Path> paths, String user, 933 boolean requireAccessAcl, boolean requireDefaultAcl) throws Exception { 934 for (Path path : paths) { 935 checkUserAclEntry(fs, path, user, requireAccessAcl, requireDefaultAcl); 936 } 937 } 938 939 static void checkUserAclEntry(FileSystem fs, Path path, String userName, boolean requireAccessAcl, 940 boolean requireDefaultAcl) throws IOException { 941 boolean accessAclEntry = false; 942 boolean defaultAclEntry = false; 943 if (fs.exists(path)) { 944 for (AclEntry aclEntry : fs.getAclStatus(path).getEntries()) { 945 String user = aclEntry.getName(); 946 if (user != null && user.equals(userName)) { 947 if (aclEntry.getScope() == AclEntryScope.DEFAULT) { 948 defaultAclEntry = true; 949 } else if (aclEntry.getScope() == AclEntryScope.ACCESS) { 950 accessAclEntry = true; 951 } 952 } 953 } 954 } 955 String message = "require user: " + userName + ", path: " + path.toString() + " acl"; 956 assertEquals(message, requireAccessAcl, accessAclEntry); 957 assertEquals(message, requireDefaultAcl, defaultAclEntry); 958 } 959 960 static void deleteTable(TableName tableName) { 961 try { 962 admin.disableTable(tableName); 963 admin.deleteTable(tableName); 964 } catch (IOException e) { 965 LOG.warn("Failed to delete table: {}", tableName); 966 } 967 } 968}