[hbase] branch master updated: HBASE-25456 : add security check for setRegionStateInMeta (#2833)

[vjasani]

This is an automated email from the ASF dual-hosted git repository.

vjasani pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/hbase.git


The following commit(s) were added to refs/heads/master by this push:
     new 126d01d  HBASE-25456 : add security check for setRegionStateInMeta 
(#2833)
126d01d is described below

commit 126d01dae301711ad65911c744ddc584549a33d2
Author: lujiefsi <lujie...@foxmail.com>
AuthorDate: Fri Jan 1 14:47:34 2021 +0800

    HBASE-25456 : add security check for setRegionStateInMeta (#2833)
    
    Signed-off-by: Viraj Jasani <vjas...@apache.org>
---
 .../hadoop/hbase/master/MasterRpcServices.java     |  1 +
 .../security/access/TestAccessController.java      | 23 ++++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git 
a/hbase-server/src/main/java/org/apache/hadoop/hbase/master/MasterRpcServices.java
 
b/hbase-server/src/main/java/org/apache/hadoop/hbase/master/MasterRpcServices.java
index a117132..8f2f0da 100644
--- 
a/hbase-server/src/main/java/org/apache/hadoop/hbase/master/MasterRpcServices.java
+++ 
b/hbase-server/src/main/java/org/apache/hadoop/hbase/master/MasterRpcServices.java
@@ -2550,6 +2550,7 @@ public class MasterRpcServices extends RSRpcServices 
implements
   @Override
   public SetRegionStateInMetaResponse setRegionStateInMeta(RpcController 
controller,
     SetRegionStateInMetaRequest request) throws ServiceException {
+    rpcPreCheck("setRegionStateInMeta");
     SetRegionStateInMetaResponse.Builder builder = 
SetRegionStateInMetaResponse.newBuilder();
     try {
       for (RegionSpecifierAndState s : request.getStatesList()) {
diff --git 
a/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java
 
b/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java
index 7ab808c..1727617 100644
--- 
a/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java
+++ 
b/hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestAccessController.java
@@ -31,7 +31,10 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
+
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.fs.CommonConfigurationKeys;
 import org.apache.hadoop.fs.FileStatus;
@@ -88,6 +91,7 @@ import org.apache.hadoop.hbase.io.hfile.HFileContext;
 import org.apache.hadoop.hbase.io.hfile.HFileContextBuilder;
 import org.apache.hadoop.hbase.master.HMaster;
 import org.apache.hadoop.hbase.master.MasterCoprocessorHost;
+import org.apache.hadoop.hbase.master.RegionState;
 import org.apache.hadoop.hbase.master.locking.LockProcedure;
 import org.apache.hadoop.hbase.master.procedure.MasterProcedureEnv;
 import org.apache.hadoop.hbase.master.procedure.TableProcedureInterface;
@@ -396,6 +400,25 @@ public class TestAccessController extends SecureTestUtil {
   }
 
   @Test
+  public void testUnauthorizedSetRegionStateInMeta() throws Exception {
+    Admin admin = TEST_UTIL.getAdmin();
+    final List<RegionInfo> regions = admin.getRegions(TEST_TABLE);
+    RegionInfo closeRegion = regions.get(0);
+    Map<String, RegionState.State> newStates = new HashMap<>();
+    newStates.put(closeRegion.getEncodedName(), RegionState.State.CLOSED);
+    AccessTestAction action = () -> {
+      try(Connection conn = 
ConnectionFactory.createConnection(TEST_UTIL.getConfiguration());
+        Hbck hbck = conn.getHbck()){
+        hbck.setRegionStateInMeta(newStates);
+      }
+      return null;
+    };
+
+    verifyDenied(action, USER_CREATE, USER_OWNER, USER_RW, USER_RO, USER_NONE, 
USER_GROUP_READ,
+        USER_GROUP_WRITE, USER_GROUP_CREATE);
+  }
+
+  @Test
   public void testUnauthorizedFixMeta() throws Exception {
     AccessTestAction action = () -> {
       try(Connection conn = 
ConnectionFactory.createConnection(TEST_UTIL.getConfiguration());