question Is there a way a user other than hbase can export snapshots in a secure cluster? in Archives of Support Questions (Read Only)

Is there a way a user other than hbase can export snapshots in a secure cluster?

aervits — Tue, 10 May 2016 01:10:48 GMT

I gave user admin rights but that does not have any impact on user being able to copy export snapshots

hbase(main):001:0> user_permission 'vagrant'
User                           Namespace,Table,Family,Qualifier:Permission
 vagrant                       default,vagrant,,: [Permission: actions=READ,WRITE,EXEC,CREATE,ADMIN]

still getting

Caused by: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.AccessControlException): Permission denied: user=vagrant, access=EXECUTE, inode="/apps/hbase/data/.hbase-snapshot/vagrantsnap":hbase:hdfs:drwx------

would labels and scopes help in this case? What are my options at this point?

Re: Is there a way a user other than hbase can export snapshots in a secure cluster?

sunile_manjee — Wed, 11 May 2016 11:14:02 GMT

@Artem Ervits Per hbase documentation:

14.8.7. Snapshots operations and ACLs

If you are using security with the AccessController Coprocessor (See Section 8.2, “Access Control”), only a global administrator can take, clone, or restore a snapshot, and these actions do not capture the ACL rights. This means that restoring a table preserves the ACL rights of the existing table, while cloning a table creates a new table that has no ACL rights until the administrator adds them.

Re: Is there a way a user other than hbase can export snapshots in a secure cluster?

tyu — Thu, 12 May 2016 23:19:57 GMT

Please also refer to

http://hbase.apache.org/book.html#appendix_acl_matrix