HBASE-26228 updateRSGroupConfig operation should be authorized by AccessController

[pankaj72981]

No description provided.

[Apache-HBase]

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	2m 24s	Docker mode activated.
		_ Prechecks _
+1 💚	dupname	0m 1s	No case conflicting files found.
+1 💚	hbaseanti	0m 0s	Patch does not have any anti-patterns.
+1 💚	@author	0m 0s	The patch does not contain any @author tags.
		_ master Compile Tests _
+1 💚	mvninstall	4m 23s	master passed
+1 💚	compile	3m 24s	master passed
+1 💚	checkstyle	1m 11s	master passed
+1 💚	spotbugs	2m 14s	master passed
		_ Patch Compile Tests _
+1 💚	mvninstall	4m 1s	the patch passed
+1 💚	compile	3m 24s	the patch passed
+1 💚	javac	3m 24s	the patch passed
+1 💚	checkstyle	1m 8s	the patch passed
+1 💚	whitespace	0m 0s	The patch has no whitespace issues.
+1 💚	hadoopcheck	20m 7s	Patch does not cause any errors with Hadoop 3.1.2 3.2.1 3.3.0.
+1 💚	spotbugs	2m 22s	the patch passed
		_ Other Tests _
+1 💚	asflicense	0m 14s	The patch does not generate ASF License warnings.
		53m 16s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/HBase/job/HBase-PreCommit-GitHub-PR/job/PR-3633/1/artifact/yetus-general-check/output/Dockerfile
GITHUB PR	#3633
Optional Tests	dupname asflicense javac spotbugs hadoopcheck hbaseanti checkstyle compile
uname	Linux 879e06bf5206 4.15.0-143-generic #147-Ubuntu SMP Wed Apr 14 16:10:11 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / 735bcf8
Default Java	AdoptOpenJDK-1.8.0_282-b08
Max. process+thread count	86 (vs. ulimit of 30000)
modules	C: hbase-server U: hbase-server
Console output	https://ci-hadoop.apache.org/job/HBase/job/HBase-PreCommit-GitHub-PR/job/PR-3633/1/console
versions	git=2.17.1 maven=3.6.3 spotbugs=4.2.2
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

[Apache-HBase]

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	10m 28s	Docker mode activated.
-0 ⚠️	yetus	0m 4s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+1 💚	mvninstall	4m 42s	master passed
+1 💚	compile	1m 14s	master passed
+1 💚	shadedjars	8m 25s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 46s	master passed
		_ Patch Compile Tests _
+1 💚	mvninstall	4m 27s	the patch passed
+1 💚	compile	1m 15s	the patch passed
+1 💚	javac	1m 15s	the patch passed
+1 💚	shadedjars	8m 22s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 44s	the patch passed
		_ Other Tests _
+1 💚	unit	148m 47s	hbase-server in the patch passed.
		191m 32s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/HBase/job/HBase-PreCommit-GitHub-PR/job/PR-3633/1/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR	#3633
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux 70c6459218c8 4.15.0-65-generic #74-Ubuntu SMP Tue Sep 17 17:06:04 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / 735bcf8
Default Java	AdoptOpenJDK-11.0.10+9
Test Results	https://ci-hadoop.apache.org/job/HBase/job/HBase-PreCommit-GitHub-PR/job/PR-3633/1/testReport/
Max. process+thread count	3941 (vs. ulimit of 30000)
modules	C: hbase-server U: hbase-server
Console output	https://ci-hadoop.apache.org/job/HBase/job/HBase-PreCommit-GitHub-PR/job/PR-3633/1/console
versions	git=2.17.1 maven=3.6.3
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

[Apache-HBase]

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	0m 29s	Docker mode activated.
-0 ⚠️	yetus	0m 3s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+1 💚	mvninstall	4m 19s	master passed
+1 💚	compile	1m 5s	master passed
+1 💚	shadedjars	8m 47s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 43s	master passed
		_ Patch Compile Tests _
+1 💚	mvninstall	3m 58s	the patch passed
+1 💚	compile	1m 6s	the patch passed
+1 💚	javac	1m 6s	the patch passed
+1 💚	shadedjars	9m 31s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 37s	the patch passed
		_ Other Tests _
+1 💚	unit	160m 9s	hbase-server in the patch passed.
		193m 2s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/HBase/job/HBase-PreCommit-GitHub-PR/job/PR-3633/1/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR	#3633
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux ff3bdf8c27a2 4.15.0-151-generic #157-Ubuntu SMP Fri Jul 9 23:07:57 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / 735bcf8
Default Java	AdoptOpenJDK-1.8.0_282-b08
Test Results	https://ci-hadoop.apache.org/job/HBase/job/HBase-PreCommit-GitHub-PR/job/PR-3633/1/testReport/
Max. process+thread count	3887 (vs. ulimit of 30000)
modules	C: hbase-server U: hbase-server
Console output	https://ci-hadoop.apache.org/job/HBase/job/HBase-PreCommit-GitHub-PR/job/PR-3633/1/console
versions	git=2.17.1 maven=3.6.3
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

[Apache9]

Please fill the release note for this issue.

And maybe this should be declared as an incompatible issue? Though we are just fixing a bug.

[ZhaoBQ]

+1

[pankaj72981]

And maybe this should be declared as an incompatible issue?

It shouldn't be an incompatible change, ACL check is skipped only in master branch.

In branch-2 ACL is validated twice (we should correct it)

1. MasterRpcServices#execMasterService
   

   hbase/hbase-server/src/main/java/org/apache/hadoop/hbase/master/MasterRpcServices.java

   Line 891 in 3b1482e

   rpcPreCheck("execMasterService");

2. RSGroupAdminEndpoint (currently updateRSGroupConfig doesn't call checkPermission, but authorized in MasterRpcServices#execMasterService)
   

   hbase/hbase-rsgroup/src/main/java/org/apache/hadoop/hbase/rsgroup/RSGroupAdminEndpoint.java

   Line 259 in 3b1482e

   checkPermission("addRSGroup");