* Licensed under the Apache License, Version 2.0 (the "License");

* you may not use this file except in compliance with the License.

* You may obtain a copy of the License at

*

*     http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing, software

* distributed under the License is distributed on an "AS IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

* See the License for the specific language governing permissions and

* limitations under the License.

*/

* Provides basic authorization checks for data access and administrative

* operations.

*

* <p>

* {@code AccessController} performs authorization checks for HBase operations

* based on:

* <ul>

*   <li>the identity of the user performing the operation</li>

*   <li>the scope over which the operation is performed, in increasing

*   specificity: global, table, column family, or qualifier</li>

*   <li>the type of action being performed (as mapped to

*   {@link Permission.Action} values)</li>

* </ul>

* If the authorization check fails, an {@link AccessDeniedException}

* will be thrown for the operation.

* </p>

*

* <p>

* To perform authorization checks, {@code AccessController} relies on the

* RpcServerEngine being loaded to provide

* the user identities for remote requests.

* </p>

*

* <p>

* The access control lists used for authorization can be manipulated via the

* exposed {@link AccessControlService} Interface implementation, and the associated

* {@code grant}, {@code revoke}, and {@code user_permission} HBase shell

* commands.

* </p>

*/

    implements RegionServerObserver,

      AccessControlService.Interface, CoprocessorService, EndpointObserver, BulkLoadObserver {

  public static final Log LOG = LogFactory.getLog(AccessController.class);

  private static final Log AUDITLOG =

    LogFactory.getLog("SecurityLogger."+AccessController.class.getName());

  private static final String CHECK_COVERING_PERM = "check_covering_perm";

  private static final String TAG_CHECK_PASSED = "tag_check_passed";

  private static final byte[] TRUE = Bytes.toBytes(true);

  TableAuthManager authManager = null;

  // flags if we are running on a region of the _acl_ table

  boolean aclRegion = false;

  // defined only for Endpoint implementation, so it can have way to

  // access region services.

  private RegionCoprocessorEnvironment regionEnv;

  /** Mapping of scanner instances to the user who created them */

  private Map<InternalScanner,String> scannerOwners =

      new MapMaker().weakKeys().makeMap();

  private Map<TableName, List<UserPermission>> tableAcls;

  // Provider for mapping principal names to Users

  private UserProvider userProvider;

  // The list of users with superuser authority

  private List<String> superusers;

  // if we are able to support cell ACLs

  boolean cellFeaturesEnabled;

  // if we should check EXEC permissions

  boolean shouldCheckExecPermission;

  // if we should terminate access checks early as soon as table or CF grants

  // allow access; pre-0.98 compatible behavior

  boolean compatibleEarlyTermination;

  private volatile boolean initialized = false;

  // This boolean having relevance only in the Master.

  private volatile boolean aclTabAvailable = false;

  public HRegion getRegion() {

    return regionEnv != null ? regionEnv.getRegion() : null;

  }

  public TableAuthManager getAuthManager() {

    return authManager;

  }

  void initialize(RegionCoprocessorEnvironment e) throws IOException {

    final HRegion region = e.getRegion();

    Configuration conf = e.getConfiguration();

    Map<byte[], ListMultimap<String,TablePermission>> tables =

        AccessControlLists.loadAll(region);

    // For each table, write out the table's permissions to the respective

    // znode for that table.

    for (Map.Entry<byte[], ListMultimap<String,TablePermission>> t:

      tables.entrySet()) {

      byte[] entry = t.getKey();

      ListMultimap<String,TablePermission> perms = t.getValue();

      byte[] serialized = AccessControlLists.writePermissionsAsBytes(perms, conf);

      this.authManager.getZKPermissionWatcher().writeToZookeeper(entry, serialized);

    }

    initialized = true;

  }

  /**

   * Writes all table ACLs for the tables in the given Map up into ZooKeeper

   * znodes.  This is called to synchronize ACL changes following {@code _acl_}

   * table updates.

   */

  void updateACL(RegionCoprocessorEnvironment e,

      final Map<byte[], List<Cell>> familyMap) {

    Set<byte[]> entries =

        new TreeSet<byte[]>(Bytes.BYTES_RAWCOMPARATOR);

    for (Map.Entry<byte[], List<Cell>> f : familyMap.entrySet()) {

      List<Cell> cells = f.getValue();

      for (Cell cell: cells) {

        if (Bytes.equals(cell.getFamilyArray(), cell.getFamilyOffset(),

            cell.getFamilyLength(), AccessControlLists.ACL_LIST_FAMILY, 0,

            AccessControlLists.ACL_LIST_FAMILY.length)) {

          entries.add(CellUtil.cloneRow(cell));

        }

      }

    }

    ZKPermissionWatcher zkw = this.authManager.getZKPermissionWatcher();

    Configuration conf = regionEnv.getConfiguration();

    for (byte[] entry: entries) {

      try {

        ListMultimap<String,TablePermission> perms =

          AccessControlLists.getPermissions(conf, entry);

        byte[] serialized = AccessControlLists.writePermissionsAsBytes(perms, conf);

        zkw.writeToZookeeper(entry, serialized);

      } catch (IOException ex) {

        LOG.error("Failed updating permissions mirror for '" + Bytes.toString(entry) + "'",

            ex);

      }

    }

  }

  /**

   * Check the current user for authorization to perform a specific action

   * against the given set of row data.

   *

   * <p>Note: Ordering of the authorization checks

   * has been carefully optimized to short-circuit the most common requests

   * and minimize the amount of processing required.</p>

   *

   * @param permRequest the action being requested

   * @param e the coprocessor environment

   * @param families the map of column families to qualifiers present in

   * the request

   * @return an authorization result

   */

  AuthResult permissionGranted(String request, User user, Action permRequest,

      RegionCoprocessorEnvironment e,

      Map<byte [], ? extends Collection<?>> families) {

    HRegionInfo hri = e.getRegion().getRegionInfo();

    TableName tableName = hri.getTable();

    // 1. All users need read access to hbase:meta table.

    // this is a very common operation, so deal with it quickly.

    if (hri.isMetaRegion()) {

      if (permRequest == Action.READ) {

        return AuthResult.allow(request, "All users allowed", user,

          permRequest, tableName, families);

      }

    }

    if (user == null) {

      return AuthResult.deny(request, "No user associated with request!", null,

        permRequest, tableName, families);

    }

    // 2. check for the table-level, if successful we can short-circuit

    if (authManager.authorize(user, tableName, (byte[])null, permRequest)) {

      return AuthResult.allow(request, "Table permission granted", user,

        permRequest, tableName, families);

    }

    // 3. check permissions against the requested families

    if (families != null && families.size() > 0) {

      // all families must pass

      for (Map.Entry<byte [], ? extends Collection<?>> family : families.entrySet()) {

        // a) check for family level access

        if (authManager.authorize(user, tableName, family.getKey(),

            permRequest)) {

          continue;  // family-level permission overrides per-qualifier

        }

        // b) qualifier level access can still succeed

        if ((family.getValue() != null) && (family.getValue().size() > 0)) {

          if (family.getValue() instanceof Set) {

            // for each qualifier of the family

            Set<byte[]> familySet = (Set<byte[]>)family.getValue();

            for (byte[] qualifier : familySet) {

              if (!authManager.authorize(user, tableName, family.getKey(),

                                         qualifier, permRequest)) {

                return AuthResult.deny(request, "Failed qualifier check", user,

                    permRequest, tableName, makeFamilyMap(family.getKey(), qualifier));

              }

            }

          } else if (family.getValue() instanceof List) { // List<KeyValue>

            List<KeyValue> kvList = (List<KeyValue>)family.getValue();

            for (KeyValue kv : kvList) {

              if (!authManager.authorize(user, tableName, family.getKey(),

                      kv.getQualifier(), permRequest)) {

                return AuthResult.deny(request, "Failed qualifier check", user,

                    permRequest, tableName, makeFamilyMap(family.getKey(), kv.getQualifier()));

              }

            }

          }

        } else {

          // no qualifiers and family-level check already failed

          return AuthResult.deny(request, "Failed family check", user, permRequest,

              tableName, makeFamilyMap(family.getKey(), null));

        }

      }

      // all family checks passed

      return AuthResult.allow(request, "All family checks passed", user, permRequest,

          tableName, families);

    }

    // 4. no families to check and table level access failed

    return AuthResult.deny(request, "No families to check and table permission failed",

        user, permRequest, tableName, families);

  }

  /**

   * Check the current user for authorization to perform a specific action

   * against the given set of row data.

   * @param opType the operation type

   * @param user the user

   * @param e the coprocessor environment

   * @param families the map of column families to qualifiers present in

   * the request

   * @param actions the desired actions

   * @return an authorization result

   */

  AuthResult permissionGranted(OpType opType, User user, RegionCoprocessorEnvironment e,

      Map<byte [], ? extends Collection<?>> families, Action... actions) {

    AuthResult result = null;

    for (Action action: actions) {

      result = permissionGranted(opType.toString(), user, action, e, families);

      if (!result.isAllowed()) {

        return result;

      }

    }

    return result;

  }

  private void logResult(AuthResult result) {

    if (AUDITLOG.isTraceEnabled()) {

      RequestContext ctx = RequestContext.get();

      InetAddress remoteAddr = null;

      if (ctx != null) {

        remoteAddr = ctx.getRemoteAddress();

      }

      AUDITLOG.trace("Access " + (result.isAllowed() ? "allowed" : "denied") +

          " for user " + (result.getUser() != null ? result.getUser().getShortName() : "UNKNOWN") +

          "; reason: " + result.getReason() +

          "; remote address: " + (remoteAddr != null ? remoteAddr : "") +

          "; request: " + result.getRequest() +

          "; context: " + result.toContextString());

    }

  }

  /**

   * Returns the active user to which authorization checks should be applied.

   * If we are in the context of an RPC call, the remote user is used,

   * otherwise the currently logged in user is used.

   */

  private User getActiveUser() throws IOException {

    User user = RequestContext.getRequestUser();

    if (!RequestContext.isInRequestContext()) {

      // for non-rpc handling, fallback to system user

      user = userProvider.getCurrent();

    }

    return user;

  }

  /**

   * Authorizes that the current user has any of the given permissions for the

   * given table, column family and column qualifier.

   * @param tableName Table requested

   * @param family Column family requested

   * @param qualifier Column qualifier requested

   * @throws IOException if obtaining the current user fails

   * @throws AccessDeniedException if user has no authorization

   */

  private void requirePermission(String request, TableName tableName, byte[] family, byte[] qualifier,

      Action... permissions) throws IOException {

    User user = getActiveUser();

    AuthResult result = null;

    for (Action permission : permissions) {

      if (authManager.authorize(user, tableName, family, qualifier, permission)) {

        result = AuthResult.allow(request, "Table permission granted", user,

                                  permission, tableName, family, qualifier);

        break;

      } else {

        // rest of the world

        result = AuthResult.deny(request, "Insufficient permissions", user,

                                 permission, tableName, family, qualifier);

      }

    }

    logResult(result);

    if (!result.isAllowed()) {

      throw new AccessDeniedException("Insufficient permissions " + result.toContextString());

    }

  }

  /**

   * Authorizes that the current user has global privileges for the given action.

   * @param perm The action being requested

   * @throws IOException if obtaining the current user fails

   * @throws AccessDeniedException if authorization is denied

   */

  private void requirePermission(String request, Action perm) throws IOException {

    requireGlobalPermission(request, perm, null, null);

  }

  /**

   * Authorizes that the current user has permission to perform the given

   * action on the set of table column families.

   * @param perm Action that is required

   * @param env The current coprocessor environment

   * @param families The map of column families-qualifiers.

   * @throws AccessDeniedException if the authorization check failed

   */

  private void requirePermission(String request, Action perm,

        RegionCoprocessorEnvironment env,

        Map<byte[], ? extends Collection<?>> families)

      throws IOException {

    User user = getActiveUser();

    AuthResult result = permissionGranted(request, user, perm, env, families);

    logResult(result);

    if (!result.isAllowed()) {

      throw new AccessDeniedException("Insufficient permissions (table=" +

        env.getRegion().getTableDesc().getTableName()+

        ((families != null && families.size() > 0) ? ", family: " +

        result.toFamilyString() : "") + ", action=" +

        perm.toString() + ")");

    }

  }

  /**

   * Checks that the user has the given global permission. The generated

   * audit log message will contain context information for the operation

   * being authorized, based on the given parameters.

   * @param perm Action being requested

   * @param tableName Affected table name.

   * @param familyMap Affected column families.

   */

  private void requireGlobalPermission(String request, Action perm, TableName tableName,

      Map<byte[], ? extends Collection<byte[]>> familyMap) throws IOException {

    User user = getActiveUser();

    if (authManager.authorize(user, perm) || (tableName != null &&

        authManager.authorize(user, tableName.getNamespaceAsString(), perm))) {

      logResult(AuthResult.allow(request, "Global check allowed", user, perm, tableName, familyMap));

    } else {

      logResult(AuthResult.deny(request, "Global check failed", user, perm, tableName, familyMap));

      throw new AccessDeniedException("Insufficient permissions for user '" +

          (user != null ? user.getShortName() : "null") +"' (global, action=" +

          perm.toString() + ")");

    }

  }

  /**

   * Checks that the user has the given global permission. The generated

   * audit log message will contain context information for the operation

   * being authorized, based on the given parameters.

   * @param perm Action being requested

   * @param namespace

   */

  private void requireGlobalPermission(String request, Action perm,

                                       String namespace) throws IOException {

    User user = getActiveUser();

    if (authManager.authorize(user, perm)) {

      logResult(AuthResult.allow(request, "Global check allowed", user, perm, namespace));

    } else {

      logResult(AuthResult.deny(request, "Global check failed", user, perm, namespace));

      throw new AccessDeniedException("Insufficient permissions for user '" +

          (user != null ? user.getShortName() : "null") +"' (global, action=" +

          perm.toString() + ")");

    }

  }

  /**

   * Returns <code>true</code> if the current user is allowed the given action

   * over at least one of the column qualifiers in the given column families.

   */

  private boolean hasFamilyQualifierPermission(User user,

      Action perm,

      RegionCoprocessorEnvironment env,

      Map<byte[], ? extends Collection<byte[]>> familyMap)

    throws IOException {

    HRegionInfo hri = env.getRegion().getRegionInfo();

    TableName tableName = hri.getTable();

    if (user == null) {

      return false;

    }

    if (familyMap != null && familyMap.size() > 0) {

      // at least one family must be allowed

      for (Map.Entry<byte[], ? extends Collection<byte[]>> family :

          familyMap.entrySet()) {

        if (family.getValue() != null && !family.getValue().isEmpty()) {

          for (byte[] qualifier : family.getValue()) {

            if (authManager.matchPermission(user, tableName,

                family.getKey(), qualifier, perm)) {

              return true;

            }

          }

        } else {

          if (authManager.matchPermission(user, tableName, family.getKey(),

              perm)) {

            return true;

          }

        }

      }

    } else if (LOG.isDebugEnabled()) {

      LOG.debug("Empty family map passed for permission check");

    }

    return false;

  }

  private enum OpType {

    GET_CLOSEST_ROW_BEFORE("getClosestRowBefore"),

    GET("get"),

    EXISTS("exists"),

    SCAN("scan"),

    PUT("put"),

    DELETE("delete"),

    CHECK_AND_PUT("checkAndPut"),

    CHECK_AND_DELETE("checkAndDelete"),

    INCREMENT_COLUMN_VALUE("incrementColumnValue"),

    APPEND("append"),

    INCREMENT("increment");

    private String type;

    private OpType(String type) {

      this.type = type;

    }

    @Override

    public String toString() {

      return type;

    }

  }

  /**

   * Determine if cell ACLs covered by the operation grant access. This is expensive.

   * @return false if cell ACLs failed to grant access, true otherwise

   * @throws IOException

   */

  private boolean checkCoveringPermission(OpType request, RegionCoprocessorEnvironment e,

      byte[] row, Map<byte[], ? extends Collection<?>> familyMap, long opTs, Action... actions)

      throws IOException {

    if (!cellFeaturesEnabled) {

      return false;

    }

    long cellGrants = 0;

    User user = getActiveUser();

    long latestCellTs = 0;

    Get get = new Get(row);

    // Only in case of Put/Delete op, consider TS within cell (if set for individual cells).

    // When every cell, within a Mutation, can be linked with diff TS we can not rely on only one

    // version. We have to get every cell version and check its TS against the TS asked for in

    // Mutation and skip those Cells which is outside this Mutation TS.In case of Put, we have to

    // consider only one such passing cell. In case of Delete we have to consider all the cell

    // versions under this passing version. When Delete Mutation contains columns which are a

    // version delete just consider only one version for those column cells.

    boolean considerCellTs  = (request == OpType.PUT || request == OpType.DELETE);

    if (considerCellTs) {

      get.setMaxVersions();

    } else {

      get.setMaxVersions(1);

    }

    boolean diffCellTsFromOpTs = false;

    for (Map.Entry<byte[], ? extends Collection<?>> entry: familyMap.entrySet()) {

      byte[] col = entry.getKey();

      // TODO: HBASE-7114 could possibly unify the collection type in family

      // maps so we would not need to do this

      if (entry.getValue() instanceof Set) {

        Set<byte[]> set = (Set<byte[]>)entry.getValue();

        if (set == null || set.isEmpty()) {

          get.addFamily(col);

        } else {

          for (byte[] qual: set) {

            get.addColumn(col, qual);

          }

        }

      } else if (entry.getValue() instanceof List) {

        List<Cell> list = (List<Cell>)entry.getValue();

        if (list == null || list.isEmpty()) {

          get.addFamily(col);

        } else {

          // In case of family delete, a Cell will be added into the list with Qualifier as null.

          for (Cell cell : list) {

            if (cell.getQualifierLength() == 0

                && (cell.getTypeByte() == Type.DeleteFamily.getCode()

                || cell.getTypeByte() == Type.DeleteFamilyVersion.getCode())) {

              get.addFamily(col);

            } else {

              get.addColumn(col, CellUtil.cloneQualifier(cell));

            }

            if (considerCellTs) {

              long cellTs = cell.getTimestamp();

              latestCellTs = Math.max(latestCellTs, cellTs);

              diffCellTsFromOpTs = diffCellTsFromOpTs || (opTs != cellTs);

            }

          }

        }

      } else {

        throw new RuntimeException("Unhandled collection type " +

          entry.getValue().getClass().getName());

      }

    }

    // We want to avoid looking into the future. So, if the cells of the

    // operation specify a timestamp, or the operation itself specifies a

    // timestamp, then we use the maximum ts found. Otherwise, we bound

    // the Get to the current server time. We add 1 to the timerange since

    // the upper bound of a timerange is exclusive yet we need to examine

    // any cells found there inclusively.

    long latestTs = Math.max(opTs, latestCellTs);

    if (latestTs == 0 || latestTs == HConstants.LATEST_TIMESTAMP) {

      latestTs = EnvironmentEdgeManager.currentTime();

    }

    get.setTimeRange(0, latestTs + 1);

    // In case of Put operation we set to read all versions. This was done to consider the case

    // where columns are added with TS other than the Mutation TS. But normally this wont be the

    // case with Put. There no need to get all versions but get latest version only.

    if (!diffCellTsFromOpTs && request == OpType.PUT) {

      get.setMaxVersions(1);

    }

    if (LOG.isTraceEnabled()) {

      LOG.trace("Scanning for cells with " + get);

    }

    // This Map is identical to familyMap. The key is a BR rather than byte[].

    // It will be easy to do gets over this new Map as we can create get keys over the Cell cf by

    // new SimpleByteRange(cell.familyArray, cell.familyOffset, cell.familyLen)

    Map<ByteRange, List<Cell>> familyMap1 = new HashMap<ByteRange, List<Cell>>();

    for (Entry<byte[], ? extends Collection<?>> entry : familyMap.entrySet()) {

      if (entry.getValue() instanceof List) {

        familyMap1.put(new SimpleMutableByteRange(entry.getKey()), (List<Cell>) entry.getValue());

      }

    }

    RegionScanner scanner = getRegion(e).getScanner(new Scan(get));

    List<Cell> cells = Lists.newArrayList();

    Cell prevCell = null;

    ByteRange curFam = new SimpleMutableByteRange();

    boolean curColAllVersions = (request == OpType.DELETE);

    long curColCheckTs = opTs;

    boolean foundColumn = false;

    try {

      boolean more = false;

      do {

        cells.clear();

        // scan with limit as 1 to hold down memory use on wide rows

        more = scanner.next(cells, 1);

        for (Cell cell: cells) {

          if (LOG.isTraceEnabled()) {

            LOG.trace("Found cell " + cell);

          }

          boolean colChange = prevCell == null || !CellUtil.matchingColumn(prevCell, cell);

          if (colChange) foundColumn = false;

          prevCell = cell;

          if (!curColAllVersions && foundColumn) {

            continue;

          }

          if (colChange && considerCellTs) {

            curFam.set(cell.getFamilyArray(), cell.getFamilyOffset(), cell.getFamilyLength());

            List<Cell> cols = familyMap1.get(curFam);

            for (Cell col : cols) {

              // null/empty qualifier is used to denote a Family delete. The TS and delete type

              // associated with this is applicable for all columns within the family. That is

              // why the below (col.getQualifierLength() == 0) check.

              if ((col.getQualifierLength() == 0 && request == OpType.DELETE)

                  || CellUtil.matchingQualifier(cell, col)) {

                byte type = col.getTypeByte();

                if (considerCellTs) {

                  curColCheckTs = col.getTimestamp();

                }

                // For a Delete op we pass allVersions as true. When a Delete Mutation contains

                // a version delete for a column no need to check all the covering cells within

                // that column. Check all versions when Type is DeleteColumn or DeleteFamily

                // One version delete types are Delete/DeleteFamilyVersion

                curColAllVersions = (KeyValue.Type.DeleteColumn.getCode() == type)

                    || (KeyValue.Type.DeleteFamily.getCode() == type);

                break;

              }

            }

          }

          if (cell.getTimestamp() > curColCheckTs) {

            // Just ignore this cell. This is not a covering cell.

            continue;

          }

          foundColumn = true;

          for (Action action: actions) {

            // Are there permissions for this user for the cell?

            if (!authManager.authorize(user, getTableName(e), cell, action)) {

              // We can stop if the cell ACL denies access

              return false;

            }

          }

          cellGrants++;

        }

      } while (more);

    } catch (AccessDeniedException ex) {

      throw ex;

    } catch (IOException ex) {

      LOG.error("Exception while getting cells to calculate covering permission", ex);

    } finally {

      scanner.close();

    }

    // We should not authorize unless we have found one or more cell ACLs that

    // grant access. This code is used to check for additional permissions

    // after no table or CF grants are found.

    return cellGrants > 0;

  }

  private static void addCellPermissions(final byte[] perms, Map<byte[], List<Cell>> familyMap) {

    // Iterate over the entries in the familyMap, replacing the cells therein

    // with new cells including the ACL data

    for (Map.Entry<byte[], List<Cell>> e: familyMap.entrySet()) {

      List<Cell> newCells = Lists.newArrayList();

      for (Cell cell: e.getValue()) {

        // Prepend the supplied perms in a new ACL tag to an update list of tags for the cell

        List<Tag> tags = Lists.newArrayList(new Tag(AccessControlLists.ACL_TAG_TYPE, perms));

        if (cell.getTagsLength() > 0) {

          Iterator<Tag> tagIterator = CellUtil.tagsIterator(cell.getTagsArray(),

            cell.getTagsOffset(), cell.getTagsLength());

          while (tagIterator.hasNext()) {

            tags.add(tagIterator.next());

          }

        }

        newCells.add(new TagRewriteCell(cell, Tag.fromList(tags)));

      }

      // This is supposed to be safe, won't CME

      e.setValue(newCells);

    }

  }

  // Checks whether incoming cells contain any tag with type as ACL_TAG_TYPE. This tag

  // type is reserved and should not be explicitly set by user.

  private void checkForReservedTagPresence(User user, Mutation m) throws IOException {

    // Superusers are allowed to store cells unconditionally.

    if (superusers.contains(user.getShortName())) {

      return;

    }

    // We already checked (prePut vs preBatchMutation)

    if (m.getAttribute(TAG_CHECK_PASSED) != null) {

      return;

    }

    for (CellScanner cellScanner = m.cellScanner(); cellScanner.advance();) {

      Cell cell = cellScanner.current();

      if (cell.getTagsLength() > 0) {

        Iterator<Tag> tagsItr = CellUtil.tagsIterator(cell.getTagsArray(), cell.getTagsOffset(),

          cell.getTagsLength());

        while (tagsItr.hasNext()) {

          if (tagsItr.next().getType() == AccessControlLists.ACL_TAG_TYPE) {

            throw new AccessDeniedException("Mutation contains cell with reserved type tag");

          }

        }

      }

    }

    m.setAttribute(TAG_CHECK_PASSED, TRUE);

  }

  /* ---- MasterObserver implementation ---- */

  public void start(CoprocessorEnvironment env) throws IOException {

    CompoundConfiguration conf = new CompoundConfiguration();

    conf.add(env.getConfiguration());

    shouldCheckExecPermission = conf.getBoolean(AccessControlConstants.EXEC_PERMISSION_CHECKS_KEY,

      AccessControlConstants.DEFAULT_EXEC_PERMISSION_CHECKS);

    cellFeaturesEnabled = HFile.getFormatVersion(conf) >= HFile.MIN_FORMAT_VERSION_WITH_TAGS;

    if (!cellFeaturesEnabled) {

      LOG.info("A minimum HFile version of " + HFile.MIN_FORMAT_VERSION_WITH_TAGS

          + " is required to persist cell ACLs. Consider setting " + HFile.FORMAT_VERSION_KEY

          + " accordingly.");

    }

    ZooKeeperWatcher zk = null;

    if (env instanceof MasterCoprocessorEnvironment) {

      // if running on HMaster

      MasterCoprocessorEnvironment mEnv = (MasterCoprocessorEnvironment) env;

      zk = mEnv.getMasterServices().getZooKeeper();

    } else if (env instanceof RegionServerCoprocessorEnvironment) {

      RegionServerCoprocessorEnvironment rsEnv = (RegionServerCoprocessorEnvironment) env;

      zk = rsEnv.getRegionServerServices().getZooKeeper();

    } else if (env instanceof RegionCoprocessorEnvironment) {

      // if running at region

      regionEnv = (RegionCoprocessorEnvironment) env;

      conf.addStringMap(regionEnv.getRegion().getTableDesc().getConfiguration());

      zk = regionEnv.getRegionServerServices().getZooKeeper();

      compatibleEarlyTermination = conf.getBoolean(AccessControlConstants.CF_ATTRIBUTE_EARLY_OUT,

        AccessControlConstants.DEFAULT_ATTRIBUTE_EARLY_OUT);

    }

    // set the user-provider.

    this.userProvider = UserProvider.instantiate(env.getConfiguration());

    // set up the list of users with superuser privilege

    User user = userProvider.getCurrent();

    superusers = Lists.asList(user.getShortName(),

      conf.getStrings(AccessControlLists.SUPERUSER_CONF_KEY, new String[0]));

    // If zk is null or IOException while obtaining auth manager,

    // throw RuntimeException so that the coprocessor is unloaded.

    if (zk != null) {

      try {

        this.authManager = TableAuthManager.get(zk, env.getConfiguration());

      } catch (IOException ioe) {

        throw new RuntimeException("Error obtaining TableAuthManager", ioe);

      }

    } else {

      throw new RuntimeException("Error obtaining TableAuthManager, zk found null.");

    }

    tableAcls = new MapMaker().weakValues().makeMap();

  }

  public void stop(CoprocessorEnvironment env) {

  }

  @Override

  public void preCreateTable(ObserverContext<MasterCoprocessorEnvironment> c,

      HTableDescriptor desc, HRegionInfo[] regions) throws IOException {

    Set<byte[]> families = desc.getFamiliesKeys();

    Map<byte[], Set<byte[]>> familyMap = new TreeMap<byte[], Set<byte[]>>(Bytes.BYTES_COMPARATOR);

    for (byte[] family: families) {

      familyMap.put(family, null);

    }

    requireGlobalPermission("createTable", Action.CREATE, desc.getTableName(), familyMap);

  }

  @Override

  public void postCreateTableHandler(final ObserverContext<MasterCoprocessorEnvironment> c,

      HTableDescriptor desc, HRegionInfo[] regions) throws IOException {