Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

YARN-1063. Augmented Hadoop common winutils to have the ability to create containers as domain users. Contributed by Remus Rusanu. 

Committed as a YARN patch even though all the code changes are in common.
This commit is contained in:
Vinod Kumar Vavilapalli 2014-10-01 09:53:44 -07:00
parent 04b08431a3
commit 5ca97f1e60
7 changed files with 665 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hadoop-common-project/hadoop-common/src/main/winutils/chown.c
View File

@ -63,11 +63,11 @@ static DWORD ChangeFileOwnerBySid(__in LPCWSTR path,
// SID is not contained in the caller's token, and have the SE_GROUP_OWNER
// permission enabled.
//
if (!EnablePrivilege(L"SeTakeOwnershipPrivilege"))
if (EnablePrivilege(L"SeTakeOwnershipPrivilege") != ERROR_SUCCESS)
{
fwprintf(stdout, L"INFO: The user does not have SeTakeOwnershipPrivilege.\n");
}
if (!EnablePrivilege(L"SeRestorePrivilege"))
if (EnablePrivilege(L"SeRestorePrivilege") != ERROR_SUCCESS)
{
fwprintf(stdout, L"INFO: The user does not have SeRestorePrivilege.\n");
}

26
hadoop-common-project/hadoop-common/src/main/winutils/include/winutils.h
View File

@ -27,6 +27,8 @@
#include <accctrl.h>
#include <strsafe.h>
#include <lm.h>
#include <ntsecapi.h>
#include <userenv.h>
enum EXIT_CODE
{
@ -153,6 +155,26 @@ DWORD ChangeFileModeByMask(__in LPCWSTR path, INT mode);
DWORD GetLocalGroupsForUser(__in LPCWSTR user,
__out LPLOCALGROUP_USERS_INFO_0 *groups, __out LPDWORD entries);
BOOL EnablePrivilege(__in LPCWSTR privilegeName);
void GetLibraryName(__in LPCVOID lpAddress, __out LPWSTR *filename);
DWORD EnablePrivilege(__in LPCWSTR privilegeName);
void AssignLsaString(__inout LSA_STRING * target, __in const char *strBuf);
DWORD RegisterWithLsa(__in const char *logonProcessName, __out HANDLE * lsaHandle);
void UnregisterWithLsa(__in HANDLE lsaHandle);
DWORD LookupKerberosAuthenticationPackageId(__in HANDLE lsaHandle, __out ULONG * packageId);
DWORD CreateLogonForUser(__in HANDLE lsaHandle,
__in const char * tokenSourceName,
__in const char * tokenOriginName,
__in ULONG authnPkgId,
__in const wchar_t* principalName,
__out HANDLE *tokenHandle);
DWORD LoadUserProfileForLogon(__in HANDLE logonHandle, __out PROFILEINFO * pi);
DWORD UnloadProfileForLogon(__in HANDLE logonHandle, __in PROFILEINFO * pi);

313
hadoop-common-project/hadoop-common/src/main/winutils/libwinutils.c
View File

@ -17,6 +17,8 @@
#pragma comment(lib, "authz.lib")
#pragma comment(lib, "netapi32.lib")
#pragma comment(lib, "Secur32.lib")
#pragma comment(lib, "Userenv.lib")
#include "winutils.h"
#include <authz.h>
#include <sddl.h>
@ -797,7 +799,6 @@ DWORD FindFileOwnerAndPermission(
__out_opt PINT pMask)
{
DWORD dwRtnCode = 0;
PSECURITY_DESCRIPTOR pSd = NULL;
PSID psidOwner = NULL;
@ -1638,11 +1639,12 @@ GetLocalGroupsForUserEnd:
// to the process's access token.
//
// Returns:
// TRUE: on success
// ERROR_SUCCESS on success
// GetLastError() on error
//
// Notes:
//
BOOL EnablePrivilege(__in LPCWSTR privilegeName)
DWORD EnablePrivilege(__in LPCWSTR privilegeName)
{
HANDLE hToken = INVALID_HANDLE_VALUE;
TOKEN_PRIVILEGES tp = { 0 };
@ -1651,28 +1653,31 @@ BOOL EnablePrivilege(__in LPCWSTR privilegeName)
if (!OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
ReportErrorCode(L"OpenProcessToken", GetLastError());
return FALSE;
dwErrCode = GetLastError();
ReportErrorCode(L"OpenProcessToken", dwErrCode);
return dwErrCode;
}
tp.PrivilegeCount = 1;
if (!LookupPrivilegeValueW(NULL,
privilegeName, &(tp.Privileges[0].Luid)))
{
ReportErrorCode(L"LookupPrivilegeValue", GetLastError());
dwErrCode = GetLastError();
ReportErrorCode(L"LookupPrivilegeValue", dwErrCode);
CloseHandle(hToken);
return FALSE;
return dwErrCode;
}
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
// As stated on MSDN, we need to use GetLastError() to check if
// AdjustTokenPrivileges() adjusted all of the specified privileges.
//
AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, NULL);
if( !AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, NULL) ) {
dwErrCode = GetLastError();
}
CloseHandle(hToken);
return dwErrCode == ERROR_SUCCESS;
return dwErrCode;
}
//----------------------------------------------------------------------------
@ -1716,9 +1721,6 @@ void ReportErrorCode(LPCWSTR func, DWORD err)
// Description:
// Given an address, get the file name of the library from which it was loaded.
//
// Returns:
// None
//
// Notes:
// - The function allocates heap memory and points the filename out parameter to
// the newly allocated memory, which will contain the name of the file.
@ -1757,3 +1759,290 @@ cleanup:
*filename = NULL;
}
}
// Function: AssignLsaString
//
// Description:
// fills in values of LSA_STRING struct to point to a string buffer
//
// Returns:
// None
//
// IMPORTANT*** strBuf is not copied. It must be globally immutable
//
void AssignLsaString(__inout LSA_STRING * target, __in const char *strBuf)
{
target->Length = (USHORT)(sizeof(char)*strlen(strBuf));
target->MaximumLength = target->Length;
target->Buffer = (char *)(strBuf);
}
//----------------------------------------------------------------------------
// Function: RegisterWithLsa
//
// Description:
// Registers with local security authority and sets handle for use in later LSA
// operations
//
// Returns:
// ERROR_SUCCESS on success
// Other error code on failure
//
// Notes:
//
DWORD RegisterWithLsa(__in const char *logonProcessName, __out HANDLE * lsaHandle)
{
LSA_STRING processName;
LSA_OPERATIONAL_MODE o_mode; // never useful as per msdn docs
NTSTATUS registerStatus;
*lsaHandle = 0;
AssignLsaString(&processName, logonProcessName);
registerStatus = LsaRegisterLogonProcess(&processName, lsaHandle, &o_mode);
return LsaNtStatusToWinError( registerStatus );
}
//----------------------------------------------------------------------------
// Function: UnregisterWithLsa
//
// Description:
// Closes LSA handle allocated by RegisterWithLsa()
//
// Returns:
// None
//
// Notes:
//
void UnregisterWithLsa(__in HANDLE lsaHandle)
{
LsaClose(lsaHandle);
}
//----------------------------------------------------------------------------
// Function: LookupKerberosAuthenticationPackageId
//
// Description:
// Looks of the current id (integer index) of the Kerberos authentication package on the local
// machine.
//
// Returns:
// ERROR_SUCCESS on success
// Other error code on failure
//
// Notes:
//
DWORD LookupKerberosAuthenticationPackageId(__in HANDLE lsaHandle, __out ULONG * packageId)
{
NTSTATUS lookupStatus;
LSA_STRING pkgName;
AssignLsaString(&pkgName, MICROSOFT_KERBEROS_NAME_A);
lookupStatus = LsaLookupAuthenticationPackage(lsaHandle, &pkgName, packageId);
return LsaNtStatusToWinError( lookupStatus );
}
//----------------------------------------------------------------------------
// Function: CreateLogonForUser
//
// Description:
// Contacts the local LSA and performs a logon without credential for the
// given principal. This logon token will be local machine only and have no
// network credentials attached.
//
// Returns:
// ERROR_SUCCESS on success
// Other error code on failure
//
// Notes:
// This call assumes that all required privileges have already been enabled (TCB etc).
// IMPORTANT **** tokenOriginName must be immutable!
//
DWORD CreateLogonForUser(__in HANDLE lsaHandle,
__in const char * tokenSourceName,
__in const char * tokenOriginName, // must be immutable, will not be copied!
__in ULONG authnPkgId,
__in const wchar_t* principalName,
__out HANDLE *tokenHandle)
{
DWORD logonStatus = ERROR_ASSERTION_FAILURE; // Failure to set status should trigger error
TOKEN_SOURCE tokenSource;
LSA_STRING originName;
void * profile = NULL;
// from MSDN:
// The ClientUpn and ClientRealm members of the KERB_S4U_LOGON
// structure must point to buffers in memory that are contiguous
// to the structure itself. The value of the
// AuthenticationInformationLength parameter must take into
// account the length of these buffers.
const int principalNameBufLen = lstrlen(principalName)*sizeof(*principalName);
const int totalAuthInfoLen = sizeof(KERB_S4U_LOGON) + principalNameBufLen;
KERB_S4U_LOGON* s4uLogonAuthInfo = (KERB_S4U_LOGON*)calloc(totalAuthInfoLen, 1);
if (s4uLogonAuthInfo == NULL ) {
logonStatus = ERROR_NOT_ENOUGH_MEMORY;
goto done;
}
s4uLogonAuthInfo->MessageType = KerbS4ULogon;
s4uLogonAuthInfo->ClientUpn.Buffer = (wchar_t*)((char*)s4uLogonAuthInfo + sizeof *s4uLogonAuthInfo);
CopyMemory(s4uLogonAuthInfo->ClientUpn.Buffer, principalName, principalNameBufLen);
s4uLogonAuthInfo->ClientUpn.Length = (USHORT)principalNameBufLen;
s4uLogonAuthInfo->ClientUpn.MaximumLength = (USHORT)principalNameBufLen;
AllocateLocallyUniqueId(&tokenSource.SourceIdentifier);
StringCchCopyA(tokenSource.SourceName, TOKEN_SOURCE_LENGTH, tokenSourceName );
AssignLsaString(&originName, tokenOriginName);
{
DWORD cbProfile = 0;
LUID logonId;
QUOTA_LIMITS quotaLimits;
NTSTATUS subStatus;
NTSTATUS logonNtStatus = LsaLogonUser(lsaHandle,
&originName,
Batch, // SECURITY_LOGON_TYPE
authnPkgId,
s4uLogonAuthInfo,
totalAuthInfoLen,
0,
&tokenSource,
&profile,
&cbProfile,
&logonId,
tokenHandle,
&quotaLimits,
&subStatus);
logonStatus = LsaNtStatusToWinError( logonNtStatus );
}
done:
// clean up
if (s4uLogonAuthInfo != NULL) {
free(s4uLogonAuthInfo);
}
if (profile != NULL) {
LsaFreeReturnBuffer(profile);
}
return logonStatus;
}
// NOTE: must free allocatedName
DWORD GetNameFromLogonToken(__in HANDLE logonToken, __out wchar_t **allocatedName)
{
DWORD userInfoSize = 0;
PTOKEN_USER user = NULL;
DWORD userNameSize = 0;
wchar_t * userName = NULL;
DWORD domainNameSize = 0;
wchar_t * domainName = NULL;
SID_NAME_USE sidUse = SidTypeUnknown;
DWORD getNameStatus = ERROR_ASSERTION_FAILURE; // Failure to set status should trigger error
BOOL tokenInformation = FALSE;
// call for sid size then alloc and call for sid
tokenInformation = GetTokenInformation(logonToken, TokenUser, NULL, 0, &userInfoSize);
assert (FALSE == tokenInformation);
// last call should have failed and filled in allocation size
if ((getNameStatus = GetLastError()) != ERROR_INSUFFICIENT_BUFFER)
{
goto done;
}
user = (PTOKEN_USER)calloc(userInfoSize,1);
if (user == NULL)
{
getNameStatus = ERROR_NOT_ENOUGH_MEMORY;
goto done;
}
if (!GetTokenInformation(logonToken, TokenUser, user, userInfoSize, &userInfoSize)) {
getNameStatus = GetLastError();
goto done;
}
LookupAccountSid( NULL, user->User.Sid, NULL, &userNameSize, NULL, &domainNameSize, &sidUse );
// last call should have failed and filled in allocation size
if ((getNameStatus = GetLastError()) != ERROR_INSUFFICIENT_BUFFER)
{
goto done;
}
userName = (wchar_t *)calloc(userNameSize, sizeof(wchar_t));
if (userName == NULL) {
getNameStatus = ERROR_NOT_ENOUGH_MEMORY;
goto done;
}
domainName = (wchar_t *)calloc(domainNameSize, sizeof(wchar_t));
if (domainName == NULL) {
getNameStatus = ERROR_NOT_ENOUGH_MEMORY;
goto done;
}
if (!LookupAccountSid( NULL, user->User.Sid, userName, &userNameSize, domainName, &domainNameSize, &sidUse )) {
getNameStatus = GetLastError();
goto done;
}
getNameStatus = ERROR_SUCCESS;
*allocatedName = userName;
userName = NULL;
done:
if (user != NULL) {
free( user );
user = NULL;
}
if (userName != NULL) {
free( userName );
userName = NULL;
}
if (domainName != NULL) {
free( domainName );
domainName = NULL;
}
return getNameStatus;
}
DWORD LoadUserProfileForLogon(__in HANDLE logonHandle, __out PROFILEINFO * pi)
{
wchar_t *userName = NULL;
DWORD loadProfileStatus = ERROR_ASSERTION_FAILURE; // Failure to set status should trigger error
loadProfileStatus = GetNameFromLogonToken( logonHandle, &userName );
if (loadProfileStatus != ERROR_SUCCESS) {
goto done;
}
assert(pi);
ZeroMemory( pi, sizeof(*pi) );
pi->dwSize = sizeof(*pi);
pi->lpUserName = userName;
pi->dwFlags = PI_NOUI;
// if the profile does not exist it will be created
if ( !LoadUserProfile( logonHandle, pi ) ) {
loadProfileStatus = GetLastError();
goto done;
}
loadProfileStatus = ERROR_SUCCESS;
done:
return loadProfileStatus;
}
DWORD UnloadProfileForLogon(__in HANDLE logonHandle, __in PROFILEINFO * pi)
{
DWORD touchProfileStatus = ERROR_ASSERTION_FAILURE; // Failure to set status should trigger error
assert(pi);
if ( !UnloadUserProfile(logonHandle, pi->hProfile ) ) {
touchProfileStatus = GetLastError();
goto done;
}
if (pi->lpUserName != NULL) {
free(pi->lpUserName);
pi->lpUserName = NULL;
}
ZeroMemory( pi, sizeof(*pi) );
touchProfileStatus = ERROR_SUCCESS;
done:
return touchProfileStatus;
}

2
hadoop-common-project/hadoop-common/src/main/winutils/symlink.c
View File

@ -77,7 +77,7 @@ int Symlink(__in int argc, __in_ecount(argc) wchar_t *argv[])
// This is just an additional step to do the privilege check by not using
// error code from CreateSymbolicLink() method.
//
if (!EnablePrivilege(L"SeCreateSymbolicLinkPrivilege"))
if (EnablePrivilege(L"SeCreateSymbolicLinkPrivilege") != ERROR_SUCCESS)
{
fwprintf(stderr,
L"No privilege to create symbolic links.\n");

347
hadoop-common-project/hadoop-common/src/main/winutils/task.c
View File

@ -18,6 +18,7 @@
#include "winutils.h"
#include <errno.h>
#include <psapi.h>
#include <malloc.h>
#define PSAPI_VERSION 1
#pragma comment(lib, "psapi.lib")
@ -28,12 +29,18 @@
// process exits with 128 + signal. For SIGKILL, this would be 128 + 9 = 137.
#define KILLED_PROCESS_EXIT_CODE 137
// Name for tracking this logon process when registering with LSA
static const char *LOGON_PROCESS_NAME="Hadoop Container Executor";
// Name for token source, must be less or eq to TOKEN_SOURCE_LENGTH (currently 8) chars
static const char *TOKEN_SOURCE_NAME = "HadoopEx";
// List of different task related command line options supported by
// winutils.
typedef enum TaskCommandOptionType
{
TaskInvalid,
TaskCreate,
TaskCreateAsUser,
TaskIsAlive,
TaskKill,
TaskProcessList
@ -86,37 +93,53 @@ static BOOL ParseCommandLine(__in int argc,
}
}
if (argc >= 6) {
if (wcscmp(argv[1], L"createAsUser") == 0)
{
*command = TaskCreateAsUser;
return TRUE;
}
}
return FALSE;
}
//----------------------------------------------------------------------------
// Function: createTask
// Function: CreateTaskImpl
//
// Description:
// Creates a task via a jobobject. Outputs the
// appropriate information to stdout on success, or stderr on failure.
// logonHandle may be NULL, in this case the current logon will be utilized for the
// created process
//
// Returns:
// ERROR_SUCCESS: On success
// GetLastError: otherwise
DWORD createTask(__in PCWSTR jobObjName,__in PWSTR cmdLine)
DWORD CreateTaskImpl(__in_opt HANDLE logonHandle, __in PCWSTR jobObjName,__in PWSTR cmdLine)
{
DWORD err = ERROR_SUCCESS;
DWORD dwErrorCode = ERROR_SUCCESS;
DWORD exitCode = EXIT_FAILURE;
DWORD currDirCnt = 0;
STARTUPINFO si;
PROCESS_INFORMATION pi;
HANDLE jobObject = NULL;
JOBOBJECT_EXTENDED_LIMIT_INFORMATION jeli = { 0 };
void * envBlock = NULL;
BOOL createProcessResult = FALSE;
wchar_t* curr_dir = NULL;
FILE *stream = NULL;
// Create un-inheritable job object handle and set job object to terminate
// when last handle is closed. So winutils.exe invocation has the only open
// job object handle. Exit of winutils.exe ensures termination of job object.
// Either a clean exit of winutils or crash or external termination.
jobObject = CreateJobObject(NULL, jobObjName);
err = GetLastError();
if(jobObject == NULL || err == ERROR_ALREADY_EXISTS)
dwErrorCode = GetLastError();
if(jobObject == NULL || dwErrorCode == ERROR_ALREADY_EXISTS)
{
return err;
return dwErrorCode;
}
jeli.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
if(SetInformationJobObject(jobObject,
@ -124,36 +147,102 @@ DWORD createTask(__in PCWSTR jobObjName,__in PWSTR cmdLine)
&jeli,
sizeof(jeli)) == 0)
{
err = GetLastError();
dwErrorCode = GetLastError();
CloseHandle(jobObject);
return err;
return dwErrorCode;
}
if(AssignProcessToJobObject(jobObject, GetCurrentProcess()) == 0)
{
err = GetLastError();
dwErrorCode = GetLastError();
CloseHandle(jobObject);
return err;
return dwErrorCode;
}
// the child JVM uses this env var to send the task OS process identifier
// to the TaskTracker. We pass the job object name.
if(SetEnvironmentVariable(L"JVM_PID", jobObjName) == 0)
{
err = GetLastError();
CloseHandle(jobObject);
return err;
dwErrorCode = GetLastError();
// We have to explictly Terminate, passing in the error code
// simply closing the job would kill our own process with success exit status
TerminateJobObject(jobObject, dwErrorCode);
return dwErrorCode;
}
ZeroMemory( &si, sizeof(si) );
si.cb = sizeof(si);
ZeroMemory( &pi, sizeof(pi) );
if (CreateProcess(NULL, cmdLine, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi) == 0)
{
err = GetLastError();
CloseHandle(jobObject);
return err;
if( logonHandle != NULL ) {
// create user environment for this logon
if(!CreateEnvironmentBlock(&envBlock,
logonHandle,
TRUE )) {
dwErrorCode = GetLastError();
// We have to explictly Terminate, passing in the error code
// simply closing the job would kill our own process with success exit status
TerminateJobObject(jobObject, dwErrorCode);
return dwErrorCode;
}
}
// Get the required buffer size first
currDirCnt = GetCurrentDirectory(0, NULL);
if (0 < currDirCnt) {
curr_dir = (wchar_t*) alloca(currDirCnt * sizeof(wchar_t));
assert(curr_dir);
currDirCnt = GetCurrentDirectory(currDirCnt, curr_dir);
}
if (0 == currDirCnt) {
dwErrorCode = GetLastError();
// We have to explictly Terminate, passing in the error code
// simply closing the job would kill our own process with success exit status
TerminateJobObject(jobObject, dwErrorCode);
return dwErrorCode;
}
if (logonHandle == NULL) {
createProcessResult = CreateProcess(
NULL, // ApplicationName
cmdLine, // command line
NULL, // process security attributes
NULL, // thread security attributes
TRUE, // inherit handles
0, // creation flags
NULL, // environment
curr_dir, // current directory
&si, // startup info
&pi); // process info
}
else {
createProcessResult = CreateProcessAsUser(
logonHandle, // logon token handle
NULL, // Application handle
cmdLine, // command line
NULL, // process security attributes
NULL, // thread security attributes
FALSE, // inherit handles
CREATE_UNICODE_ENVIRONMENT, // creation flags
envBlock, // environment
curr_dir, // current directory
&si, // startup info
&pi); // process info
}
if (FALSE == createProcessResult) {
dwErrorCode = GetLastError();
if( envBlock != NULL ) {
DestroyEnvironmentBlock( envBlock );
envBlock = NULL;
}
// We have to explictly Terminate, passing in the error code
// simply closing the job would kill our own process with success exit status
TerminateJobObject(jobObject, dwErrorCode);
// This is tehnically dead code, we cannot reach this condition
return dwErrorCode;
}
CloseHandle(pi.hThread);
@ -162,10 +251,15 @@ DWORD createTask(__in PCWSTR jobObjName,__in PWSTR cmdLine)
WaitForSingleObject( pi.hProcess, INFINITE );
if(GetExitCodeProcess(pi.hProcess, &exitCode) == 0)
{
err = GetLastError();
dwErrorCode = GetLastError();
}
CloseHandle( pi.hProcess );
if( envBlock != NULL ) {
DestroyEnvironmentBlock( envBlock );
envBlock = NULL;
}
// Terminate job object so that all spawned processes are also killed.
// This is needed because once this process closes the handle to the job
// object and none of the spawned objects have the handle open (via
@ -173,21 +267,134 @@ DWORD createTask(__in PCWSTR jobObjName,__in PWSTR cmdLine)
// program (say winutils task kill) to terminate this job object via its name.
if(TerminateJobObject(jobObject, exitCode) == 0)
{
err = GetLastError();
dwErrorCode = GetLastError();
}
// comes here only on failure or TerminateJobObject
// comes here only on failure of TerminateJobObject
CloseHandle(jobObject);
if(err != ERROR_SUCCESS)
if(dwErrorCode != ERROR_SUCCESS)
{
return err;
return dwErrorCode;
}
return exitCode;
}
//----------------------------------------------------------------------------
// Function: isTaskAlive
// Function: CreateTask
//
// Description:
// Creates a task via a jobobject. Outputs the
// appropriate information to stdout on success, or stderr on failure.
//
// Returns:
// ERROR_SUCCESS: On success
// GetLastError: otherwise
DWORD CreateTask(__in PCWSTR jobObjName,__in PWSTR cmdLine)
{
// call with null logon in order to create tasks utilizing the current logon
return CreateTaskImpl( NULL, jobObjName, cmdLine );
}
//----------------------------------------------------------------------------
// Function: CreateTask
//
// Description:
// Creates a task via a jobobject. Outputs the
// appropriate information to stdout on success, or stderr on failure.
//
// Returns:
// ERROR_SUCCESS: On success
// GetLastError: otherwise
DWORD CreateTaskAsUser(__in PCWSTR jobObjName,__in PWSTR user, __in PWSTR pidFilePath, __in PWSTR cmdLine)
{
DWORD err = ERROR_SUCCESS;
DWORD exitCode = EXIT_FAILURE;
ULONG authnPkgId;
HANDLE lsaHandle = INVALID_HANDLE_VALUE;
PROFILEINFO pi;
BOOL profileIsLoaded = FALSE;
FILE* pidFile = NULL;
DWORD retLen = 0;
HANDLE logonHandle = NULL;
err = EnablePrivilege(SE_TCB_NAME);
if( err != ERROR_SUCCESS ) {
fwprintf(stdout, L"INFO: The user does not have SE_TCB_NAME.\n");
goto done;
}
err = EnablePrivilege(SE_ASSIGNPRIMARYTOKEN_NAME);
if( err != ERROR_SUCCESS ) {
fwprintf(stdout, L"INFO: The user does not have SE_ASSIGNPRIMARYTOKEN_NAME.\n");
goto done;
}
err = EnablePrivilege(SE_INCREASE_QUOTA_NAME);
if( err != ERROR_SUCCESS ) {
fwprintf(stdout, L"INFO: The user does not have SE_INCREASE_QUOTA_NAME.\n");
goto done;
}
err = EnablePrivilege(SE_RESTORE_NAME);
if( err != ERROR_SUCCESS ) {
fwprintf(stdout, L"INFO: The user does not have SE_RESTORE_NAME.\n");
goto done;
}
err = RegisterWithLsa(LOGON_PROCESS_NAME ,&lsaHandle);
if( err != ERROR_SUCCESS ) goto done;
err = LookupKerberosAuthenticationPackageId( lsaHandle, &authnPkgId );
if( err != ERROR_SUCCESS ) goto done;
err = CreateLogonForUser(lsaHandle,
LOGON_PROCESS_NAME,
TOKEN_SOURCE_NAME,
authnPkgId,
user,
&logonHandle);
if( err != ERROR_SUCCESS ) goto done;
err = LoadUserProfileForLogon(logonHandle, &pi);
if( err != ERROR_SUCCESS ) goto done;
profileIsLoaded = TRUE;
// Create the PID file
if (!(pidFile = _wfopen(pidFilePath, "w"))) {
err = GetLastError();
goto done;
}
if (0 > fprintf_s(pidFile, "%ls", jobObjName)) {
err = GetLastError();
}
fclose(pidFile);
if (err != ERROR_SUCCESS) {
goto done;
}
err = CreateTaskImpl(logonHandle, jobObjName, cmdLine);
done:
if( profileIsLoaded ) {
UnloadProfileForLogon( logonHandle, &pi );
profileIsLoaded = FALSE;
}
if( logonHandle != NULL ) {
CloseHandle(logonHandle);
}
if (INVALID_HANDLE_VALUE != lsaHandle) {
UnregisterWithLsa(lsaHandle);
}
return err;
}
//----------------------------------------------------------------------------
// Function: IsTaskAlive
//
// Description:
// Checks if a task is alive via a jobobject. Outputs the
@ -196,7 +403,7 @@ DWORD createTask(__in PCWSTR jobObjName,__in PWSTR cmdLine)
// Returns:
// ERROR_SUCCESS: On success
// GetLastError: otherwise
DWORD isTaskAlive(const WCHAR* jobObjName, int* isAlive, int* procsInJob)
DWORD IsTaskAlive(const WCHAR* jobObjName, int* isAlive, int* procsInJob)
{
PJOBOBJECT_BASIC_PROCESS_ID_LIST procList;
HANDLE jobObject = NULL;
@ -247,7 +454,7 @@ DWORD isTaskAlive(const WCHAR* jobObjName, int* isAlive, int* procsInJob)
}
//----------------------------------------------------------------------------
// Function: killTask
// Function: KillTask
//
// Description:
// Kills a task via a jobobject. Outputs the
@ -256,7 +463,7 @@ DWORD isTaskAlive(const WCHAR* jobObjName, int* isAlive, int* procsInJob)
// Returns:
// ERROR_SUCCESS: On success
// GetLastError: otherwise
DWORD killTask(PCWSTR jobObjName)
DWORD KillTask(PCWSTR jobObjName)
{
HANDLE jobObject = OpenJobObject(JOB_OBJECT_TERMINATE, FALSE, jobObjName);
if(jobObject == NULL)
@ -280,7 +487,7 @@ DWORD killTask(PCWSTR jobObjName)
}
//----------------------------------------------------------------------------
// Function: printTaskProcessList
// Function: PrintTaskProcessList
//
// Description:
// Prints resource usage of all processes in the task jobobject
@ -288,7 +495,7 @@ DWORD killTask(PCWSTR jobObjName)
// Returns:
// ERROR_SUCCESS: On success
// GetLastError: otherwise
DWORD printTaskProcessList(const WCHAR* jobObjName)
DWORD PrintTaskProcessList(const WCHAR* jobObjName)
{
DWORD i;
PJOBOBJECT_BASIC_PROCESS_ID_LIST procList;
@ -372,6 +579,21 @@ int Task(__in int argc, __in_ecount(argc) wchar_t *argv[])
{
DWORD dwErrorCode = ERROR_SUCCESS;
TaskCommandOption command = TaskInvalid;
wchar_t* cmdLine = NULL;
wchar_t buffer[16*1024] = L""; // 32K max command line
size_t charCountBufferLeft = sizeof (buffer)/sizeof(wchar_t);
int crtArgIndex = 0;
size_t argLen = 0;
size_t wscatErr = 0;
wchar_t* insertHere = NULL;
enum {
ARGC_JOBOBJECTNAME = 2,
ARGC_USERNAME,
ARGC_PIDFILE,
ARGC_COMMAND,
ARGC_COMMAND_ARGS
};
if (!ParseCommandLine(argc, argv, &command)) {
dwErrorCode = ERROR_INVALID_COMMAND_LINE;
@ -385,10 +607,57 @@ int Task(__in int argc, __in_ecount(argc) wchar_t *argv[])
{
// Create the task jobobject
//
dwErrorCode = createTask(argv[2], argv[3]);
dwErrorCode = CreateTask(argv[2], argv[3]);
if (dwErrorCode != ERROR_SUCCESS)
{
ReportErrorCode(L"CreateTask", dwErrorCode);
goto TaskExit;
}
} else if (command == TaskCreateAsUser)
{
// Create the task jobobject as a domain user
// createAsUser accepts an open list of arguments. All arguments after the command are
// to be passed as argumrnts to the command itself.Here we're concatenating all
// arguments after the command into a single arg entry.
//
cmdLine = argv[ARGC_COMMAND];
if (argc > ARGC_COMMAND_ARGS) {
crtArgIndex = ARGC_COMMAND;
insertHere = buffer;
while (crtArgIndex < argc) {
argLen = wcslen(argv[crtArgIndex]);
wscatErr = wcscat_s(insertHere, charCountBufferLeft, argv[crtArgIndex]);
switch (wscatErr) {
case 0:
// 0 means success;
break;
case EINVAL:
dwErrorCode = ERROR_INVALID_PARAMETER;
goto TaskExit;
case ERANGE:
dwErrorCode = ERROR_INSUFFICIENT_BUFFER;
goto TaskExit;
default:
// This case is not MSDN documented.
dwErrorCode = ERROR_GEN_FAILURE;
goto TaskExit;
}
insertHere += argLen;
charCountBufferLeft -= argLen;
insertHere[0] = L' ';
insertHere += 1;
charCountBufferLeft -= 1;
insertHere[0] = 0;
++crtArgIndex;
}
cmdLine = buffer;
}
dwErrorCode = CreateTaskAsUser(
argv[ARGC_JOBOBJECTNAME], argv[ARGC_USERNAME], argv[ARGC_PIDFILE], cmdLine);
if (dwErrorCode != ERROR_SUCCESS)
{
ReportErrorCode(L"createTask", dwErrorCode);
ReportErrorCode(L"CreateTaskAsUser", dwErrorCode);
goto TaskExit;
}
} else if (command == TaskIsAlive)
@ -397,10 +666,10 @@ int Task(__in int argc, __in_ecount(argc) wchar_t *argv[])
//
int isAlive;
int numProcs;
dwErrorCode = isTaskAlive(argv[2], &isAlive, &numProcs);
dwErrorCode = IsTaskAlive(argv[2], &isAlive, &numProcs);
if (dwErrorCode != ERROR_SUCCESS)
{
ReportErrorCode(L"isTaskAlive", dwErrorCode);
ReportErrorCode(L"IsTaskAlive", dwErrorCode);
goto TaskExit;
}
@ -412,27 +681,27 @@ int Task(__in int argc, __in_ecount(argc) wchar_t *argv[])
else
{
dwErrorCode = ERROR_TASK_NOT_ALIVE;
ReportErrorCode(L"isTaskAlive returned false", dwErrorCode);
ReportErrorCode(L"IsTaskAlive returned false", dwErrorCode);
goto TaskExit;
}
} else if (command == TaskKill)
{
// Check if task jobobject
//
dwErrorCode = killTask(argv[2]);
dwErrorCode = KillTask(argv[2]);
if (dwErrorCode != ERROR_SUCCESS)
{
ReportErrorCode(L"killTask", dwErrorCode);
ReportErrorCode(L"KillTask", dwErrorCode);
goto TaskExit;
}
} else if (command == TaskProcessList)
{
// Check if task jobobject
//
dwErrorCode = printTaskProcessList(argv[2]);
dwErrorCode = PrintTaskProcessList(argv[2]);
if (dwErrorCode != ERROR_SUCCESS)
{
ReportErrorCode(L"printTaskProcessList", dwErrorCode);
ReportErrorCode(L"PrintTaskProcessList", dwErrorCode);
goto TaskExit;
}
} else
@ -453,10 +722,12 @@ void TaskUsage()
// ProcessTree.isSetsidSupported()
fwprintf(stdout, L"\
Usage: task create [TASKNAME] [COMMAND_LINE] |\n\
task createAsUser [TASKNAME] [USERNAME] [PIDFILE] [COMMAND_LINE] |\n\
task isAlive [TASKNAME] |\n\
task kill [TASKNAME]\n\
task processList [TASKNAME]\n\
Creates a new task jobobject with taskname\n\
Creates a new task jobobject with taskname as the user provided\n\
Checks if task jobobject is alive\n\
Kills task jobobject\n\
Prints to stdout a list of processes in the task\n\

26
hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/util/TestWinUtils.java
View File

@ -20,10 +20,12 @@
import static org.junit.Assert.*;
import static org.junit.Assume.assumeTrue;
import static org.junit.matchers.JUnitMatchers.containsString;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.io.IOException;
import org.apache.commons.io.FileUtils;
@ -33,7 +35,7 @@
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
import static org.junit.Assume.*;
import static org.hamcrest.CoreMatchers.*;
/**
@ -521,4 +523,26 @@ public void testReadLink() throws IOException {
assertThat(ece.getExitCode(), is(1));
}
}
@SuppressWarnings("deprecation")
@Test(timeout=10000)
public void testTaskCreate() throws IOException {
File batch = new File(TEST_DIR, "testTaskCreate.cmd");
File proof = new File(TEST_DIR, "testTaskCreate.out");
FileWriter fw = new FileWriter(batch);
String testNumber = String.format("%f", Math.random());
fw.write(String.format("echo %s > \"%s\"", testNumber, proof.getAbsolutePath()));
fw.close();
assertFalse(proof.exists());
Shell.execCommand(Shell.WINUTILS, "task", "create", "testTaskCreate" + testNumber,
batch.getAbsolutePath());
assertTrue(proof.exists());
String outNumber = FileUtils.readFileToString(proof);
assertThat(outNumber, containsString(testNumber));
}
}

3
hadoop-yarn-project/CHANGES.txt
View File

@ -115,6 +115,9 @@ Release 2.6.0 - UNRELEASED
YARN-2581. Passed LogAggregationContext to NM via ContainerTokenIdentifier.
(Xuan Gong via zjshen)
YARN-1063. Augmented Hadoop common winutils to have the ability to create
containers as domain users. (Remus Rusanu via vinodkv)
IMPROVEMENTS
YARN-2197. Add a link to YARN CHANGES.txt in the left side of doc