HDFS-11076. Add unit test for extended Acls. Contributed by Chen Liang
This commit is contained in:
Mingliang Liu
parent
7154a20bcb
commit
7534aee09a
|
|
@ -0,0 +1,441 @@
|
||||||
|
/**
|
||||||
|
* Licensed to the Apache Software Foundation (ASF) under one
|
||||||
|
* or more contributor license agreements. See the NOTICE file
|
||||||
|
* distributed with this work for additional information
|
||||||
|
* regarding copyright ownership. The ASF licenses this file
|
||||||
|
* to you under the Apache License, Version 2.0 (the
|
||||||
|
* "License"); you may not use this file except in compliance
|
||||||
|
* with the License. You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
package org.apache.hadoop.hdfs;
|
||||||
|
|
||||||
|
import com.google.common.collect.Lists;
|
||||||
|
import org.apache.hadoop.conf.Configuration;
|
||||||
|
import org.apache.hadoop.fs.FileSystem;
|
||||||
|
import org.apache.hadoop.fs.Path;
|
||||||
|
import org.apache.hadoop.fs.permission.AclEntry;
|
||||||
|
import org.apache.hadoop.fs.permission.AclStatus;
|
||||||
|
import org.apache.hadoop.fs.permission.FsAction;
|
||||||
|
import org.apache.hadoop.fs.permission.FsPermission;
|
||||||
|
import org.apache.hadoop.security.AccessControlException;
|
||||||
|
import org.apache.hadoop.security.UserGroupInformation;
|
||||||
|
import org.junit.AfterClass;
|
||||||
|
import org.junit.BeforeClass;
|
||||||
|
import org.junit.Test;
|
||||||
|
|
||||||
|
import java.io.IOException;
|
||||||
|
import java.security.PrivilegedExceptionAction;
|
||||||
|
import java.util.List;
|
||||||
|
|
||||||
|
import static org.apache.hadoop.fs.permission.AclEntryScope.ACCESS;
|
||||||
|
import static org.apache.hadoop.fs.permission.AclEntryType.MASK;
|
||||||
|
import static org.apache.hadoop.fs.permission.AclEntryType.USER;
|
||||||
|
import static org.apache.hadoop.fs.permission.FsAction.NONE;
|
||||||
|
import static org.apache.hadoop.fs.permission.FsAction.READ;
|
||||||
|
import static org.apache.hadoop.fs.permission.FsAction.READ_EXECUTE;
|
||||||
|
import static org.apache.hadoop.fs.permission.FsAction.READ_WRITE;
|
||||||
|
import static org.apache.hadoop.hdfs.DFSConfigKeys.DFS_NAMENODE_ACLS_ENABLED_KEY;
|
||||||
|
import static org.apache.hadoop.hdfs.server.namenode.AclTestHelpers.aclEntry;
|
||||||
|
|
||||||
|
import static org.apache.hadoop.fs.permission.AclEntryScope.DEFAULT;
|
||||||
|
import static org.apache.hadoop.fs.permission.FsAction.ALL;
|
||||||
|
import static org.apache.hadoop.fs.permission.AclEntryType.GROUP;
|
||||||
|
import static org.apache.hadoop.fs.permission.AclEntryType.OTHER;
|
||||||
|
import static org.junit.Assert.assertArrayEquals;
|
||||||
|
import static org.junit.Assert.assertFalse;
|
||||||
|
import static org.junit.Assert.assertTrue;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* A class for testing the behavior of HDFS directory and file ACL.
|
||||||
|
*/
|
||||||
|
public class TestExtendedAcls {
|
||||||
|
|
||||||
|
private static MiniDFSCluster cluster;
|
||||||
|
private static Configuration conf;
|
||||||
|
|
||||||
|
private static final short REPLICATION = 3;
|
||||||
|
|
||||||
|
private static DistributedFileSystem hdfs;
|
||||||
|
|
||||||
|
@BeforeClass
|
||||||
|
public static void setup() throws IOException {
|
||||||
|
conf = new Configuration();
|
||||||
|
conf.setBoolean(DFS_NAMENODE_ACLS_ENABLED_KEY, true);
|
||||||
|
cluster = new MiniDFSCluster.Builder(conf)
|
||||||
|
.numDataNodes(REPLICATION)
|
||||||
|
.build();
|
||||||
|
cluster.waitActive();
|
||||||
|
hdfs = cluster.getFileSystem();
|
||||||
|
}
|
||||||
|
|
||||||
|
@AfterClass
|
||||||
|
public static void shutdown() throws IOException {
|
||||||
|
if (cluster != null) {
|
||||||
|
cluster.shutdown();
|
||||||
|
cluster = null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set default ACL to a directory.
|
||||||
|
* Create subdirectory, it must have default acls set.
|
||||||
|
* Create sub file and it should have default acls.
|
||||||
|
* @throws IOException
|
||||||
|
*/
|
||||||
|
@Test
|
||||||
|
public void testDefaultAclNewChildDirFile() throws IOException {
|
||||||
|
Path parent = new Path("/testDefaultAclNewChildDirFile");
|
||||||
|
List<AclEntry> acls = Lists.newArrayList(
|
||||||
|
aclEntry(DEFAULT, USER, "foo", ALL));
|
||||||
|
|
||||||
|
hdfs.mkdirs(parent);
|
||||||
|
hdfs.setAcl(parent, acls);
|
||||||
|
|
||||||
|
// create sub directory
|
||||||
|
Path childDir = new Path(parent, "childDir");
|
||||||
|
hdfs.mkdirs(childDir);
|
||||||
|
// the sub directory should have the default acls
|
||||||
|
AclEntry[] childDirExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", ALL),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, USER, ALL),
|
||||||
|
aclEntry(DEFAULT, USER, "foo", ALL),
|
||||||
|
aclEntry(DEFAULT, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, MASK, ALL),
|
||||||
|
aclEntry(DEFAULT, OTHER, READ_EXECUTE)
|
||||||
|
};
|
||||||
|
AclStatus childDirAcl = hdfs.getAclStatus(childDir);
|
||||||
|
assertArrayEquals(childDirExpectedAcl, childDirAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
// create sub file
|
||||||
|
Path childFile = new Path(parent, "childFile");
|
||||||
|
hdfs.create(childFile).close();
|
||||||
|
// the sub file should have the default acls
|
||||||
|
AclEntry[] childFileExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", ALL),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE)
|
||||||
|
};
|
||||||
|
AclStatus childFileAcl = hdfs.getAclStatus(childFile);
|
||||||
|
assertArrayEquals(
|
||||||
|
childFileExpectedAcl, childFileAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
hdfs.delete(parent, true);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Set default ACL to a directory and make sure existing sub dirs/files
|
||||||
|
* does not have default acl.
|
||||||
|
* @throws IOException
|
||||||
|
*/
|
||||||
|
@Test
|
||||||
|
public void testDefaultAclExistingDirFile() throws Exception {
|
||||||
|
Path parent = new Path("/testDefaultAclExistingDirFile");
|
||||||
|
hdfs.mkdirs(parent);
|
||||||
|
// the old acls
|
||||||
|
List<AclEntry> acls1 = Lists.newArrayList(
|
||||||
|
aclEntry(DEFAULT, USER, "foo", ALL));
|
||||||
|
// the new acls
|
||||||
|
List<AclEntry> acls2 = Lists.newArrayList(
|
||||||
|
aclEntry(DEFAULT, USER, "foo", READ_EXECUTE));
|
||||||
|
// set parent to old acl
|
||||||
|
hdfs.setAcl(parent, acls1);
|
||||||
|
|
||||||
|
Path childDir = new Path(parent, "childDir");
|
||||||
|
hdfs.mkdirs(childDir);
|
||||||
|
// the sub directory should also have the old acl
|
||||||
|
AclEntry[] childDirExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", ALL),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, USER, ALL),
|
||||||
|
aclEntry(DEFAULT, USER, "foo", ALL),
|
||||||
|
aclEntry(DEFAULT, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, MASK, ALL),
|
||||||
|
aclEntry(DEFAULT, OTHER, READ_EXECUTE)
|
||||||
|
};
|
||||||
|
AclStatus childDirAcl = hdfs.getAclStatus(childDir);
|
||||||
|
assertArrayEquals(childDirExpectedAcl, childDirAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
Path childFile = new Path(childDir, "childFile");
|
||||||
|
// the sub file should also have the old acl
|
||||||
|
hdfs.create(childFile).close();
|
||||||
|
AclEntry[] childFileExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", ALL),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE)
|
||||||
|
};
|
||||||
|
AclStatus childFileAcl = hdfs.getAclStatus(childFile);
|
||||||
|
assertArrayEquals(
|
||||||
|
childFileExpectedAcl, childFileAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
// now change parent to new acls
|
||||||
|
hdfs.setAcl(parent, acls2);
|
||||||
|
|
||||||
|
// sub directory and sub file should still have the old acls
|
||||||
|
childDirAcl = hdfs.getAclStatus(childDir);
|
||||||
|
assertArrayEquals(childDirExpectedAcl, childDirAcl.getEntries().toArray());
|
||||||
|
childFileAcl = hdfs.getAclStatus(childFile);
|
||||||
|
assertArrayEquals(
|
||||||
|
childFileExpectedAcl, childFileAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
// now remove the parent acls
|
||||||
|
hdfs.removeAcl(parent);
|
||||||
|
|
||||||
|
// sub directory and sub file should still have the old acls
|
||||||
|
childDirAcl = hdfs.getAclStatus(childDir);
|
||||||
|
assertArrayEquals(childDirExpectedAcl, childDirAcl.getEntries().toArray());
|
||||||
|
childFileAcl = hdfs.getAclStatus(childFile);
|
||||||
|
assertArrayEquals(
|
||||||
|
childFileExpectedAcl, childFileAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
// check changing the access mode of the file
|
||||||
|
// mask out the access of group other for testing
|
||||||
|
hdfs.setPermission(childFile, new FsPermission((short)0640));
|
||||||
|
boolean canAccess =
|
||||||
|
tryAccess(childFile, "other", new String[]{"other"}, READ);
|
||||||
|
assertFalse(canAccess);
|
||||||
|
hdfs.delete(parent, true);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Verify that access acl does not get inherited on newly created subdir/file.
|
||||||
|
* @throws IOException
|
||||||
|
*/
|
||||||
|
@Test
|
||||||
|
public void testAccessAclNotInherited() throws IOException {
|
||||||
|
Path parent = new Path("/testAccessAclNotInherited");
|
||||||
|
hdfs.mkdirs(parent);
|
||||||
|
// parent have both access acl and default acl
|
||||||
|
List<AclEntry> acls = Lists.newArrayList(
|
||||||
|
aclEntry(DEFAULT, USER, "foo", READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, USER, READ_WRITE),
|
||||||
|
aclEntry(ACCESS, GROUP, READ),
|
||||||
|
aclEntry(ACCESS, OTHER, READ),
|
||||||
|
aclEntry(ACCESS, USER, "bar", ALL));
|
||||||
|
hdfs.setAcl(parent, acls);
|
||||||
|
|
||||||
|
Path childDir = new Path(parent, "childDir");
|
||||||
|
hdfs.mkdirs(childDir);
|
||||||
|
// subdirectory should only have the default acl inherited
|
||||||
|
AclEntry[] childDirExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, GROUP, READ),
|
||||||
|
aclEntry(DEFAULT, USER, READ_WRITE),
|
||||||
|
aclEntry(DEFAULT, USER, "foo", READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, GROUP, READ),
|
||||||
|
aclEntry(DEFAULT, MASK, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, OTHER, READ)
|
||||||
|
};
|
||||||
|
AclStatus childDirAcl = hdfs.getAclStatus(childDir);
|
||||||
|
assertArrayEquals(childDirExpectedAcl, childDirAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
Path childFile = new Path(parent, "childFile");
|
||||||
|
hdfs.create(childFile).close();
|
||||||
|
// sub file should only have the default acl inherited
|
||||||
|
AclEntry[] childFileExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, GROUP, READ)
|
||||||
|
};
|
||||||
|
AclStatus childFileAcl = hdfs.getAclStatus(childFile);
|
||||||
|
assertArrayEquals(
|
||||||
|
childFileExpectedAcl, childFileAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
hdfs.delete(parent, true);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Create a parent dir and set default acl to allow foo read/write access.
|
||||||
|
* Create a sub dir and set default acl to allow bar group read/write access.
|
||||||
|
* parent dir/file can not be viewed/appended by bar group.
|
||||||
|
* parent dir/child dir/file can be viewed/appended by bar group.
|
||||||
|
* @throws Exception
|
||||||
|
*/
|
||||||
|
@Test
|
||||||
|
public void testGradSubdirMoreAccess() throws Exception {
|
||||||
|
Path parent = new Path("/testGradSubdirMoreAccess");
|
||||||
|
hdfs.mkdirs(parent);
|
||||||
|
List<AclEntry> aclsParent = Lists.newArrayList(
|
||||||
|
aclEntry(DEFAULT, USER, "foo", READ_EXECUTE));
|
||||||
|
List<AclEntry> aclsChild = Lists.newArrayList(
|
||||||
|
aclEntry(DEFAULT, GROUP, "bar", READ_WRITE));
|
||||||
|
|
||||||
|
hdfs.setAcl(parent, aclsParent);
|
||||||
|
AclEntry[] parentDirExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(DEFAULT, USER, ALL),
|
||||||
|
aclEntry(DEFAULT, USER, "foo", READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, MASK, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, OTHER, READ_EXECUTE)
|
||||||
|
};
|
||||||
|
AclStatus parentAcl = hdfs.getAclStatus(parent);
|
||||||
|
assertArrayEquals(parentDirExpectedAcl, parentAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
Path childDir = new Path(parent, "childDir");
|
||||||
|
hdfs.mkdirs(childDir);
|
||||||
|
hdfs.modifyAclEntries(childDir, aclsChild);
|
||||||
|
// child dir should inherit the default acls from parent, plus bar group
|
||||||
|
AclEntry[] childDirExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, USER, ALL),
|
||||||
|
aclEntry(DEFAULT, USER, "foo", READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, GROUP, "bar", READ_WRITE),
|
||||||
|
aclEntry(DEFAULT, MASK, ALL),
|
||||||
|
aclEntry(DEFAULT, OTHER, READ_EXECUTE)
|
||||||
|
};
|
||||||
|
AclStatus childDirAcl = hdfs.getAclStatus(childDir);
|
||||||
|
assertArrayEquals(childDirExpectedAcl, childDirAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
Path parentFile = new Path(parent, "parentFile");
|
||||||
|
hdfs.create(parentFile).close();
|
||||||
|
hdfs.setPermission(parentFile, new FsPermission((short)0640));
|
||||||
|
// parent dir/parent file allows foo to access but not bar group
|
||||||
|
AclEntry[] parentFileExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE)
|
||||||
|
};
|
||||||
|
AclStatus parentFileAcl = hdfs.getAclStatus(parentFile);
|
||||||
|
assertArrayEquals(parentFileExpectedAcl,
|
||||||
|
parentFileAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
Path childFile = new Path(childDir, "childFile");
|
||||||
|
hdfs.create(childFile).close();
|
||||||
|
hdfs.setPermission(childFile, new FsPermission((short)0640));
|
||||||
|
// child dir/child file allows foo user and bar group to access
|
||||||
|
AclEntry[] childFileExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, GROUP, "bar", READ_WRITE)
|
||||||
|
};
|
||||||
|
AclStatus childFileAcl = hdfs.getAclStatus(childFile);
|
||||||
|
assertArrayEquals(
|
||||||
|
childFileExpectedAcl, childFileAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
// parent file should not be accessible for bar group
|
||||||
|
assertFalse(tryAccess(parentFile, "barUser", new String[]{"bar"}, READ));
|
||||||
|
// child file should be accessible for bar group
|
||||||
|
assertTrue(tryAccess(childFile, "barUser", new String[]{"bar"}, READ));
|
||||||
|
// parent file should be accessible for foo user
|
||||||
|
assertTrue(tryAccess(parentFile, "foo", new String[]{"fooGroup"}, READ));
|
||||||
|
// child file should be accessible for foo user
|
||||||
|
assertTrue(tryAccess(childFile, "foo", new String[]{"fooGroup"}, READ));
|
||||||
|
|
||||||
|
hdfs.delete(parent, true);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Verify that sub directory can restrict acl with acl inherited from parent.
|
||||||
|
* Create a parent dir and set default to allow foo and bar full access
|
||||||
|
* Create a sub dir and set default to restrict bar to empty access
|
||||||
|
*
|
||||||
|
* parent dir/file can be viewed by foo
|
||||||
|
* parent dir/child dir/file can be viewed by foo
|
||||||
|
* parent dir/child dir/file can not be viewed by bar
|
||||||
|
*
|
||||||
|
* @throws IOException
|
||||||
|
*/
|
||||||
|
@Test
|
||||||
|
public void testRestrictAtSubDir() throws Exception {
|
||||||
|
Path parent = new Path("/testRestrictAtSubDir");
|
||||||
|
hdfs.mkdirs(parent);
|
||||||
|
List<AclEntry> aclsParent = Lists.newArrayList(
|
||||||
|
aclEntry(DEFAULT, USER, "foo", ALL),
|
||||||
|
aclEntry(DEFAULT, GROUP, "bar", ALL)
|
||||||
|
);
|
||||||
|
hdfs.setAcl(parent, aclsParent);
|
||||||
|
AclEntry[] parentDirExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(DEFAULT, USER, ALL),
|
||||||
|
aclEntry(DEFAULT, USER, "foo", ALL),
|
||||||
|
aclEntry(DEFAULT, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, GROUP, "bar", ALL),
|
||||||
|
aclEntry(DEFAULT, MASK, ALL),
|
||||||
|
aclEntry(DEFAULT, OTHER, READ_EXECUTE)
|
||||||
|
};
|
||||||
|
AclStatus parentAcl = hdfs.getAclStatus(parent);
|
||||||
|
assertArrayEquals(parentDirExpectedAcl, parentAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
Path parentFile = new Path(parent, "parentFile");
|
||||||
|
hdfs.create(parentFile).close();
|
||||||
|
hdfs.setPermission(parentFile, new FsPermission((short)0640));
|
||||||
|
AclEntry[] parentFileExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", ALL),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, GROUP, "bar", ALL),
|
||||||
|
};
|
||||||
|
AclStatus parentFileAcl = hdfs.getAclStatus(parentFile);
|
||||||
|
assertArrayEquals(
|
||||||
|
parentFileExpectedAcl, parentFileAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
Path childDir = new Path(parent, "childDir");
|
||||||
|
hdfs.mkdirs(childDir);
|
||||||
|
List<AclEntry> newAclsChild = Lists.newArrayList(
|
||||||
|
aclEntry(DEFAULT, GROUP, "bar", NONE)
|
||||||
|
);
|
||||||
|
hdfs.modifyAclEntries(childDir, newAclsChild);
|
||||||
|
AclEntry[] childDirExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", ALL),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, GROUP, "bar", ALL),
|
||||||
|
aclEntry(DEFAULT, USER, ALL),
|
||||||
|
aclEntry(DEFAULT, USER, "foo", ALL),
|
||||||
|
aclEntry(DEFAULT, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(DEFAULT, GROUP, "bar", NONE),
|
||||||
|
aclEntry(DEFAULT, MASK, ALL),
|
||||||
|
aclEntry(DEFAULT, OTHER, READ_EXECUTE)
|
||||||
|
};
|
||||||
|
AclStatus childDirAcl = hdfs.getAclStatus(childDir);
|
||||||
|
assertArrayEquals(childDirExpectedAcl, childDirAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
Path childFile = new Path(childDir, "childFile");
|
||||||
|
hdfs.create(childFile).close();
|
||||||
|
hdfs.setPermission(childFile, new FsPermission((short)0640));
|
||||||
|
AclEntry[] childFileExpectedAcl = new AclEntry[] {
|
||||||
|
aclEntry(ACCESS, USER, "foo", ALL),
|
||||||
|
aclEntry(ACCESS, GROUP, READ_EXECUTE),
|
||||||
|
aclEntry(ACCESS, GROUP, "bar", NONE)
|
||||||
|
};
|
||||||
|
AclStatus childFileAcl = hdfs.getAclStatus(childFile);
|
||||||
|
assertArrayEquals(
|
||||||
|
childFileExpectedAcl, childFileAcl.getEntries().toArray());
|
||||||
|
|
||||||
|
// child file should not be accessible for bar group
|
||||||
|
assertFalse(tryAccess(childFile, "barUser", new String[]{"bar"}, READ));
|
||||||
|
// child file should be accessible for foo user
|
||||||
|
assertTrue(tryAccess(childFile, "foo", new String[]{"fooGroup"}, READ));
|
||||||
|
// parent file should be accessible for bar group
|
||||||
|
assertTrue(tryAccess(parentFile, "barUser", new String[]{"bar"}, READ));
|
||||||
|
// parent file should be accessible for foo user
|
||||||
|
assertTrue(tryAccess(parentFile, "foo", new String[]{"fooGroup"}, READ));
|
||||||
|
|
||||||
|
hdfs.delete(parent, true);
|
||||||
|
}
|
||||||
|
|
||||||
|
private boolean tryAccess(Path path, String user,
|
||||||
|
String[] group, FsAction action) throws Exception {
|
||||||
|
UserGroupInformation testUser =
|
||||||
|
UserGroupInformation.createUserForTesting(
|
||||||
|
user, group);
|
||||||
|
FileSystem fs = testUser.doAs(new PrivilegedExceptionAction<FileSystem>() {
|
||||||
|
@Override
|
||||||
|
public FileSystem run() throws Exception {
|
||||||
|
return FileSystem.get(conf);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
boolean canAccess;
|
||||||
|
try {
|
||||||
|
fs.access(path, action);
|
||||||
|
canAccess = true;
|
||||||
|
} catch (AccessControlException e) {
|
||||||
|
canAccess = false;
|
||||||
|
}
|
||||||
|
return canAccess;
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue