diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt index de4432478df..8b500651986 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt +++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt @@ -900,6 +900,9 @@ Release 2.8.0 - UNRELEASED HDFS-8984. Move replication queues related methods in FSNamesystem to BlockManager. (wheat9) + HDFS-9019. Adding informative message to sticky bit permission denied + exception. (xyao) + OPTIMIZATIONS HDFS-8026. Trace FSOutputSummer#writeChecksumChunks rather than diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSPermissionChecker.java b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSPermissionChecker.java index e6570f544e6..041ce0b277a 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSPermissionChecker.java +++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSPermissionChecker.java @@ -207,7 +207,7 @@ class FSPermissionChecker implements AccessControlEnforcer { final INodeAttributes last = inodeAttrs[inodeAttrs.length - 1]; if (parentAccess != null && parentAccess.implies(FsAction.WRITE) && inodeAttrs.length > 1 && last != null) { - checkStickyBit(inodeAttrs[inodeAttrs.length - 2], last); + checkStickyBit(inodeAttrs[inodeAttrs.length - 2], last, path); } if (ancestorAccess != null && inodeAttrs.length > 1) { check(inodeAttrs, path, ancestorIndex, ancestorAccess); @@ -405,8 +405,8 @@ class FSPermissionChecker implements AccessControlEnforcer { } /** Guarded by {@link FSNamesystem#readLock()} */ - private void checkStickyBit(INodeAttributes parent, INodeAttributes inode - ) throws AccessControlException { + private void checkStickyBit(INodeAttributes parent, INodeAttributes inode, + String path) throws AccessControlException { if (!parent.getFsPermission().getStickyBit()) { return; } @@ -421,8 +421,14 @@ class FSPermissionChecker implements AccessControlEnforcer { return; } - throw new AccessControlException("Permission denied by sticky bit setting:" + - " user=" + getUser() + ", inode=" + inode); + throw new AccessControlException(String.format( + "Permission denied by sticky bit: user=%s, path=\"%s\":%s:%s:%s%s, " + + "parent=\"%s\":%s:%s:%s%s", user, + path, inode.getUserName(), inode.getGroupName(), + inode.isDirectory() ? "d" : "-", inode.getFsPermission().toString(), + path.substring(0, path.length() - inode.toString().length() - 1 ), + parent.getUserName(), parent.getGroupName(), + parent.isDirectory() ? "d" : "-", parent.getFsPermission().toString())); } /** diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/fs/permission/TestStickyBit.java b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/fs/permission/TestStickyBit.java index 9d0e31be520..d5cece4195a 100644 --- a/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/fs/permission/TestStickyBit.java +++ b/hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/fs/permission/TestStickyBit.java @@ -140,6 +140,9 @@ public class TestStickyBit { } catch (IOException ioe) { assertTrue(ioe instanceof AccessControlException); assertTrue(ioe.getMessage().contains("sticky bit")); + assertTrue(ioe.getMessage().contains("user="+user2.getUserName())); + assertTrue(ioe.getMessage().contains("path=\"" + file + "\"")); + assertTrue(ioe.getMessage().contains("parent=\"" + file.getParent() + "\"")); } }