Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HDFS-13194. CachePool permissions incorrectly checked. Contributed by Jianfei Jiang.

This commit is contained in:
Yiqun Lin 2018-02-28 10:17:43 +08:00
parent d86f301d46
commit a9c14b1119
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/FSPermissionChecker.java
View File

@ -573,7 +573,9 @@ public class FSPermissionChecker implements AccessControlEnforcer {
&& mode.getGroupAction().implies(access)) { && mode.getGroupAction().implies(access)) {
return; return;
} }
if (mode.getOtherAction().implies(access)) { if (!getUser().equals(pool.getOwnerName())
&& !isMemberOfGroup(pool.getGroupName())
&& mode.getOtherAction().implies(access)) {
return; return;
} }
throw new AccessControlException("Permission denied while accessing pool " throw new AccessControlException("Permission denied while accessing pool "

15
hadoop-hdfs-project/hadoop-hdfs/src/test/java/org/apache/hadoop/hdfs/server/namenode/TestCacheDirectives.java
View File

@ -420,6 +420,9 @@ public class TestCacheDirectives {
setMode(new FsPermission((short)0777))); setMode(new FsPermission((short)0777)));
proto.addCachePool(new CachePoolInfo("pool4"). proto.addCachePool(new CachePoolInfo("pool4").
setMode(new FsPermission((short)0))); setMode(new FsPermission((short)0)));
proto.addCachePool(new CachePoolInfo("pool5").
setMode(new FsPermission((short)0007))
.setOwnerName(unprivilegedUser.getShortUserName()));
CacheDirectiveInfo alpha = new CacheDirectiveInfo.Builder(). CacheDirectiveInfo alpha = new CacheDirectiveInfo.Builder().
setPath(new Path("/alpha")). setPath(new Path("/alpha")).
@ -488,6 +491,18 @@ public class TestCacheDirectives {
long deltaId = addAsUnprivileged(delta); long deltaId = addAsUnprivileged(delta);
try {
addAsUnprivileged(new CacheDirectiveInfo.Builder().
setPath(new Path("/epsilon")).
setPool("pool5").
build());
fail("expected an error when adding to a pool with " +
"mode 007 (no permissions for pool owner).");
} catch (AccessControlException e) {
GenericTestUtils.
assertExceptionContains("Permission denied while accessing pool", e);
}
// We expect the following to succeed, because DistributedFileSystem // We expect the following to succeed, because DistributedFileSystem
// qualifies the path. // qualifies the path.
long relativeId = addAsUnprivileged( long relativeId = addAsUnprivileged(