Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HADOOP-12413. AccessControlList should avoid calling getGroupNames in isUserInList with empty groups. Contributed by Zhihai Xu.

This commit is contained in:
cnauroth 2015-09-15 10:41:50 -07:00
parent 083b44c136
commit b2017d9b03
3 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hadoop-common-project/hadoop-common/CHANGES.txt
View File

@ -776,6 +776,9 @@ Release 2.8.0 - UNRELEASED
HADOOP-12324. Better exception reporting in SaslPlainServer. HADOOP-12324. Better exception reporting in SaslPlainServer.
(Mike Yoder via stevel) (Mike Yoder via stevel)
HADOOP-12413. AccessControlList should avoid calling getGroupNames in
isUserInList with empty groups. (Zhihai Xu via cnauroth)
OPTIMIZATIONS OPTIMIZATIONS
HADOOP-11785. Reduce the number of listStatus operation in distcp HADOOP-11785. Reduce the number of listStatus operation in distcp

2
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java
View File

@ -230,7 +230,7 @@ public class AccessControlList implements Writable {
public final boolean isUserInList(UserGroupInformation ugi) { public final boolean isUserInList(UserGroupInformation ugi) {
if (allAllowed || users.contains(ugi.getShortUserName())) { if (allAllowed || users.contains(ugi.getShortUserName())) {
return true; return true;
} else { } else if (!groups.isEmpty()) {
for(String group: ugi.getGroupNames()) { for(String group: ugi.getGroupNames()) {
if (groups.contains(group)) { if (groups.contains(group)) {
return true; return true;

9
hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/authorize/TestAccessControlList.java
View File

@ -37,6 +37,10 @@ import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.util.NativeCodeLoader; import org.apache.hadoop.util.NativeCodeLoader;
import org.junit.Test; import org.junit.Test;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.verify;
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"}) @InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"})
@InterfaceStability.Evolving @InterfaceStability.Evolving
public class TestAccessControlList { public class TestAccessControlList {
@ -449,6 +453,11 @@ public class TestAccessControlList {
assertUserAllowed(susan, acl); assertUserAllowed(susan, acl);
assertUserAllowed(barbara, acl); assertUserAllowed(barbara, acl);
assertUserAllowed(ian, acl); assertUserAllowed(ian, acl);
acl = new AccessControlList("");
UserGroupInformation spyUser = spy(drwho);
acl.isUserAllowed(spyUser);
verify(spyUser, never()).getGroupNames();
} }
private void assertUserAllowed(UserGroupInformation ugi, private void assertUserAllowed(UserGroupInformation ugi,