big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HDFS-15053. RBF: Add permission check for safemode operation. Contributed by Xiaoqiao He.

Browse Source
This commit is contained in:
Ayush Saxena 2019-12-14 17:57:23 +05:30
parent 7fe924b1c0
commit 72aee114f8
2 changed files with 48 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/java/org/apache/hadoop/hdfs/server/federation/router/RouterAdminServer.java
View File

@ -241,6 +241,13 @@ public InetSocketAddress getRpcAddress() {
return this.adminAddress;
}
void checkSuperuserPrivilege() throws AccessControlException {
RouterPermissionChecker pc = RouterAdminServer.getPermissionChecker();
if (pc != null) {
pc.checkSuperuserPrivilege();
}
}
@Override
protected void serviceInit(Configuration configuration) throws Exception {
this.conf = configuration;
@ -392,6 +399,7 @@ public GetMountTableEntriesResponse getMountTableEntries(
@Override
public EnterSafeModeResponse enterSafeMode(EnterSafeModeRequest request)
throws IOException {
checkSuperuserPrivilege();
boolean success = false;
RouterSafemodeService safeModeService = this.router.getSafemodeService();
if (safeModeService != null) {
@ -412,6 +420,7 @@ public EnterSafeModeResponse enterSafeMode(EnterSafeModeRequest request)
@Override
public LeaveSafeModeResponse leaveSafeMode(LeaveSafeModeRequest request)
throws IOException {
checkSuperuserPrivilege();
boolean success = false;
RouterSafemodeService safeModeService = this.router.getSafemodeService();
if (safeModeService != null) {
@ -508,11 +517,7 @@ private boolean verifySafeMode(boolean isInSafeMode) {
@Override
public DisableNameserviceResponse disableNameservice(
DisableNameserviceRequest request) throws IOException {
RouterPermissionChecker pc = getPermissionChecker();
if (pc != null) {
pc.checkSuperuserPrivilege();
}
checkSuperuserPrivilege();
String nsId = request.getNameServiceId();
boolean success = false;
@ -545,10 +550,7 @@ private boolean namespaceExists(final String nsId) throws IOException {
@Override
public EnableNameserviceResponse enableNameservice(
EnableNameserviceRequest request) throws IOException {
RouterPermissionChecker pc = getPermissionChecker();
if (pc != null) {
pc.checkSuperuserPrivilege();
}
checkSuperuserPrivilege();
String nsId = request.getNameServiceId();
DisabledNameserviceStore store = getDisabledNameserviceStore();

37
hadoop-hdfs-project/hadoop-hdfs-rbf/src/test/java/org/apache/hadoop/hdfs/server/federation/router/TestRouterAdminCLI.java
View File

@ -862,6 +862,43 @@ public void testSafeModeStatus() throws Exception {
assertTrue(out.toString().contains("false"));
}
@Test
public void testSafeModePermission() throws Exception {
// ensure the Router become RUNNING state
waitState(RouterServiceState.RUNNING);
assertFalse(routerContext.getRouter().getSafemodeService().isInSafeMode());
UserGroupInformation superUser = UserGroupInformation.createRemoteUser(
UserGroupInformation.getCurrentUser().getShortUserName());
UserGroupInformation remoteUser = UserGroupInformation
.createRemoteUser(TEST_USER);
try {
// use normal user as current user to test
UserGroupInformation.setLoginUser(remoteUser);
assertEquals(-1,
ToolRunner.run(admin, new String[]{"-safemode", "enter"}));
// set back login user
UserGroupInformation.setLoginUser(superUser);
assertEquals(0,
ToolRunner.run(admin, new String[]{"-safemode", "enter"}));
// use normal user as current user to test
UserGroupInformation.setLoginUser(remoteUser);
assertEquals(-1,
ToolRunner.run(admin, new String[]{"-safemode", "leave"}));
// set back login user
UserGroupInformation.setLoginUser(superUser);
assertEquals(0,
ToolRunner.run(admin, new String[]{"-safemode", "leave"}));
} finally {
// set back login user to make sure it doesn't pollute other unit tests
// even this one fails.
UserGroupInformation.setLoginUser(superUser);
}
}
@Test
public void testCreateInvalidEntry() throws Exception {
String[] argv = new String[] {