big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HADOOP-12413. AccessControlList should avoid calling getGroupNames in isUserInList with empty groups. Contributed by Zhihai Xu.

Browse Source
This commit is contained in:
cnauroth 2015-09-15 10:41:50 -07:00
parent 083b44c136
commit b2017d9b03
3 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hadoop-common-project/hadoop-common/CHANGES.txt
View File

@ -776,6 +776,9 @@ Release 2.8.0 - UNRELEASED
HADOOP-12324. Better exception reporting in SaslPlainServer.
(Mike Yoder via stevel)
HADOOP-12413. AccessControlList should avoid calling getGroupNames in
isUserInList with empty groups. (Zhihai Xu via cnauroth)
OPTIMIZATIONS
HADOOP-11785. Reduce the number of listStatus operation in distcp

2
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/AccessControlList.java
View File

@ -230,7 +230,7 @@ public Collection<String> getGroups() {
public final boolean isUserInList(UserGroupInformation ugi) {
if (allAllowed || users.contains(ugi.getShortUserName())) {
return true;
} else {
} else if (!groups.isEmpty()) {
for(String group: ugi.getGroupNames()) {
if (groups.contains(group)) {
return true;

9
hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/security/authorize/TestAccessControlList.java
View File

@ -37,6 +37,10 @@
import org.apache.hadoop.util.NativeCodeLoader;
import org.junit.Test;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.verify;
@InterfaceAudience.LimitedPrivate({"HDFS", "MapReduce"})
@InterfaceStability.Evolving
public class TestAccessControlList {
@ -449,6 +453,11 @@ public void testIsUserAllowed() {
assertUserAllowed(susan, acl);
assertUserAllowed(barbara, acl);
assertUserAllowed(ian, acl);
acl = new AccessControlList("");
UserGroupInformation spyUser = spy(drwho);
acl.isUserAllowed(spyUser);
verify(spyUser, never()).getGroupNames();
}
private void assertUserAllowed(UserGroupInformation ugi,