You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by aw...@apache.org on 2014/12/10 22:41:37 UTC
hadoop git commit: HADOOP-6590. Add a username check for hadoop
sub-commands (John Smith via aw)
Repository: hadoop
Updated Branches:
refs/heads/trunk a7c6c710b -> c53614269
HADOOP-6590. Add a username check for hadoop sub-commands (John Smith via aw)
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/c5361426
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/c5361426
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/c5361426
Branch: refs/heads/trunk
Commit: c536142699099c0e6da3413f1bbb01784577e28e
Parents: a7c6c71
Author: Allen Wittenauer <aw...@apache.org>
Authored: Wed Dec 10 13:41:28 2014 -0800
Committer: Allen Wittenauer <aw...@apache.org>
Committed: Wed Dec 10 13:41:28 2014 -0800
----------------------------------------------------------------------
hadoop-common-project/hadoop-common/CHANGES.txt | 2 ++
hadoop-common-project/hadoop-common/src/main/bin/hadoop | 2 ++
.../hadoop-common/src/main/bin/hadoop-functions.sh | 12 ++++++++++++
.../hadoop-common/src/main/conf/hadoop-env.sh | 6 ++++++
hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs | 2 ++
hadoop-mapreduce-project/bin/mapred | 2 ++
hadoop-yarn-project/hadoop-yarn/bin/yarn | 2 ++
7 files changed, 28 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/CHANGES.txt
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index 7310dd4..6e1cc11 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -24,6 +24,8 @@ Trunk (Unreleased)
(Dexter Bradshaw, Mostafa Elhemali, Xi Fang, Johannes Klein, David Lao,
Mike Liddell, Chuan Liu, Lengning Liu, Ivan Mitic, Michael Rys,
Alexander Stojanovich, Brian Swan, and Min Wei via cnauroth)
+
+ HADOOP-6590. Add a username check for hadoop sub-commands (John Smith via aw)
IMPROVEMENTS
http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/src/main/bin/hadoop
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/main/bin/hadoop b/hadoop-common-project/hadoop-common/src/main/bin/hadoop
index be38382..b216b8f 100755
--- a/hadoop-common-project/hadoop-common/src/main/bin/hadoop
+++ b/hadoop-common-project/hadoop-common/src/main/bin/hadoop
@@ -179,6 +179,8 @@ case ${COMMAND} in
;;
esac
+hadoop_verify_user "${COMMAND}"
+
# Always respect HADOOP_OPTS and HADOOP_CLIENT_OPTS
hadoop_debug "Appending HADOOP_CLIENT_OPTS onto HADOOP_OPTS"
HADOOP_OPTS="${HADOOP_OPTS} ${HADOOP_CLIENT_OPTS}"
http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh b/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh
index 3e353d9..dfd7315 100644
--- a/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh
+++ b/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh
@@ -1154,3 +1154,15 @@ function hadoop_secure_daemon_handler
esac
}
+function hadoop_verify_user
+{
+ local command=$1
+ local uservar="HADOOP_${command}_USER"
+
+ if [[ -n ${!uservar} ]]; then
+ if [[ ${!uservar} != ${USER} ]]; then
+ hadoop_error "ERROR: ${command} can only be executed by ${!uservar}."
+ exit 1
+ fi
+ fi
+}
http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh
----------------------------------------------------------------------
diff --git a/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh b/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh
index 588b02a..ae18542 100644
--- a/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh
+++ b/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh
@@ -398,3 +398,9 @@ esac
# via this special env var:
# export HADOOP_ENABLE_BUILD_PATHS="true"
+#
+# To prevent accidents, shell commands be (superficially) locked
+# to only allow certain users to execute certain subcommands.
+#
+# For example, to limit who can execute the namenode command,
+# export HADOOP_namenode_USER=hdfs
http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs
----------------------------------------------------------------------
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs b/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs
index 8140f18..98a89b7 100755
--- a/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs
@@ -247,6 +247,8 @@ case ${COMMAND} in
;;
esac
+hadoop_verify_user "${COMMAND}"
+
if [[ -n "${secure_service}" ]]; then
HADOOP_SECURE_USER="${secure_user}"
hadoop_verify_secure_prereq
http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-mapreduce-project/bin/mapred
----------------------------------------------------------------------
diff --git a/hadoop-mapreduce-project/bin/mapred b/hadoop-mapreduce-project/bin/mapred
index 9f28471..066c438 100755
--- a/hadoop-mapreduce-project/bin/mapred
+++ b/hadoop-mapreduce-project/bin/mapred
@@ -135,6 +135,8 @@ case ${COMMAND} in
;;
esac
+hadoop_verify_user "${COMMAND}"
+
daemon_outfile="${HADOOP_LOG_DIR}/hadoop-${HADOOP_IDENT_STRING}-${COMMAND}-${HOSTNAME}.out"
daemon_pidfile="${HADOOP_PID_DIR}/hadoop-${HADOOP_IDENT_STRING}-${COMMAND}.pid"
http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-yarn-project/hadoop-yarn/bin/yarn
----------------------------------------------------------------------
diff --git a/hadoop-yarn-project/hadoop-yarn/bin/yarn b/hadoop-yarn-project/hadoop-yarn/bin/yarn
index 760d8e6..ab9f7dd 100644
--- a/hadoop-yarn-project/hadoop-yarn/bin/yarn
+++ b/hadoop-yarn-project/hadoop-yarn/bin/yarn
@@ -184,6 +184,8 @@ case "${COMMAND}" in
;;
esac
+hadoop_verify_user "${COMMAND}"
+
# set HADOOP_OPTS to YARN_OPTS so that we can use
# finalize, etc, without doing anything funky
hadoop_debug "Resetting HADOOP_OPTS=YARN_OPTS"