Question about superuser and permissions

[Frank Astier <fa...@yahoo-inc.com>]

Hi -

I’m writing unit tests that programatically start a name node and populate HDFS directories, but I want to simulate the situation where I don’t have read access to some HDFS directory (which happens on the real grid I eventually deploy to).

I’ve tried to chown and chmod, but it seems to have no effect, and my unit tests happily read the directory I don’t want them to be able to read. Looking at the permissions documentation, it seems that because my unit test program started the name node, it is automatically superuser. I tried setting dfs.permissions.supergroup to some other user, but that didn’t work either.

Is there any way I could have that unit test think it’s not the user who started the name node?

Thanks,

Frank

Re: Question about superuser and permissions

[Uma Maheswara Rao G 72686 <ma...@huawei.com>]

Also i would suggest you to look at TestDFSPermission & TestDFSShell test cases for dfs permissions. Which will help you for writing your unit tests.

Thanks
Uma 
----- Original Message -----
From: Joey Echeverria <jo...@cloudera.com>
Date: Friday, November 4, 2011 4:02 am
Subject: Re: Question about superuser and permissions
To: common-user@hadoop.apache.org

> When you get the handle to the FileSystem object you can connect as a
> different user:
> 
> http://hadoop.apache.org/common/docs/r0.20.203.0/api/org/apache/hadoop/fs/FileSystem.html#get(java.net.URI,
> org.apache.hadoop.conf.Configuration, java.lang.String)
> 
> This should get any permissions you set enforced against the
> operations using that FileSystem object.
> 
> -Joey
> 
> On Thu, Nov 3, 2011 at 4:01 PM, Frank Astier <fastier@yahoo-
> inc.com> wrote:
> > Hi -
> >
> > I’m writing unit tests that programatically start a name node and 
> populate HDFS directories, but I want to simulate the situation 
> where I don’t have read access to some HDFS directory (which 
> happens on the real grid I eventually deploy to).
> >
> > I’ve tried to chown and chmod, but it seems to have no effect, 
> and my unit tests happily read the directory I don’t want them to 
> be able to read. Looking at the permissions documentation, it seems 
> that because my unit test program started the name node, it is 
> automatically superuser. I tried setting dfs.permissions.supergroup 
> to some other user, but that didn’t work either.
> >
> > Is there any way I could have that unit test think it’s not the 
> user who started the name node?
> >
> > Thanks,
> >
> > Frank
> >
> 
> 
> 
> -- 
> Joseph Echeverria
> Cloudera, Inc.
> 443.305.9434
> 

Re: Question about superuser and permissions

[Joey Echeverria <jo...@cloudera.com>]

When you get the handle to the FileSystem object you can connect as a
different user:

http://hadoop.apache.org/common/docs/r0.20.203.0/api/org/apache/hadoop/fs/FileSystem.html#get(java.net.URI,
org.apache.hadoop.conf.Configuration, java.lang.String)

This should get any permissions you set enforced against the
operations using that FileSystem object.

-Joey

On Thu, Nov 3, 2011 at 4:01 PM, Frank Astier <fa...@yahoo-inc.com> wrote:
> Hi -
>
> I’m writing unit tests that programatically start a name node and populate HDFS directories, but I want to simulate the situation where I don’t have read access to some HDFS directory (which happens on the real grid I eventually deploy to).
>
> I’ve tried to chown and chmod, but it seems to have no effect, and my unit tests happily read the directory I don’t want them to be able to read. Looking at the permissions documentation, it seems that because my unit test program started the name node, it is automatically superuser. I tried setting dfs.permissions.supergroup to some other user, but that didn’t work either.
>
> Is there any way I could have that unit test think it’s not the user who started the name node?
>
> Thanks,
>
> Frank
>



-- 
Joseph Echeverria
Cloudera, Inc.
443.305.9434