You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Hongbing Wang (Jira)" <ji...@apache.org> on 2023/05/19 05:21:00 UTC
[jira] [Updated] (HDDS-8653) Let directory inherit bucket default ACLs
[ https://issues.apache.org/jira/browse/HDDS-8653?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Hongbing Wang updated HDDS-8653:
--------------------------------
Description:
Dir and file inherited ACLs are not consistent, which seems to be confusing and wrong ACLs. Case as follows:
{code:java}
// setup
$ ozone sh vol create vol1
$ ozone sh vol addacl -a=user:user1:rlw vol1
$ ozone sh bucket create vol1/buk1
$ ozone sh bucket addacl -a=user:user1:rlw[DEFAULT] vol1/buk1
$ ozone sh bucket addacl -a=user:group1:rlw[DEFAULT] vol1/buk1
$ export HADOOP_USER_NAME=user1
$ hadoop fs -mkdir -p ofs://ip:9862/vol1/buk1/d11/d22
$ hadoop fs -put /etc/hosts ofs://ip:9862/vol1/buk1/d11/d22/f1
// GOOD CASE: user1 is owner, so user1 has ALL acl, also inherits bucket alcs
$ ozone sh key getacl vol1/buk1/d11/d22/f1
[ {
"type" : "USER",
"name" : "user1",
"aclScope" : "ACCESS",
"aclList" : [ "READ", "WRITE", "LIST", "ALL" ]
}, {
"type" : "USER",
"name" : "group1",
"aclScope" : "ACCESS",
"aclList" : [ "READ", "WRITE", "LIST" ]
} ]
// BAD CASE 1: dir22 only has owner alcs, NOT inherit
$ ozone sh key getacl vol1/buk1/d11/d22/
[ {
"type" : "USER",
"name" : "user1",
"aclScope" : "ACCESS",
"aclList" : [ "ALL" ]
} ]
// BAD CASE 2: dir11 does NOT have owner alcs, but inherits bucket both DEFAULT and ACCESS acls
$ ozone sh key getacl vol1/buk1/d11/
[ {
"type" : "USER",
"name" : "hadoop",
"aclScope" : "ACCESS",
"aclList" : [ "ALL" ]
}, {
"type" : "GROUP",
"name" : "hadoop",
"aclScope" : "ACCESS",
"aclList" : [ "ALL" ]
}, {
"type" : "USER",
"name" : "user1",
"aclScope" : "DEFAULT",
"aclList" : [ "READ", "WRITE", "LIST" ]
}, {
"type" : "USER",
"name" : "group1",
"aclScope" : "DEFAULT",
"aclList" : [ "READ", "WRITE", "LIST" ]
} ]{code}
This Jira fixes bad cases above.
> Let directory inherit bucket default ACLs
> -----------------------------------------
>
> Key: HDDS-8653
> URL: https://issues.apache.org/jira/browse/HDDS-8653
> Project: Apache Ozone
> Issue Type: Bug
> Components: OM
> Affects Versions: 1.3.0
> Reporter: Hongbing Wang
> Priority: Major
>
> Dir and file inherited ACLs are not consistent, which seems to be confusing and wrong ACLs. Case as follows:
> {code:java}
> // setup
> $ ozone sh vol create vol1
> $ ozone sh vol addacl -a=user:user1:rlw vol1
> $ ozone sh bucket create vol1/buk1
> $ ozone sh bucket addacl -a=user:user1:rlw[DEFAULT] vol1/buk1
> $ ozone sh bucket addacl -a=user:group1:rlw[DEFAULT] vol1/buk1
> $ export HADOOP_USER_NAME=user1
> $ hadoop fs -mkdir -p ofs://ip:9862/vol1/buk1/d11/d22
> $ hadoop fs -put /etc/hosts ofs://ip:9862/vol1/buk1/d11/d22/f1
> // GOOD CASE: user1 is owner, so user1 has ALL acl, also inherits bucket alcs
> $ ozone sh key getacl vol1/buk1/d11/d22/f1
> [ {
> "type" : "USER",
> "name" : "user1",
> "aclScope" : "ACCESS",
> "aclList" : [ "READ", "WRITE", "LIST", "ALL" ]
> }, {
> "type" : "USER",
> "name" : "group1",
> "aclScope" : "ACCESS",
> "aclList" : [ "READ", "WRITE", "LIST" ]
> } ]
> // BAD CASE 1: dir22 only has owner alcs, NOT inherit
> $ ozone sh key getacl vol1/buk1/d11/d22/
> [ {
> "type" : "USER",
> "name" : "user1",
> "aclScope" : "ACCESS",
> "aclList" : [ "ALL" ]
> } ]
> // BAD CASE 2: dir11 does NOT have owner alcs, but inherits bucket both DEFAULT and ACCESS acls
> $ ozone sh key getacl vol1/buk1/d11/
> [ {
> "type" : "USER",
> "name" : "hadoop",
> "aclScope" : "ACCESS",
> "aclList" : [ "ALL" ]
> }, {
> "type" : "GROUP",
> "name" : "hadoop",
> "aclScope" : "ACCESS",
> "aclList" : [ "ALL" ]
> }, {
> "type" : "USER",
> "name" : "user1",
> "aclScope" : "DEFAULT",
> "aclList" : [ "READ", "WRITE", "LIST" ]
> }, {
> "type" : "USER",
> "name" : "group1",
> "aclScope" : "DEFAULT",
> "aclList" : [ "READ", "WRITE", "LIST" ]
> } ]{code}
> This Jira fixes bad cases above.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org