Example usage for org.apache.hadoop.fs.permission AclEntryScope ACCESS

List of usage examples for org.apache.hadoop.fs.permission AclEntryScope ACCESS

  1. HOME
  2. Java
  3. org.apache.hadoop
  4. org.apache.hadoop.fs.permission.*
  5. AclEntryScope
  6. ACCESS

Introduction

In this page you can find the example usage for org.apache.hadoop.fs.permission AclEntryScope ACCESS.

Prototype

AclEntryScope ACCESS

To view the source code for org.apache.hadoop.fs.permission AclEntryScope ACCESS.

Click Source Link

Document

An ACL entry that is inspected during permission checks to enforce permissions.

Usage

From source file:alluxio.underfs.hdfs.acl.SupportedHdfsAclProvider.java

License:Apache License

@Override
public Pair<AccessControlList, DefaultAccessControlList> getAcl(FileSystem hdfs, String path)
        throws IOException {
    AclStatus hdfsAcl;//from  w  w  w . j a  va  2  s.c  o m
    Path filePath = new Path(path);
    boolean isDir = hdfs.isDirectory(filePath);
    try {
        hdfsAcl = hdfs.getAclStatus(filePath);
    } catch (AclException e) {
        // When dfs.namenode.acls.enabled is false, getAclStatus throws AclException.
        return new Pair<>(null, null);
    }
    AccessControlList acl = new AccessControlList();
    DefaultAccessControlList defaultAcl = new DefaultAccessControlList();

    acl.setOwningUser(hdfsAcl.getOwner());
    acl.setOwningGroup(hdfsAcl.getGroup());
    defaultAcl.setOwningUser(hdfsAcl.getOwner());
    defaultAcl.setOwningGroup(hdfsAcl.getGroup());
    for (AclEntry entry : hdfsAcl.getEntries()) {
        alluxio.security.authorization.AclEntry.Builder builder = new alluxio.security.authorization.AclEntry.Builder();
        builder.setType(getAclEntryType(entry));
        builder.setSubject(entry.getName() == null ? "" : entry.getName());
        FsAction permission = entry.getPermission();
        if (permission.implies(FsAction.READ)) {
            builder.addAction(AclAction.READ);
        } else if (permission.implies(FsAction.WRITE)) {
            builder.addAction(AclAction.WRITE);
        } else if (permission.implies(FsAction.EXECUTE)) {
            builder.addAction(AclAction.EXECUTE);
        }
        if (entry.getScope().equals(AclEntryScope.ACCESS)) {
            acl.setEntry(builder.build());
        } else {
            // default ACL, must be a directory
            defaultAcl.setEntry(builder.build());
        }
    }
    if (isDir) {
        return new Pair<>(acl, defaultAcl);
    } else {
        // a null defaultACL indicates this is a file
        return new Pair<>(acl, null);
    }
}

From source file:alluxio.underfs.hdfs.acl.SupportedHdfsAclProvider.java

License:Apache License

private AclEntry getHdfsAclEntry(alluxio.security.authorization.AclEntry entry) throws IOException {
    AclEntry.Builder builder = new AclEntry.Builder();
    // Do not set name for unnamed entries
    if (entry.getType() != alluxio.security.authorization.AclEntryType.OWNING_USER
            && entry.getType() != alluxio.security.authorization.AclEntryType.OWNING_GROUP) {
        builder.setName(entry.getSubject());
    }/*from w  ww .j a va  2 s .  co  m*/

    builder.setScope(entry.isDefault() ? AclEntryScope.DEFAULT : AclEntryScope.ACCESS);
    builder.setType(getHdfsAclEntryType(entry));
    FsAction permission = FsAction.getFsAction(entry.getActions().toCliString());
    builder.setPermission(permission);
    return builder.build();
}

From source file:com.thinkbiganalytics.datalake.authorization.hdfs.HDFSUtil.java

License:Apache License

/**
 * @param fileSystem : HDFS fileSystem object
 * @param path       : Path on which ACL needs to be created
 * @param groups     : List of group to which permission needs to be granted.
 *///from  www.  j a v  a2 s . c om

public void listAllDirAndApplyPolicy(FileSystem fileSystem, Path path, String groups, String hdfsPermission)
        throws FileNotFoundException, IOException {
    FsAction fsActionObject = getFinalPermission(hdfsPermission);
    FileStatus[] fileStatus = fileSystem.listStatus(path);

    for (FileStatus status : fileStatus) {

        // Flush ACL before creating new one.
        flushAcl(fileSystem, status.getPath());

        // Apply ACL recursively on each file/directory.
        if (status.isDirectory()) {
            String[] groupListForPermission = groups.split(",");
            for (int groupCounter = 0; groupCounter < groupListForPermission.length; groupCounter++) {

                // Create HDFS ACL for each for each Path on HDFS
                AclEntry aclEntryOwner = new AclEntry.Builder().setName(groupListForPermission[groupCounter])
                        .setPermission(fsActionObject).setScope(AclEntryScope.ACCESS)
                        .setType(AclEntryType.GROUP).build();

                AclEntry aclEntryOther = new AclEntry.Builder().setPermission(FsAction.NONE)
                        .setScope(AclEntryScope.ACCESS).setType(AclEntryType.OTHER).build();

                // Apply ACL on Path
                applyAcl(fileSystem, status.getPath(), aclEntryOwner);
                applyAcl(fileSystem, status.getPath(), aclEntryOther);

            }

            // Recursive call made to apply acl on each sub directory
            listAllDirAndApplyPolicy(fileSystem, status.getPath(), groups, hdfsPermission);
        } else {
            String[] groupListForPermission = groups.split(",");
            for (int groupCounter = 0; groupCounter < groupListForPermission.length; groupCounter++) {

                // Create HDFS ACL for each for each Path on HDFS
                AclEntry aclEntryOwner = new AclEntry.Builder().setName(groupListForPermission[groupCounter])
                        .setPermission(fsActionObject).setScope(AclEntryScope.ACCESS)
                        .setType(AclEntryType.GROUP).build();

                AclEntry aclEntryOther = new AclEntry.Builder().setPermission(FsAction.NONE)
                        .setScope(AclEntryScope.ACCESS).setType(AclEntryType.OTHER).build();

                // Apply ACL on Path
                applyAcl(fileSystem, status.getPath(), aclEntryOwner);
                applyAcl(fileSystem, status.getPath(), aclEntryOther);

            }
        }
    }
}

From source file:org.apache.nifi.processors.hadoop.inotify.util.EventTestUtils.java

License:Apache License

public static Event.MetadataUpdateEvent createMetadataUpdateEvent() {
    return new Event.MetadataUpdateEvent.Builder().replication(0)
            .perms(new FsPermission(FsAction.ALL, FsAction.NONE, FsAction.NONE)).path("/some/path/metadata")
            .ownerName("owner")
            .acls(Collections.singletonList(new AclEntry.Builder().setName("schema").setPermission(FsAction.ALL)
                    .setScope(AclEntryScope.ACCESS).setType(AclEntryType.GROUP).build()))
            .atime(new Date().getTime()).groupName("groupName")
            .metadataType(Event.MetadataUpdateEvent.MetadataType.ACLS).mtime(1L)
            .xAttrs(Collections.singletonList(new XAttr.Builder().setName("name")
                    .setNameSpace(XAttr.NameSpace.USER).setValue(new byte[0]).build()))
            .xAttrsRemoved(false).build();
}

From source file:org.apache.sentry.hdfs.SentryAuthorizationInfoX.java

License:Apache License

@Override
public List<AclEntry> getAclEntries(String[] pathElements) {
    AclEntry acl = new AclEntry.Builder().setType(AclEntryType.USER).setPermission(FsAction.ALL)
            .setName("user-authz").setScope(AclEntryScope.ACCESS).build();
    return Arrays.asList(acl);
}

From source file:org.apache.sentry.hdfs.SentryAuthorizationProvider.java

License:Apache License

private List<AclEntry> createAclEntries(String user, String group, FsPermission permission) {
    List<AclEntry> list = new ArrayList<AclEntry>();
    AclEntry.Builder builder = new AclEntry.Builder();
    FsPermission fsPerm = new FsPermission(permission);
    builder.setName(user);/*w w w  .j ava 2  s. c  om*/
    builder.setType(AclEntryType.USER);
    builder.setScope(AclEntryScope.ACCESS);
    builder.setPermission(fsPerm.getUserAction());
    list.add(builder.build());
    builder.setName(group);
    builder.setType(AclEntryType.GROUP);
    builder.setScope(AclEntryScope.ACCESS);
    builder.setPermission(fsPerm.getGroupAction());
    list.add(builder.build());
    builder.setName(null);
    return list;
}

From source file:org.apache.sentry.hdfs.SentryINodeAttributesProvider.java

License:Apache License

private static List<AclEntry> createAclEntries(String user, String group, FsPermission permission) {
    List<AclEntry> list = new ArrayList<AclEntry>();
    AclEntry.Builder builder = new AclEntry.Builder();
    FsPermission fsPerm = new FsPermission(permission);
    builder.setName(user);/*  ww w.ja va2 s. c  o m*/
    builder.setType(AclEntryType.USER);
    builder.setScope(AclEntryScope.ACCESS);
    builder.setPermission(fsPerm.getUserAction());
    list.add(builder.build());
    builder.setName(group);
    builder.setType(AclEntryType.GROUP);
    builder.setScope(AclEntryScope.ACCESS);
    builder.setPermission(fsPerm.getGroupAction());
    list.add(builder.build());
    builder.setName(null);
    return list;
}

From source file:org.apache.sentry.hdfs.SentryPermissions.java

License:Apache License

/**
 * Constructs HDFS ACL's based on the permissions granted to the object directly
 * and inherited from the parents./*from w  w  w .ja v a  2s  .co  m*/
 * @param authzObj Object name for which ACL are needed
 * @return HDFS ACL's
 */
@Override
public List<AclEntry> getAcls(String authzObj) {
    Map<HdfsAclEntity, FsAction> permissions = getPerms(authzObj);

    List<AclEntry> retList = new LinkedList<AclEntry>();
    for (Map.Entry<HdfsAclEntity, FsAction> permission : permissions.entrySet()) {
        AclEntry.Builder builder = new AclEntry.Builder();
        if (permission.getKey().getType() == AclEntryType.GROUP) {
            builder.setName(permission.getKey().getValue());
            builder.setType(AclEntryType.GROUP);
        } else if (permission.getKey().getType() == AclEntryType.USER) {
            builder.setName(permission.getKey().getValue());
            builder.setType(AclEntryType.USER);
        } else {
            LOG.warn("Permissions for Invalid AclEntryType: %s", permission.getKey().getType());
            continue;
        }
        builder.setScope(AclEntryScope.ACCESS);
        FsAction action = permission.getValue();
        if (action == FsAction.READ || action == FsAction.WRITE || action == FsAction.READ_WRITE) {
            action = action.or(FsAction.EXECUTE);
        }
        builder.setPermission(action);
        retList.add(builder.build());
    }
    return retList;
}

From source file:org.apache.sentry.hdfs.TestSentryAuthorizationProvider.java

License:Apache License

@Test
public void testProvider() throws Exception {
    admin.doAs(new PrivilegedExceptionAction<Void>() {
        @Override//from w  w  w  .j  a v a2 s . c om
        public Void run() throws Exception {
            String sysUser = UserGroupInformation.getCurrentUser().getShortUserName();
            FileSystem fs = FileSystem.get(miniDFS.getConfiguration(0));

            List<AclEntry> baseAclList = new ArrayList<AclEntry>();
            AclEntry.Builder builder = new AclEntry.Builder();
            baseAclList.add(builder.setType(AclEntryType.USER).setScope(AclEntryScope.ACCESS).build());
            baseAclList.add(builder.setType(AclEntryType.GROUP).setScope(AclEntryScope.ACCESS).build());
            baseAclList.add(builder.setType(AclEntryType.OTHER).setScope(AclEntryScope.ACCESS).build());
            Path path1 = new Path("/user/authz/obj/xxx");
            fs.mkdirs(path1);
            fs.setAcl(path1, baseAclList);

            fs.mkdirs(new Path("/user/authz/xxx"));
            fs.mkdirs(new Path("/user/xxx"));

            // root
            Path path = new Path("/");
            Assert.assertEquals(sysUser, fs.getFileStatus(path).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), fs.getFileStatus(path).getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            // dir before prefixes
            path = new Path("/user");
            Assert.assertEquals(sysUser, fs.getFileStatus(path).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), fs.getFileStatus(path).getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            // prefix dir
            path = new Path("/user/authz");
            Assert.assertEquals(sysUser, fs.getFileStatus(path).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), fs.getFileStatus(path).getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            // dir inside of prefix, no obj
            path = new Path("/user/authz/xxx");
            FileStatus status = fs.getFileStatus(path);
            Assert.assertEquals(sysUser, status.getOwner());
            Assert.assertEquals("supergroup", status.getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), status.getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            // dir inside of prefix, obj
            path = new Path("/user/authz/obj");
            Assert.assertEquals("hive", fs.getFileStatus(path).getOwner());
            Assert.assertEquals("hive", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0770), fs.getFileStatus(path).getPermission());
            Assert.assertFalse(fs.getAclStatus(path).getEntries().isEmpty());

            List<AclEntry> acls = new ArrayList<AclEntry>();
            acls.add(new AclEntry.Builder().setName(sysUser).setType(AclEntryType.USER)
                    .setScope(AclEntryScope.ACCESS).setPermission(FsAction.ALL).build());
            acls.add(new AclEntry.Builder().setName("supergroup").setType(AclEntryType.GROUP)
                    .setScope(AclEntryScope.ACCESS).setPermission(FsAction.READ_EXECUTE).build());
            acls.add(new AclEntry.Builder().setName("user-authz").setType(AclEntryType.USER)
                    .setScope(AclEntryScope.ACCESS).setPermission(FsAction.ALL).build());
            Assert.assertEquals(new LinkedHashSet<AclEntry>(acls),
                    new LinkedHashSet<AclEntry>(fs.getAclStatus(path).getEntries()));

            // dir inside of prefix, inside of obj
            path = new Path("/user/authz/obj/xxx");
            Assert.assertEquals("hive", fs.getFileStatus(path).getOwner());
            Assert.assertEquals("hive", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0770), fs.getFileStatus(path).getPermission());
            Assert.assertFalse(fs.getAclStatus(path).getEntries().isEmpty());

            Path path2 = new Path("/user/authz/obj/path2");
            fs.mkdirs(path2);
            fs.setAcl(path2, baseAclList);

            // dir outside of prefix
            path = new Path("/user/xxx");
            Assert.assertEquals(sysUser, fs.getFileStatus(path).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), fs.getFileStatus(path).getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());
            return null;
        }
    });
}

From source file:org.apache.sentry.hdfs.TestSentryINodeAttributesProvider.java

License:Apache License

@Test
public void testProvider() throws Exception {
    admin.doAs(new PrivilegedExceptionAction<Void>() {
        @Override//  w w  w  . ja v a  2  s.  com
        public Void run() throws Exception {
            String sysUser = UserGroupInformation.getCurrentUser().getShortUserName();
            FileSystem fs = FileSystem.get(miniDFS.getConfiguration(0));

            List<AclEntry> baseAclList = new ArrayList<AclEntry>();
            AclEntry.Builder builder = new AclEntry.Builder();
            baseAclList.add(builder.setType(AclEntryType.USER).setScope(AclEntryScope.ACCESS).build());
            baseAclList.add(builder.setType(AclEntryType.GROUP).setScope(AclEntryScope.ACCESS).build());
            baseAclList.add(builder.setType(AclEntryType.OTHER).setScope(AclEntryScope.ACCESS).build());
            Path path1 = new Path("/user/authz/obj/xxx");
            fs.mkdirs(path1);
            fs.setAcl(path1, baseAclList);

            fs.mkdirs(new Path("/user/authz/xxx"));
            fs.mkdirs(new Path("/user/xxx"));

            // root
            Path path = new Path("/");
            Assert.assertEquals(sysUser, fs.getFileStatus(path).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), fs.getFileStatus(path).getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            // dir before prefixes
            path = new Path("/user");
            Assert.assertEquals(sysUser, fs.getFileStatus(path).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), fs.getFileStatus(path).getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            // prefix dir
            path = new Path("/user/authz");
            Assert.assertEquals(sysUser, fs.getFileStatus(path).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), fs.getFileStatus(path).getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            // dir inside of prefix, no obj
            path = new Path("/user/authz/xxx");
            FileStatus status = fs.getFileStatus(path);
            Assert.assertEquals(sysUser, status.getOwner());
            Assert.assertEquals("supergroup", status.getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), status.getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            // dir inside of prefix, obj
            path = new Path("/user/authz/obj");
            Assert.assertEquals("hive", fs.getFileStatus(path).getOwner());
            Assert.assertEquals("hive", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0771), fs.getFileStatus(path).getPermission());
            Assert.assertFalse(fs.getAclStatus(path).getEntries().isEmpty());

            List<AclEntry> acls = new ArrayList<AclEntry>();
            acls.add(new AclEntry.Builder().setName(sysUser).setType(AclEntryType.USER)
                    .setScope(AclEntryScope.ACCESS).setPermission(FsAction.ALL).build());
            acls.add(new AclEntry.Builder().setName("supergroup").setType(AclEntryType.GROUP)
                    .setScope(AclEntryScope.ACCESS).setPermission(FsAction.READ_EXECUTE).build());
            acls.add(new AclEntry.Builder().setName("user-authz").setType(AclEntryType.USER)
                    .setScope(AclEntryScope.ACCESS).setPermission(FsAction.ALL).build());
            Assert.assertEquals(new LinkedHashSet<AclEntry>(acls),
                    new LinkedHashSet<AclEntry>(fs.getAclStatus(path).getEntries()));

            // dir inside of prefix, inside of obj
            path = new Path("/user/authz/obj/xxx");
            Assert.assertEquals("hive", fs.getFileStatus(path).getOwner());
            Assert.assertEquals("hive", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0771), fs.getFileStatus(path).getPermission());
            Assert.assertFalse(fs.getAclStatus(path).getEntries().isEmpty());

            Path path2 = new Path("/user/authz/obj/path2");
            fs.mkdirs(path2);
            fs.setAcl(path2, baseAclList);

            // dir outside of prefix
            path = new Path("/user/xxx");
            Assert.assertEquals(sysUser, fs.getFileStatus(path).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(path).getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), fs.getFileStatus(path).getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            //stale and dir inside of prefix, obj
            System.setProperty("test.stale", "true");
            path = new Path("/user/authz/xxx");
            status = fs.getFileStatus(path);
            Assert.assertEquals(sysUser, status.getOwner());
            Assert.assertEquals("supergroup", status.getGroup());
            Assert.assertEquals(new FsPermission((short) 0755), status.getPermission());
            Assert.assertTrue(fs.getAclStatus(path).getEntries().isEmpty());

            // setPermission sets the permission for dir outside of prefix.
            // setUser/setGroup sets the user/group for dir outside of prefix.
            Path pathOutside = new Path("/user/xxx");

            fs.setPermission(pathOutside, new FsPermission((short) 0000));
            Assert.assertEquals(new FsPermission((short) 0000), fs.getFileStatus(pathOutside).getPermission());
            fs.setOwner(pathOutside, sysUser, "supergroup");
            Assert.assertEquals(sysUser, fs.getFileStatus(pathOutside).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(pathOutside).getGroup());

            // removeAcl removes the ACL entries for dir outside of prefix.
            List<AclEntry> aclsOutside = new ArrayList<AclEntry>(baseAclList);
            List<AclEntry> acl = new ArrayList<AclEntry>();
            acl.add(new AclEntry.Builder().setName("supergroup").setType(AclEntryType.GROUP)
                    .setScope(AclEntryScope.ACCESS).setPermission(FsAction.READ_EXECUTE).build());
            aclsOutside.addAll(acl);
            fs.setAcl(pathOutside, aclsOutside);
            fs.removeAclEntries(pathOutside, acl);
            Assert.assertFalse(fs.getAclStatus(pathOutside).getEntries().containsAll(acl));

            // setPermission sets the permission for dir inside of prefix but not a hive obj.
            // setUser/setGroup sets the user/group for dir inside of prefix but not a hive obj.
            Path pathInside = new Path("/user/authz/xxx");

            fs.setPermission(pathInside, new FsPermission((short) 0000));
            Assert.assertEquals(new FsPermission((short) 0000), fs.getFileStatus(pathInside).getPermission());
            fs.setOwner(pathInside, sysUser, "supergroup");
            Assert.assertEquals(sysUser, fs.getFileStatus(pathInside).getOwner());
            Assert.assertEquals("supergroup", fs.getFileStatus(pathInside).getGroup());

            // removeAcl is a no op for dir inside of prefix.
            Assert.assertTrue(fs.getAclStatus(pathInside).getEntries().isEmpty());
            fs.removeAclEntries(pathInside, acl);
            Assert.assertTrue(fs.getAclStatus(pathInside).getEntries().isEmpty());

            // setPermission/setUser/setGroup is a no op for dir inside of prefix, and is a hive obj.
            Path pathInsideAndHive = new Path("/user/authz/obj");

            fs.setPermission(pathInsideAndHive, new FsPermission((short) 0000));
            Assert.assertEquals(new FsPermission((short) 0771),
                    fs.getFileStatus(pathInsideAndHive).getPermission());
            fs.setOwner(pathInsideAndHive, sysUser, "supergroup");
            Assert.assertEquals("hive", fs.getFileStatus(pathInsideAndHive).getOwner());
            Assert.assertEquals("hive", fs.getFileStatus(pathInsideAndHive).getGroup());

            return null;
        }
    });
}