HADOOP-6590. Add a username check for hadoop sub-commands (John Smith via aw)
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/c5361426 Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/c5361426 Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/c5361426 Branch: refs/heads/YARN-2139 Commit: c536142699099c0e6da3413f1bbb01784577e28e Parents: a7c6c71 Author: Allen Wittenauer <a...@apache.org> Authored: Wed Dec 10 13:41:28 2014 -0800 Committer: Allen Wittenauer <a...@apache.org> Committed: Wed Dec 10 13:41:28 2014 -0800 ---------------------------------------------------------------------- hadoop-common-project/hadoop-common/CHANGES.txt | 2 ++ hadoop-common-project/hadoop-common/src/main/bin/hadoop | 2 ++ .../hadoop-common/src/main/bin/hadoop-functions.sh | 12 ++++++++++++ .../hadoop-common/src/main/conf/hadoop-env.sh | 6 ++++++ hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs | 2 ++ hadoop-mapreduce-project/bin/mapred | 2 ++ hadoop-yarn-project/hadoop-yarn/bin/yarn | 2 ++ 7 files changed, 28 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/CHANGES.txt ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt index 7310dd4..6e1cc11 100644 --- a/hadoop-common-project/hadoop-common/CHANGES.txt +++ b/hadoop-common-project/hadoop-common/CHANGES.txt @@ -24,6 +24,8 @@ Trunk (Unreleased) (Dexter Bradshaw, Mostafa Elhemali, Xi Fang, Johannes Klein, David Lao, Mike Liddell, Chuan Liu, Lengning Liu, Ivan Mitic, Michael Rys, Alexander Stojanovich, Brian Swan, and Min Wei via cnauroth) + + HADOOP-6590. Add a username check for hadoop sub-commands (John Smith via aw) IMPROVEMENTS http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/src/main/bin/hadoop ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/bin/hadoop b/hadoop-common-project/hadoop-common/src/main/bin/hadoop index be38382..b216b8f 100755 --- a/hadoop-common-project/hadoop-common/src/main/bin/hadoop +++ b/hadoop-common-project/hadoop-common/src/main/bin/hadoop @@ -179,6 +179,8 @@ case ${COMMAND} in ;; esac +hadoop_verify_user "${COMMAND}" + # Always respect HADOOP_OPTS and HADOOP_CLIENT_OPTS hadoop_debug "Appending HADOOP_CLIENT_OPTS onto HADOOP_OPTS" HADOOP_OPTS="${HADOOP_OPTS} ${HADOOP_CLIENT_OPTS}" http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh b/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh index 3e353d9..dfd7315 100644 --- a/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh +++ b/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh @@ -1154,3 +1154,15 @@ function hadoop_secure_daemon_handler esac } +function hadoop_verify_user +{ + local command=$1 + local uservar="HADOOP_${command}_USER" + + if [[ -n ${!uservar} ]]; then + if [[ ${!uservar} != ${USER} ]]; then + hadoop_error "ERROR: ${command} can only be executed by ${!uservar}." + exit 1 + fi + fi +} http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh b/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh index 588b02a..ae18542 100644 --- a/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh +++ b/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh @@ -398,3 +398,9 @@ esac # via this special env var: # export HADOOP_ENABLE_BUILD_PATHS="true" +# +# To prevent accidents, shell commands be (superficially) locked +# to only allow certain users to execute certain subcommands. +# +# For example, to limit who can execute the namenode command, +# export HADOOP_namenode_USER=hdfs http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs ---------------------------------------------------------------------- diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs b/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs index 8140f18..98a89b7 100755 --- a/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs +++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs @@ -247,6 +247,8 @@ case ${COMMAND} in ;; esac +hadoop_verify_user "${COMMAND}" + if [[ -n "${secure_service}" ]]; then HADOOP_SECURE_USER="${secure_user}" hadoop_verify_secure_prereq http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-mapreduce-project/bin/mapred ---------------------------------------------------------------------- diff --git a/hadoop-mapreduce-project/bin/mapred b/hadoop-mapreduce-project/bin/mapred index 9f28471..066c438 100755 --- a/hadoop-mapreduce-project/bin/mapred +++ b/hadoop-mapreduce-project/bin/mapred @@ -135,6 +135,8 @@ case ${COMMAND} in ;; esac +hadoop_verify_user "${COMMAND}" + daemon_outfile="${HADOOP_LOG_DIR}/hadoop-${HADOOP_IDENT_STRING}-${COMMAND}-${HOSTNAME}.out" daemon_pidfile="${HADOOP_PID_DIR}/hadoop-${HADOOP_IDENT_STRING}-${COMMAND}.pid" http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-yarn-project/hadoop-yarn/bin/yarn ---------------------------------------------------------------------- diff --git a/hadoop-yarn-project/hadoop-yarn/bin/yarn b/hadoop-yarn-project/hadoop-yarn/bin/yarn index 760d8e6..ab9f7dd 100644 --- a/hadoop-yarn-project/hadoop-yarn/bin/yarn +++ b/hadoop-yarn-project/hadoop-yarn/bin/yarn @@ -184,6 +184,8 @@ case "${COMMAND}" in ;; esac +hadoop_verify_user "${COMMAND}" + # set HADOOP_OPTS to YARN_OPTS so that we can use # finalize, etc, without doing anything funky hadoop_debug "Resetting HADOOP_OPTS=YARN_OPTS"