Repository: hadoop Updated Branches: refs/heads/branch-2.8.0 c5c13d869 -> 3fa777437
Treat encrypted files as private. Contributed by Daniel Templeton. (cherry picked from commit f01a69f84f4cc7d925d078a7ce32e5800da4e429) (cherry picked from commit 120f680318d766f44787fd0eec88270d61172523) (cherry picked from commit dd5d0103dfe38dacd5d9379ceb2931ab910f11ab) Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/3fa77743 Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/3fa77743 Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/3fa77743 Branch: refs/heads/branch-2.8.0 Commit: 3fa7774379187fb584fee28262a3057ebd541aa6 Parents: c5c13d8 Author: Akira Ajisaka <[email protected]> Authored: Tue Mar 7 13:22:11 2017 +0900 Committer: Akira Ajisaka <[email protected]> Committed: Tue Mar 7 13:42:46 2017 +0900 ---------------------------------------------------------------------- .../filecache/ClientDistributedCacheManager.java | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/3fa77743/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/filecache/ClientDistributedCacheManager.java ---------------------------------------------------------------------- diff --git a/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/filecache/ClientDistributedCacheManager.java b/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/filecache/ClientDistributedCacheManager.java index c15e647..9672f31 100644 --- a/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/filecache/ClientDistributedCacheManager.java +++ b/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/filecache/ClientDistributedCacheManager.java @@ -275,10 +275,21 @@ public class ClientDistributedCacheManager { FsAction action, Map<URI, FileStatus> statCache) throws IOException { FileStatus status = getFileStatus(fs, path.toUri(), statCache); FsPermission perms = status.getPermission(); - FsAction otherAction = perms.getOtherAction(); - if (otherAction.implies(action)) { - return true; + + // Encrypted files are always treated as private. This stance has two + // important side effects. The first is that the encrypted files will be + // downloaded as the job owner instead of the YARN user, which is required + // for the KMS ACLs to work as expected. Second, it prevent a file with + // world readable permissions that is stored in an encryption zone from + // being localized as a publicly shared file with world readable + // permissions. + if (!perms.getEncryptedBit()) { + FsAction otherAction = perms.getOtherAction(); + if (otherAction.implies(action)) { + return true; + } } + return false; } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
