[
https://issues.apache.org/jira/browse/HADOOP-9984?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14516025#comment-14516025
]
Sanjay Radia commented on HADOOP-9984:
--------------------------------------
The Hive issue:
Colins posted the following in an HDFS-dev email thread that I am reproducing:
{quote}
Basically any
higher-level software that is relying on path-based access will have
problems with symlinks. For example, Hive assumes that if you limit a
user's access to just things under /home/username, then you have
effectively sandboxed that person. But if you can create a symlink
from /home/username/foo to /foo, then you've effectively broken out of
Hive's sandbox. Since Hive often runs with elevated permissions, and
is willing access files under /home/username with those permissions,
this would be disastrous. Hive is just one example, of course...
basically we'd have to audit all software using HDFS for this kind of
problem before enabling symlinks.
{quote}
I am not aware of the above sandboxing "feature" in hive. I checked with a
couple of folks who are active in Hive and they told me that the above style of
sandboxing was not supported in Hive.
> FileSystem#globStatus and FileSystem#listStatus should resolve symlinks by
> default
> ----------------------------------------------------------------------------------
>
> Key: HADOOP-9984
> URL: https://issues.apache.org/jira/browse/HADOOP-9984
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: fs
> Affects Versions: 2.1.0-beta
> Reporter: Colin Patrick McCabe
> Assignee: Colin Patrick McCabe
> Priority: Critical
> Attachments: HADOOP-9984.001.patch, HADOOP-9984.003.patch,
> HADOOP-9984.005.patch, HADOOP-9984.007.patch, HADOOP-9984.009.patch,
> HADOOP-9984.010.patch, HADOOP-9984.011.patch, HADOOP-9984.012.patch,
> HADOOP-9984.013.patch, HADOOP-9984.014.patch, HADOOP-9984.015.patch
>
>
> During the process of adding symlink support to FileSystem, we realized that
> many existing HDFS clients would be broken by listStatus and globStatus
> returning symlinks. One example is applications that assume that
> !FileStatus#isFile implies that the inode is a directory. As we discussed in
> HADOOP-9972 and HADOOP-9912, we should default these APIs to returning
> resolved paths.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
