Best is to use one user for map/reduce and another for hdfs. Neither of them should be root or "real" users. With the setuid patch (HADOOP-4490), it is possible to run the jobs as the submitted user. Note that if you do that, you no doubt want to block certain system uids (bin, mysql, etc.)
-- Owen
