Author: ddas
Date: Fri Aug 6 22:19:52 2010
New Revision: 983134
URL: http://svn.apache.org/viewvc?rev=983134&view=rev
Log:
HDFS-1130. Adds dfs.cluster.administrator ACL configuration that can be used to
control who can view the default hdfs servlets. Contributed by Devaraj Das.
Modified:
hadoop/hdfs/trunk/CHANGES.txt
hadoop/hdfs/trunk/src/docs/src/documentation/content/xdocs/hdfs_permissions_guide.xml
hadoop/hdfs/trunk/src/java/hdfs-default.xml
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/DFSConfigKeys.java
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/NameNode.java
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/SecondaryNameNode.java
Modified: hadoop/hdfs/trunk/CHANGES.txt
URL:
http://svn.apache.org/viewvc/hadoop/hdfs/trunk/CHANGES.txt?rev=983134&r1=983133&r2=983134&view=diff
==============================================================================
--- hadoop/hdfs/trunk/CHANGES.txt (original)
+++ hadoop/hdfs/trunk/CHANGES.txt Fri Aug 6 22:19:52 2010
@@ -97,6 +97,9 @@ Trunk (unreleased changes)
HDFS-1178. The NameNode servlets should not use RPC to connect to the
NameNode. (Kan Zhang via jghoman)
+ HDFS-1130. Adds dfs.cluster.administrator ACL configuration that can
+ be used to control who can view the default hdfs servlets. (ddas)
+
OPTIMIZATIONS
HDFS-1140. Speedup INode.getPathComponents. (Dmytro Molkov via shv)
Modified:
hadoop/hdfs/trunk/src/docs/src/documentation/content/xdocs/hdfs_permissions_guide.xml
URL:
http://svn.apache.org/viewvc/hadoop/hdfs/trunk/src/docs/src/documentation/content/xdocs/hdfs_permissions_guide.xml?rev=983134&r1=983133&r2=983134&view=diff
==============================================================================
---
hadoop/hdfs/trunk/src/docs/src/documentation/content/xdocs/hdfs_permissions_guide.xml
(original)
+++
hadoop/hdfs/trunk/src/docs/src/documentation/content/xdocs/hdfs_permissions_guide.xml
Fri Aug 6 22:19:52 2010
@@ -242,6 +242,12 @@ are the user and group identity of the s
<br />The <code>umask</code> used when creating files and directories. For
configuration files, the decimal
value <em>18<sub>10</sub></em> may be used.
</li>
+
+ <li><code>dfs.cluster.administrators = ACL-for-admins></code>
+ <br />The administrators for the cluster specified as an ACL. This
+ controls who can access the default servlets, etc. in the
+ HDFS.
+ </li>
</ul>
</section>
Modified: hadoop/hdfs/trunk/src/java/hdfs-default.xml
URL:
http://svn.apache.org/viewvc/hadoop/hdfs/trunk/src/java/hdfs-default.xml?rev=983134&r1=983133&r2=983134&view=diff
==============================================================================
--- hadoop/hdfs/trunk/src/java/hdfs-default.xml (original)
+++ hadoop/hdfs/trunk/src/java/hdfs-default.xml Fri Aug 6 22:19:52 2010
@@ -210,6 +210,15 @@ creations/deletions), or "all".</descrip
<value>supergroup</value>
<description>The name of the group of super-users.</description>
</property>
+<!--
+<property>
+ <name>dfs.cluster.administrators</name>
+ <value>ACL for the admins</value>
+ <description>This configuration is used to control who can access the
+ default servlets in the namenode, etc.
+ </description>
+</property>
+-->
<property>
<name>dfs.block.access.token.enable</name>
Modified: hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/DFSConfigKeys.java
URL:
http://svn.apache.org/viewvc/hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/DFSConfigKeys.java?rev=983134&r1=983133&r2=983134&view=diff
==============================================================================
--- hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/DFSConfigKeys.java
(original)
+++ hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/DFSConfigKeys.java Fri
Aug 6 22:19:52 2010
@@ -87,6 +87,7 @@ public class DFSConfigKeys extends Commo
public static final boolean DFS_PERMISSIONS_ENABLED_DEFAULT = true;
public static final String DFS_PERMISSIONS_SUPERUSERGROUP_KEY =
"dfs.permissions.superusergroup";
public static final String DFS_PERMISSIONS_SUPERUSERGROUP_DEFAULT =
"supergroup";
+ public static final String DFS_ADMIN = "dfs.cluster.administrators";
public static final String DFS_SERVER_HTTPS_KEYSTORE_RESOURCE_KEY =
"dfs.https.server.keystore.resource";
public static final String DFS_SERVER_HTTPS_KEYSTORE_RESOURCE_DEFAULT =
"ssl-server.xml";
public static final String DFS_NAMENODE_NAME_DIR_RESTORE_KEY =
"dfs.namenode.name.dir.restore";
Modified:
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java
URL:
http://svn.apache.org/viewvc/hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java?rev=983134&r1=983133&r2=983134&view=diff
==============================================================================
---
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java
(original)
+++
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java
Fri Aug 6 22:19:52 2010
@@ -107,6 +107,7 @@ import org.apache.hadoop.net.DNS;
import org.apache.hadoop.net.NetUtils;
import org.apache.hadoop.security.SecurityUtil;
import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.hadoop.security.authorize.AccessControlList;
import org.apache.hadoop.security.authorize.ServiceAuthorizationManager;
import org.apache.hadoop.security.token.Token;
import org.apache.hadoop.security.token.TokenIdentifier;
@@ -407,9 +408,10 @@ public class DataNode extends Configured
int tmpInfoPort = infoSocAddr.getPort();
this.infoServer = (secureResources == null)
? new HttpServer("datanode", infoHost, tmpInfoPort, tmpInfoPort == 0,
- conf)
+ conf, new AccessControlList(conf.get(DFSConfigKeys.DFS_ADMIN, " ")))
: new HttpServer("datanode", infoHost, tmpInfoPort, tmpInfoPort == 0,
- conf, secureResources.getListener());
+ conf, new AccessControlList(conf.get(DFSConfigKeys.DFS_ADMIN, " ")),
+ secureResources.getListener());
LOG.debug("Datanode listening on " + infoHost + ":" + tmpInfoPort);
if (conf.getBoolean("dfs.https.enable", false)) {
boolean needClientAuth =
conf.getBoolean(DFSConfigKeys.DFS_CLIENT_HTTPS_NEED_AUTH_KEY,
Modified:
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/NameNode.java
URL:
http://svn.apache.org/viewvc/hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/NameNode.java?rev=983134&r1=983133&r2=983134&view=diff
==============================================================================
---
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/NameNode.java
(original)
+++
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/NameNode.java
Fri Aug 6 22:19:52 2010
@@ -92,6 +92,7 @@ import org.apache.hadoop.security.Groups
import org.apache.hadoop.security.RefreshUserMappingsProtocol;
import org.apache.hadoop.security.SecurityUtil;
import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.hadoop.security.authorize.AccessControlList;
import org.apache.hadoop.security.authorize.AuthorizationException;
import org.apache.hadoop.security.authorize.ProxyUsers;
import org.apache.hadoop.security.authorize.RefreshAuthorizationPolicyProtocol;
@@ -455,7 +456,8 @@ public class NameNode implements Namenod
public HttpServer run() throws IOException, InterruptedException {
int infoPort = infoSocAddr.getPort();
httpServer = new HttpServer("hdfs", infoHost, infoPort,
- infoPort == 0, conf);
+ infoPort == 0, conf,
+ new AccessControlList(conf.get(DFSConfigKeys.DFS_ADMIN, " ")));
boolean certSSL = conf.getBoolean("dfs.https.enable", false);
boolean useKrb = UserGroupInformation.isSecurityEnabled();
Modified:
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/SecondaryNameNode.java
URL:
http://svn.apache.org/viewvc/hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/SecondaryNameNode.java?rev=983134&r1=983133&r2=983134&view=diff
==============================================================================
---
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/SecondaryNameNode.java
(original)
+++
hadoop/hdfs/trunk/src/java/org/apache/hadoop/hdfs/server/namenode/SecondaryNameNode.java
Fri Aug 6 22:19:52 2010
@@ -52,6 +52,7 @@ import org.apache.hadoop.net.NetUtils;
import org.apache.hadoop.security.Krb5AndCertsSslSocketConnector;
import org.apache.hadoop.security.SecurityUtil;
import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.hadoop.security.authorize.AccessControlList;
import org.apache.hadoop.util.Daemon;
import org.apache.hadoop.util.StringUtils;
@@ -191,7 +192,8 @@ public class SecondaryNameNode implement
int tmpInfoPort = infoSocAddr.getPort();
infoServer = new HttpServer("secondary", infoBindAddress,
tmpInfoPort,
- tmpInfoPort == 0, conf);
+ tmpInfoPort == 0, conf,
+ new AccessControlList(conf.get(DFSConfigKeys.DFS_ADMIN, " ")));
if(UserGroupInformation.isSecurityEnabled()) {
System.setProperty("https.cipherSuites",
