[
https://issues.apache.org/jira/browse/HDFS-12960?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16301787#comment-16301787
]
Wei-Chiu Chuang edited comment on HDFS-12960 at 12/22/17 6:40 PM:
------------------------------------------------------------------
Hi [~xiaodong.hu] thanks for filing the issue.
Audit logger should record a success whenever the operation is authorized.
{code:title=HdfsAuditLogger}
/**
* Same as
* {@link #logAuditEvent(boolean, String, InetAddress, String, String, String,
* FileStatus)} with additional parameters related to logging delegation token
* tracking IDs.
*
* @param succeeded Whether authorization succeeded.
* @param userName Name of the user executing the request.
* @param addr Remote address of the request.
* @param cmd The requested command.
* @param src Path of affected source file.
* @param dst Path of affected destination file (if any).
* @param stat File information for operations that change the file's metadata
* (permissions, owner, times, etc).
* @param callerContext Context information of the caller
* @param ugi UserGroupInformation of the current user, or null if not logging
* token tracking information
* @param dtSecretManager The token secret manager, or null if not logging
* token tracking information
*/
public void logAuditEvent(boolean succeeded, String userName,
InetAddress addr, String cmd, String src, String dst,
FileStatus stat, CallerContext callerContext, UserGroupInformation ugi,
DelegationTokenSecretManager dtSecretManager) {
logAuditEvent(succeeded, userName, addr, cmd, src, dst, stat,
ugi, dtSecretManager);
}
{code}
When delete returns false, that means files are not actually removed. Looking
at HDFS implementation, in the case of HDFS, it returns false if no blocks are
removed (for example the file is 0-byte)
{code:title=ClientProtocol}
/**
* Delete the given file or directory from the file system.
* <p>
* same as delete but provides a way to avoid accidentally
* deleting non empty directories programmatically.
* @param src existing name
* @param recursive if true deletes a non empty directory recursively,
* else throws an exception.
* @return true only if the existing file or directory was actually removed
* from the file system.
*
* @throws org.apache.hadoop.security.AccessControlException If access is
* denied
* @throws java.io.FileNotFoundException If file <code>src</code> is not found
* @throws org.apache.hadoop.hdfs.server.namenode.SafeModeException create not
* allowed in safemode
* @throws org.apache.hadoop.fs.UnresolvedLinkException If <code>src</code>
* contains a symlink
* @throws SnapshotAccessControlException if path is in RO snapshot
* @throws IOException If an I/O error occurred
*/
@AtMostOnce
boolean delete(String src, boolean recursive)
throws IOException;
{code}
was (Author: jojochuang):
Hi [~xiaodong.hu] thanks for filing the issue.
Audit logger should record a success whenever the operation is authorized.
{code:title=HdfsAuditLogger}
/**
* Same as
* {@link #logAuditEvent(boolean, String, InetAddress, String, String, String,
* FileStatus)} with additional parameters related to logging delegation token
* tracking IDs.
*
* @param succeeded Whether authorization succeeded.
* @param userName Name of the user executing the request.
* @param addr Remote address of the request.
* @param cmd The requested command.
* @param src Path of affected source file.
* @param dst Path of affected destination file (if any).
* @param stat File information for operations that change the file's metadata
* (permissions, owner, times, etc).
* @param callerContext Context information of the caller
* @param ugi UserGroupInformation of the current user, or null if not logging
* token tracking information
* @param dtSecretManager The token secret manager, or null if not logging
* token tracking information
*/
public void logAuditEvent(boolean succeeded, String userName,
InetAddress addr, String cmd, String src, String dst,
FileStatus stat, CallerContext callerContext, UserGroupInformation ugi,
DelegationTokenSecretManager dtSecretManager) {
logAuditEvent(succeeded, userName, addr, cmd, src, dst, stat,
ugi, dtSecretManager);
}
{code}
When delete returns false, that means files are not actually removed. Looking
at HDFS implementation, in the case of HDFS, it returns false if no blocks are
removed (for example the file is 0-byte)
{code:ClientProtocol}
/**
* Delete the given file or directory from the file system.
* <p>
* same as delete but provides a way to avoid accidentally
* deleting non empty directories programmatically.
* @param src existing name
* @param recursive if true deletes a non empty directory recursively,
* else throws an exception.
* @return true only if the existing file or directory was actually removed
* from the file system.
*
* @throws org.apache.hadoop.security.AccessControlException If access is
* denied
* @throws java.io.FileNotFoundException If file <code>src</code> is not found
* @throws org.apache.hadoop.hdfs.server.namenode.SafeModeException create not
* allowed in safemode
* @throws org.apache.hadoop.fs.UnresolvedLinkException If <code>src</code>
* contains a symlink
* @throws SnapshotAccessControlException if path is in RO snapshot
* @throws IOException If an I/O error occurred
*/
@AtMostOnce
boolean delete(String src, boolean recursive)
throws IOException;
{code}
> The audit log recorded the wrong result when the delete API return false
> ------------------------------------------------------------------------
>
> Key: HDFS-12960
> URL: https://issues.apache.org/jira/browse/HDFS-12960
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: datanode
> Affects Versions: 3.0.0-alpha4
> Reporter: hu xiaodong
> Assignee: hu xiaodong
> Attachments: HDFS-12960.001.patch
>
>
> The audit log recorded the wrong result when the delete API return false
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
