[
https://issues.apache.org/jira/browse/HDFS-5117?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13746920#comment-13746920
]
Ryan Hennig commented on HDFS-5117:
-----------------------------------
Colin: Read the description. We need one group of writers, another group of
readers, and no access for others. The best that HDFS can do right now is a
single writer, a group of readers, and no access for others with mode 740 or
741.
Caleb: We are also pursuing an ACL-based alternative. However the
group-as-owner approach has several advantages: Not only is it a much simpler
way to view and specify an ACL, but the list of users with read/write access
can be stored in an LDAP group and managed centrally without involving the
NameNode. The impact on HDFS and associated tools is minimal.
> Allow the owner of an HDFS path to be a group
> ---------------------------------------------
>
> Key: HDFS-5117
> URL: https://issues.apache.org/jira/browse/HDFS-5117
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: hdfs-client
> Reporter: Ryan Hennig
> Original Estimate: 48h
> Remaining Estimate: 48h
>
> At eBay, we have the need to associate some HDFS paths with a set of users
> with write access, a set of users with read-only access, and neither read or
> write to others.
> The current model of POSIX-style permissions is nearly sufficient for this,
> except for the need of multiple writers.
> One easy fix would be to allow the owner of a path to be a group, and then
> grant owner permissions to all members of that group. I have verified that
> HDP 1.3 allows you to set the owner of a path to a group without error, but
> the owner permissions of that group are not given to members of the group.
> I've created a relatively simple fix for this by modifying the "check" method
> in src/hdfs/org/apache/hadoop/hdfs/server/namenode/FSPermissionChecker.java
> and I am working on related changes to unit tests etc now.
> - Ryan
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
