[
https://issues.apache.org/jira/browse/HADOOP-10701?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14031803#comment-14031803
]
Premchandra Preetham Kukillaya commented on HADOOP-10701:
---------------------------------------------------------
Here are the detailed steps to recreate this bug. FYI we are using LDAP for
storing the Unix ID and group and the LDAP is integrated with Hadoop cluster.
Preliminary steps
1.Created Group say group1
2.Created Another Group say group2
3.Now created a User say “pocuser” and associated it with group1 and group2 (
now pocuser is associated with group1 and group2)
uid=13500(pocuser) gid=3500(group1) groups=3500(group1),3600(group2)
4 Created HDFS directory named data1 and assigned the ownership to hdfs:group1
with permission 770
5.Create Another HDFS directory say data2 and assigned the ownership to
hdfs:group2 with permission 770
drwxrwx--- - hdfs group1 0 2014-06-14 04:14 /data1
drwxrwx--- - hdfs group2 0 2014-06-14 04:14 /data2
Steps to create bug
1) Now login as “pocuser" in to the machine where HDFS is mounted and just
type command “id" then you will see that user “pocuser” is associated with two
groups (group1 and group2)
uid=13500(pocuser) gid=3500(group1) groups=3500(group1),3600(group2)
2)Execute "cd /hdfsmount; ls – ltra" then you will see that permissions are
reflecting properly in the mounted file system
drwxrwx---. 2 hdfs group1 64 Jun 14 04:14 data1
drwxrwx---. 2 hdfs group2 64 Jun 14 04:14 data2
3) Reconfirmed that user “pocuser” belongs to the two group by executing
command "groups pocuser"
pocuser : group1 group2
4) Now the user “pocuser” can access only data1 and NOT data2 as for some
reasons it ignores the secondary group while accessing the mounted file system
and throws Permission denied.
-sh-4.1$ cd data2
-sh: cd: data2: Permission denied
-sh-4.1$ cd data1
-sh-4.1$
5) Now if execute the command “newgrp group2” then the user can access data2
and not data1 as the the primary group of the user “pocuser” is group2
newgrp group2
cd data1
cd: data1: Permission denied
cd data2
> The bug is while accessing NFS Mounted File System the permission is always
> validated based on the primary Unix group the user is associated with and
> Secondary Unix groups are ignored.
> -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: HADOOP-10701
> URL: https://issues.apache.org/jira/browse/HADOOP-10701
> Project: Hadoop Common
> Issue Type: Bug
> Components: nfs
> Environment: Linux Redhat
> Reporter: Premchandra Preetham Kukillaya
> Attachments: Hadoop_NFS_BugCreation_Steps.docx
>
>
--
This message was sent by Atlassian JIRA
(v6.2#6252)
