ArkoSharma commented on a change in pull request #1630:
URL: https://github.com/apache/hive/pull/1630#discussion_r519596217
##########
File path:
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/ReplChangeManager.java
##########
@@ -606,6 +614,45 @@ public Void execute() throws IOException {
}
}
+ /*
+ * Provide members of warehouse group access to the cmRoot location.
+ * To do this, assign cmRoot to group of warehouse if possible. If not, set
acl for wh-group.
+ * If warehouse directory cannot be determined then give rwx permissions to
default group of cmroot.
+ */
+ private static void setCmRootPermissions(Path cmroot) throws IOException{
+ FileSystem cmFs = cmroot.getFileSystem(conf);
+ cmFs.setPermission(cmroot, new FsPermission("770"));
+ try {
+ FileStatus warehouseStatus = cmFs.getFileStatus(new
Path(MetastoreConf.get(conf, ConfVars.WAREHOUSE.getVarname())));
+ String warehouseOwner = warehouseStatus.getOwner();
+ String warehouseGroup = warehouseStatus.getGroup();
+ if (warehouseOwner.equals(cmFs.getFileStatus(cmroot).getOwner())) {
+ FsAction whOwnerAction =
warehouseStatus.getPermission().getUserAction();
+ FsAction whGroupAction =
warehouseStatus.getPermission().getGroupAction();
+ FsAction whOtherAction =
warehouseStatus.getPermission().getOtherAction();
+ if(!warehouseGroup.equals(cmFs.getFileStatus(cmroot).getGroup())) {
+ //change group to wh-group.
+ //since cmRoot owner is already part of wh-group, this can be done.
+ cmFs.setOwner(cmroot, null, warehouseGroup);
+ cmFs.setPermission(cmroot, new FsPermission(whOwnerAction,
whGroupAction, whOtherAction));
+ }
+ } else {
+ LOG.warn("Metastore-user is not same as owner of warehouse.");
+ if(!warehouseGroup.equals(cmFs.getFileStatus(cmroot).getGroup())) {
+ List<AclEntry> aclList = Lists.newArrayList(
+ new
AclEntry.Builder().setScope(ACCESS).setType(USER).setPermission(FsAction.ALL).build(),
+ new
AclEntry.Builder().setScope(ACCESS).setType(GROUP).setPermission(FsAction.ALL).build(),
+ new
AclEntry.Builder().setScope(ACCESS).setType(OTHER).setPermission(FsAction.NONE).build());
+ aclList.add(new
AclEntry.Builder().setScope(ACCESS).setType(GROUP).setName(warehouseGroup).
+
setPermission(warehouseStatus.getPermission().getGroupAction()).build());
+ cmFs.setAcl(cmroot, aclList);
Review comment:
Group permissions were provided initially(line 624), so nothing needs to
be added.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
