[ https://issues.apache.org/jira/browse/HDFS-5623?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Chris Nauroth updated HDFS-5623: -------------------------------- Attachment: HDFS-5623.1.patch I'm attaching a patch. Summary: # {{FSAclBaseTest}}: Add new tests covering skipping ACL enforcement when permissions are disabled, skipping ACL enforcement for super-user and members of the super-group, making sure that only the owner of the file can change the ACL, and getting a file's ACL requires traverse access along the full path. # {{AclTestHelpers}}, {{TestAclWithSnapshot}}: Refactored some helper methods that were useful in the new tests. This wasn't really required for {{assertDirPermissionDenied}} and {{assertDirPermissionGranted}}, but I did it anyway for consistency with {{assertFilePermissionDenied}} and {{assertFilePermissionGranted}}, which I really did need for the new tests. # {{TestNameNodeAcl}}, {{TestWebHDFSAcl}}: The subclasses of {{FSAclBaseTest}} needed some refactoring to support creation of {{FileSystem}} instances as a specific user. # {{FSNamesystem}}: These tests uncovered one bug. {{FSNamesystem#getAclStatus}} was not enforcing traverse access on the ancestor path. I'm including the fix in this patch. The check for {{isPermissionEnabled}} here is consistent with {{getFileInfo}}, which similarly returns the permission bits. Aside from that one bug, all tests passed as I expected. > NameNode: add tests for skipping ACL enforcement when permission checks are > disabled, user is superuser or user is member of supergroup. > ---------------------------------------------------------------------------------------------------------------------------------------- > > Key: HDFS-5623 > URL: https://issues.apache.org/jira/browse/HDFS-5623 > Project: Hadoop HDFS > Issue Type: Sub-task > Components: namenode > Affects Versions: HDFS ACLs (HDFS-4685) > Reporter: Chris Nauroth > Assignee: Chris Nauroth > Attachments: HDFS-5623.1.patch > > > The existing permission checks are skipped under the following conditions: > * {{dfs.permissions.enabled}} is set to false. (There are several exceptions > stated in the documentation.) > * The user is the super-user. > * The user is a member of the super-user group. > Add tests verifying that ACL enforcement is also skipped for all of these > cases. -- This message was sent by Atlassian JIRA (v6.1.5#6160)