[
https://issues.apache.org/jira/browse/MAPREDUCE-1542?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12862574#action_12862574
]
Amareshwari Sriramadasu commented on MAPREDUCE-1542:
----------------------------------------------------
After discussing with Grid operations at Yahoo, we realized that they are in
favor of having separate configuration properties for MAPREDUCE and HDFS
projects, because usually the conf directory is not different for MAPREDUCE and
HDFS, it is just a single HADOOP_CONF_DIR; If the same property name is used
for both the administrators it will be confusing and might have other problems
if both files are loaded.
Currently we have hadoop.clusrer.administrators, mapred.permissions.supergroup
and dfs.permissions.supergroup configuration properties for controlling admins.
I propose the following change in the configuration for fixing administrator
access:
1. Remove hadoop.cluster.administrators
2. Replace mapred.permissions.supergroup with an acl:
mapreduce.cluster.administrators
3. The change in HDFS can be decided later, in a different HDFS issue. Will
leave dfs.persmissions.supergrop as is, for now.
So, when individual daemons create HTTPServer they will set appropriate
administrator acl for the HTTPServer. Here, mapred daemons will set the value
of mapreduce.cluster.administrators and HDFS daemons will set ' '(space)
followed by hdfs.persmissions.supergrop.
Thoughts?
> Deprecate mapred.permissions.supergroup in favor of
> hadoop.cluster.administrators
> ---------------------------------------------------------------------------------
>
> Key: MAPREDUCE-1542
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-1542
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: security
> Reporter: Vinod K V
> Assignee: Ravi Gummadi
> Fix For: 0.22.0
>
> Attachments: 1542.20S.1.patch, 1542.20S.patch, 1542.patch,
> 1542.v1.patch, mapreduce-1542-y20s.patch
>
>
> HADOOP-6568 added the configuration {{hadoop.cluster.administrators}} through
> which admins can configure who the superusers/supergroups for the cluster
> are. MAPREDUCE itself already has {{mapred.permissions.supergroup}} (which is
> just a single group). As agreed upon at HADOOP-6568, this should be
> deprecated in favor of {{hadoop.cluster.administrators}}.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
