HDDS-1611. Evaluate ACL on volume bucket key and prefix to authorize access. Contributed by Ajay Kumar. #973
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Draft patch for initial feedback, will ad robot test and more unit tests soon. |
|
💔 -1 overall
This message was automatically generated. |
xiaoyuyao
reviewed
Jun 17, 2019
| BitSet rights = BitSet.valueOf(a.getRights().toByteArray()); | ||
| switch (a.getType()) { | ||
| case USER: | ||
| if (a.getName().equals(context.getClientUgi().getUserName())) { |
There was a problem hiding this comment.
Can we move context.getClientUgi().getUserName() out of the for loop?
xiaoyuyao
reviewed
Jun 17, 2019
| * | ||
| * @return true if given ugi has acl set, else false. | ||
| * */ | ||
| public boolean hasAccess(ACLType acl, ACLIdentityType aclType, |
There was a problem hiding this comment.
Discussed offline, we need to handle different identity types.
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
| Should contain ${result} createdOn | ||
| ${result} = Execute ozone sh volume list --user bilbo | grep -Ev 'Removed|DEBUG|ERROR|INFO|TRACE|WARN' | jq -r '.[] | select(.volumeName=="${volume}")' | ||
| ${result} = Execute ozone sh volume list | grep -Ev 'Removed|DEBUG|ERROR|INFO|TRACE|WARN' | jq -r '.[] | select(.volumeName=="${volume}")' |
| Test native authorizer | ||
| Execute ozone sh volume removeacl ${volume3} -a group:root:a | ||
| Execute kdestroy |
| Execute kdestroy | ||
| Run Keyword Kinit test user testuser2 testuser2.keytab | ||
| ${result} = Execute And Ignore Error ozone sh bucket list /${volume3}/ |
| Should contain ${result} PERMISSION_DENIED org.apache.hadoop.ozone.om.exceptions.OMException: User testuser2/scm@EXAMPLE.COM doesn't have LIST permission to access volume | ||
| Execute ozone sh volume addacl ${volume3} -a user:testuser2/scm@EXAMPLE.COM:l | ||
| Execute ozone sh bucket list /${volume3}/ |
| Execute ozone sh volume addacl ${volume3} -a user:testuser2/scm@EXAMPLE.COM:l | ||
| Execute ozone sh bucket list /${volume3}/ | ||
| Execute ozone sh volume getacl /${volume3}/ |
| @@ -33,21 +33,21 @@ Setup volume names | |||
| *** Test Cases *** | |||
| Create volume bucket with wrong credentials | |||
| Execute kdestroy | |||
| ${rc} ${output} = Run And Return Rc And Output ozone sh volume create o3://om/fstest --user bilbo --quota 100TB --root | |||
| ${rc} ${output} = Run And Return Rc And Output ozone sh volume create o3://om/fstest | |||
| @@ -356,7 +359,7 @@ public void testFailedDeleteVolume() throws IOException, OzoneException { | |||
| // Create a volume and test Volume access for a different user | |||
| @Test | |||
| public void testAccessVolume() throws IOException, OzoneException { | |||
| String userName = "user" + RandomStringUtils.randomNumeric(5); | |||
| String userName = UserGroupInformation.getCurrentUser().getUserName(); | |||
| private void validateAll(OzoneObj obj, RequestContext.Builder | ||
| builder) throws OMException { | ||
| List<ACLType> allAcls = new ArrayList<>(Arrays.asList(ACLType.values())); | ||
| allAcls.remove(ALL); |
| */ | ||
| private void validateNone(OzoneObj obj, RequestContext.Builder | ||
| builder) throws OMException { | ||
| List<ACLType> allAcls = new ArrayList<>(Arrays.asList(ACLType.values())); |
| metadataManager.getLock().acquireBucketLock(volume, bucket); | ||
| try { | ||
| validateBucket(volume, bucket); | ||
| String objectKey = metadataManager.getOzoneKey(volume, bucket, keyName); |
| args.getVolumeName(), args.getBucketName(), args.getKeyName()); | ||
| } else { | ||
| throw ex; | ||
| } |
| @@ -78,4 +78,12 @@ | |||
| * @throws IOException - incase of volume creation failure. | |||
| */ | |||
| boolean createOzoneVolumeIfNeeded(String userName) throws IOException; | |||
|
|
|||
| .setQuotaInBytes(OzoneConsts.MAX_QUOTA_IN_BYTES); | ||
| for (OzoneAcl acl : getDefaultAcls()) { | ||
| builder.addOzoneAcls(OzoneAcl.toProtobuf(acl)); | ||
| } |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
anuengineer
reviewed
Jun 28, 2019
| @@ -118,6 +118,10 @@ | |||
| * */ | |||
| public static final String OZONE_ADMINISTRATORS = | |||
| "ozone.administrators"; | |||
| /** | |||
| * Make every user an admin. | |||
There was a problem hiding this comment.
Perhaps write more detailed comment here ?
anuengineer
reviewed
Jun 29, 2019
|
|
||
| public static int getNoOfAcls() { | ||
| return length; | ||
| } | ||
|
|
||
| public static ACLType getAclTypeFromOrdinal(int ordinal) { | ||
| if (ordinal > length - 1) { |
There was a problem hiding this comment.
We should perhaps add a not less than zero check also , so we can throw exception correctly.
anuengineer
reviewed
Jun 29, 2019
| testMatrix.put(" world:bilbo:w", Boolean.FALSE); | ||
| testMatrix.put(" world:bilbo:rw", Boolean.FALSE); | ||
| testMatrix.put(" world:bilbo:w", Boolean.TRUE); | ||
| testMatrix.put(" world:bilbo:rw", Boolean.TRUE); |
There was a problem hiding this comment.
This is a good catch. I think we should move to more explicit error, where if the users tries to set world and a user name, we should throw an error, that way user is not making a mistake, which we are silently ignoring.
anuengineer
reviewed
Jun 29, 2019
| checkAcls(ResourceType.KEY, StoreType.OZONE, ACLType.WRITE, | ||
| args.getVolumeName(), args.getBucketName(), args.getKeyName()); | ||
| try { | ||
| checkAcls(ResourceType.KEY, StoreType.OZONE, ACLType.WRITE, |
There was a problem hiding this comment.
we need to make sure that Audit system knows about these ACL check failures.
There was a problem hiding this comment.
Created HDDS-1768 to track it.
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
ajayydv
force-pushed
the
HDDS-1611
branch
2 times, most recently
from
4ba675f to
881c4da
Compare
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
…access. Contributed by Ajay Kumar.
|
seems like some error in reporting, acceptance tests passed. |
|
/retest |
|
failed junit tests look unrelated, TestWatchForCommit & TestFailureHandlingByClient fail for trunk as well. |
anuengineer
approved these changes
Jul 10, 2019
asfgit
pushed a commit
that referenced
this pull request
Jul 10, 2019
…authorize access. Contributed by Ajay Kumar. (#973) Fixes a build break in ozone.
shanthoosh
added a commit
to shanthoosh/hadoop
that referenced
this pull request
Oct 15, 2019
amahussein
pushed a commit
to amahussein/hadoop
that referenced
this pull request
Oct 29, 2019
…access. Contributed by Ajay Kumar. (apache#973)
amahussein
pushed a commit
to amahussein/hadoop
that referenced
this pull request
Oct 29, 2019
…authorize access. Contributed by Ajay Kumar. (apache#973) Fixes a build break in ozone.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.