question Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs in Archives of Support Questions (Read Only)

Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

KuldeepK — Wed, 16 Dec 2015 12:57:38 GMT

I have configured once policy for hdfs via ranger. below are the details:

1. Policy configured for user admin

2. User admin can rwx into /user/oozie

3. Point number 2 tested successfully

4. When I went to change ownership of /user/oozie to admin by user admin then it fails with below error

[admin@hdpambari ~]$ hdfs dfs -chown root /user/oozie/test1
chown: changing ownership of '/user/oozie/test1': Non-super user cannot change owner

I know that logically this is correct as user "admin" has rwx access to /user/oozie so no need to change the ownership.

Is my understanding correct ? is there any documentation that points to this ?

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

KuldeepK — Wed, 16 Dec 2015 12:59:59 GMT

@Arti Wadhwani

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

bleonhardi — Wed, 16 Dec 2015 17:38:02 GMT

Just a question for clarification: Can you do a hdfs dfs -ls /user/oozie? If the test1 folder is not owned by user admin ( he only has rwx but is not the owner ), then he cannot change the ownership either. That is the same in Linux. I suppose this is not the case here but I just wanted to clarify

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

jstraub — Wed, 16 Dec 2015 17:43:51 GMT

Agree, you have to be a superuser or the owner to change the owner of a folder. Also see this FSDirAttrOp.java#L73

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

KuldeepK — Thu, 17 Dec 2015 10:59:11 GMT

@Benjamin Leonhardi - Yes I can do dfs -ls /user/oozie, I can read each and every file, I can write into it. You are correct! its same as Unix.

@Jonas Straub - Thank you for the link. I think only superuser can change the ownership ( current owner also cannot change it)

Unix:

-rwxrwxrwx    1 kkulkarni  staff    39441 Dec 17 08:17 test 
KKs-Mac:~ kkulkarni$
KKs-Mac:~ kkulkarni$ chown root test 
chown: test: Operation not permitted

KKs-Mac:~ kkulkarni$ sudo chown root test 
KKs-Mac:~ kkulkarni$ ls -lrt test
-rwxrwxrwx  1 root  staff  39441 Dec 17 08:17 test 
KKs-Mac:~ kkulkarni$

Same is the case for hdfs.

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

KuldeepK — Thu, 17 Dec 2015 11:08:14 GMT

@mkhandekar

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

nsabharwal — Thu, 17 Dec 2015 11:10:28 GMT

@Kuldeep Kulkarni

Based on the output in the question , you are logged in as admin user

[admin@hdpambari ~]$ hdfs dfs -chown root /user/oozie/test1

chown: changing ownership of '/user/oozie/test1':Non-super user cannot change owner

test1 is owned by some other user?

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

bdurai — Thu, 17 Dec 2015 11:29:10 GMT

@Kuldeep Kulkarni, how are you setting user admin as administrator? Is the user admin in dfs.cluster.administrators?

Do you have access to user "hdfs"?

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

KuldeepK — Thu, 17 Dec 2015 12:39:16 GMT

@Neeraj Sabharwal - its owned by admin only

[root@hdpambari yarn]# hadoop fs -ls /user/oozie/test1
-rw-r--r--   3 admin hadoop          0 2015-12-09 21:47 /user/oozie/test1
[root@hdpambari yarn]#

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

KuldeepK — Thu, 17 Dec 2015 12:40:44 GMT

@bdurai - nopes I have just configured ranger policy and given rwx access to admin user for /user/oozie (recursively)

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

KuldeepK — Thu, 17 Dec 2015 12:42:53 GMT

I do have access to hdfs user and yes we can change the ownership using

sudo -u hdfs hadoop fs -chown <some-user> /user/oozie/test1

I just wanted to ensure that if this is expected behavior that even after granting rwx via Ranger authorization we cannot change the ownership.

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

bdurai — Thu, 17 Dec 2015 13:02:26 GMT

Yes, this is the expected behavior. Ranger Policies are just for the ACL and not for ownership. The right way to do out here is to use Ranger for all the ACLs. You should you want root to access /user/oozie/test1, then from Ranger Admin, you should give "root" the required access to the folder. Ideally, you shouldn't play with owner and group.

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

KuldeepK — Thu, 17 Dec 2015 19:49:31 GMT

@bdurai - Thats correct! Thank you.

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

aervits — Wed, 03 Feb 2016 01:52:00 GMT

@Kuldeep Kulkarni has this been resolved? Please accept best answer or provide your own solution.

Re: Ranger authorization for HDFS - Unable to change ownership of a directory in hdfs

KuldeepK — Wed, 03 Feb 2016 10:04:25 GMT

Based on all the discussion, this is expected behavior. Even after giving full permissions via ranger, only superuser can modify ownership.