question Re: Can we restrict root directory[level 1 directory ] access for users ? in Archives of Support Questions (Read Only)

Can we restrict root directory[level 1 directory ] access for users ?

sshimpi — Tue, 15 Mar 2016 16:27:10 GMT

I have HDFS filesystem as below -

------

# sudo -u hdfs hadoop fs -ls /

dr-------- - hdfs hdfs 0 2016-03-09 15:14 /test1

drwxr-xr-x - bat hdfs 0 2016-03-09 15:10 /bat

drwxr-xr-x - hdfs hdfs 0 2016-03-06 11:25 /hdp

drwxr-xr-x - mapred hdfs 0 2016-03-06 11:25 /mapred

drwxrwxrwx - mapred hadoop 0 2016-03-06 11:26 /mr-history

drwxrwxrwx - hdfs hdfs 0 2016-03-08 15:30 /tmp

drwxr-xr-x - hdfs hdfs 0 2016-03-09 04:55 /user

[root@node1 ~]#

--------

I have user created name 'bat' and bat user can issue same command as shown below -

--------

[bat@node1 ~]$ id

uid=1009(bat) gid=1007(hdfs2) groups=1007(hdfs2)

[bat@node1 ~]$ hadoop fs -ls /

dr-------- - hdfs hdfs 0 2016-03-09 15:14 /test1

drwxr-xr-x - bat hdfs 0 2016-03-09 15:10 /bat

drwxr-xr-x - hdfs hdfs 0 2016-03-06 11:25 /hdp

drwxr-xr-x - mapred hdfs 0 2016-03-06 11:25 /mapred

drwxrwxrwx - mapred hadoop 0 2016-03-06 11:26 /mr-history

drwxrwxrwx - hdfs hdfs 0 2016-03-08 15:30 /tmp

drwxr-xr-x - hdfs hdfs 0 2016-03-09 04:55 /user

[bat@node1 ~]$

--------

Is it possible that - bat user will only able to see the directory on which he has permission / owner of those directories -

So the expected output will be -

[bat@node1 ~]$ id

uid=1009(bat) gid=1007(hdfs2) groups=1007(hdfs2)

[bat@node1 ~]$ hadoop fs -ls /

dr-------- - hdfs hdfs 0 2016-03-09 15:14 /test1

drwxr-xr-x - bat hdfs 0 2016-03-09 15:10 /bat

[bat@node1 ~]$

----

Can we block access to level 1 directories in HDFS/Ranger/etc... in hadoop ?

If not why is so ?

Re: Can we restrict root directory[level 1 directory ] access for users ?

KuldeepK — Wed, 16 Mar 2016 13:40:00 GMT

Sagar Shimpi - I think this is working as expected because you have execute permission for other users on "/" directory on hdfs so they can see contents inside "/"

e.g.

[root@sandbox ~]# hadoop fs -ls -d /
drwxr-xr-x   - hdfs hdfs          0 2015-10-27 13:12 /
[root@sandbox ~]#

Re: Can we restrict root directory[level 1 directory ] access for users ?

rpatil — Fri, 18 Mar 2016 15:05:28 GMT

For the actual question on how to then fix the permissions so that users from different group don't get to see/read it, below might be helpful.

hdfs dfs -chmod -R 770 <path/to/restrict>

Re: Can we restrict root directory[level 1 directory ] access for users ?

bdurai — Fri, 18 Mar 2016 19:15:17 GMT

Don't forget to change the umask. Either 077 or 027

Re: Can we restrict root directory[level 1 directory ] access for users ?

KuldeepK — Thu, 18 Aug 2016 13:06:56 GMT

@Sagar Shimpi - Can you please accept appropriate answer or provide your own solution?