Can we set exceptions to a SuperUser's access permissions?

egarelnabi — Mon, 29 Aug 2016 23:08:57 GMT

We have an application (Datameer) that requires superuser access by being a member in the HDFS supergroup. What options are available for securing/restricting that user's access to files and folders on HDFS?

With Ranger 0.6+ (HDP 2.5+) we can use Deny or Exclude Conditions (https://cwiki.apache.org/confluence/display/RANGER/Deny-conditions+and+excludes+in+Ranger+policies), but what do we do with previous versions like HDP 2.4 (Ranger 0.5.2)?

Re: Can we set exceptions to a SuperUser's access permissions?

emaxwell — Mon, 29 Aug 2016 23:40:38 GMT

@Eyad Garelnabi

According to the Hadoop Documentation, permissions checks for the superuser always succeed, even if you try to restrict them. The process (and group) used to start the namenode become the superuser and can always do everything within HDFS.

question Re: Can we set exceptions to a SuperUser's access permissions? in Archives of Support Questions (Read Only)

Can we set exceptions to a SuperUser's access permissions?

Re: Can we set exceptions to a SuperUser's access permissions?