question User can still see / read on paths that it does not own in Archives of Support Questions (Read Only)

User can still see / read on paths that it does not own

menorah84 — Tue, 22 Nov 2016 18:27:43 GMT

I have set a Ranger policy enabling a certain newuser to read/write/execute only on his own home directory in HDFS, say /user/<newuser>. While the policy certainly works on his own path, however, I do not want newuser to be able to read directories and files outside its own, which still happens when I do:

hadoop fs -ls /

Or on some other directories. Same thing happens when newuser is logged in in Hue.

How do I do this in Ranger?

Re: User can still see / read on paths that it does not own

dsharma — Tue, 22 Nov 2016 18:29:45 GMT

that is because HDFS posix permission is there on base dir , so make that is 000

Re: User can still see / read on paths that it does not own

agillan — Tue, 22 Nov 2016 18:32:51 GMT

Hi @J. D. Bacolod - please see this article I wrote a while ago which explains how Ranger works: https://community.hortonworks.com/content/kbentry/49177/how-do-ranger-policies-work-in-relation-to-hdfs-po.html

From HDP 2.5, there is also the potential to Deny access explicitly via a Deny policy. See this article on how to enable them: https://community.hortonworks.com/content/kbentry/61208/how-to-enable-deny-conditions-and-excludes-in-rang.html

Hope this helps!