Permission denied: user=yarn, access=WRITE oozie shell action

[#1]

Generally you will get permission denied error as below when you run oozie shell action without setting environment variable to username who is submitting the oozie workflow.

Permission denied: user=yarn, access=WRITE oozie shell action

Below are my sample configs

workflow.xml

<workflow-app xmlns="uri:oozie:workflow:0.3" name="shell-wf">
    <start to="shell-node"/>
    <action name="shell-node">
        <shell xmlns="uri:oozie:shell-action:0.1">
            <job-tracker>${jobTracker}</job-tracker>
            <name-node>${nameNode}</name-node>
            <configuration>
                <property>
                    <name>mapred.job.queue.name</name>
                    <value>${queueName}</value>
                </property>
            </configuration>
            <exec>test.sh</exec>
    <file>/user/root/test.sh</file>
        </shell>
        <ok to="end"/>
        <error to="fail"/>
    </action>
    <kill name="fail">
        <message>Shell action failed, error message[${wf:errorMessage(wf:lastErrorNode())}]</message>
    </kill>
    <end name="end"/>
</workflow-app>

job.properties

nameNode=hdfs://sandbox.hortonworks.com:8020
jobTracker=sandbox.hortonworks.com:8050
queueName=default
examplesRoot=examples
oozie.wf.application.path=${nameNode}/user/${user.name}

test.sh shell script

#!/bin/bash
hadoop fs -mkdir /user/root/testdir

Error:

mkdir: Permission denied: user=yarn, access=WRITE, inode="/user/root/testdir":root:hdfs:drwxr-xr-x
Failing Oozie Launcher, Main class [org.apache.oozie.action.hadoop.ShellMain], exit code [1]
log4j:WARN No appenders could be found for logger (org.apache.hadoop.metrics2.impl.MetricsSystemImpl).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.

How to fix this?

To tell oozie not to run container as yarn but as the user who has submitted the workflow, we need to add below variable environment variable in our workflow.xml file

    <env-var>HADOOP_USER_NAME=${wf:user()}</env-var>

Modified working workflow.xml file:

<workflow-app xmlns="uri:oozie:workflow:0.3" name="shell-wf">
    <start to="shell-node"/>
    <action name="shell-node">
        <shell xmlns="uri:oozie:shell-action:0.1">
            <job-tracker>${jobTracker}</job-tracker>
            <name-node>${nameNode}</name-node>
            <configuration>
                <property>
                    <name>mapred.job.queue.name</name>
                    <value>${queueName}</value>
                </property>
            </configuration>
            <exec>test.sh</exec>
    <env-var>HADOOP_USER_NAME=${wf:user()}</env-var>
    <file>/user/root/test.sh</file>
        </shell>
        <ok to="end"/>
        <error to="fail"/>
    </action>
    <kill name="fail">
        <message>Shell action failed, error message[${wf:errorMessage(wf:lastErrorNode())}]</message>
    </kill>
    <end name="end"/>
</workflow-app>

Ouptut:

[root@sandbox ~]# hadoop fs -ls -d /user/root/testdir
drwxr-xr-x   - root hdfs          0 2016-04-08 07:59 /user/root/testdir
[root@sandbox ~]#

[#2]

@Kuldeep Kulkarni - I'm getting an semantic exception in workflow.xml when I add

<env-var>HADOOP_USER_NAME=${wf:user()}</env-var> 

Any pointers ?

[#3]

@Tushar Bodhale - I think order really matters here. you need to put above line exactly below your script location, please refer my working workflow.xml file. Do let me know if you have any further questions.

[#4]

@Kuldeep Kulkarni This worked for me...Thank you.

[#5]

@Kuldeep Kulkarni

Please suggest on the order if we are executing a sqoop action. I am getting the below semantic exception.

Error: Invalid app definition, org.xml.sax.SAXParseException; lineNumber: 9; columnNumber: 22; cvc-complex-type.2.4.a: Invalid content was found starting with element 'env-var'. One of '{"uri:oozie:sqoop-action:0.3":prepare, "uri:oozie:sqoop-action:0.3":job-xml, "uri:oozie:sqoop-action:0.3":configuration, "uri:oozie:sqoop-action:0.3":command, "uri:oozie:sqoop-action:0.3":arg}' is expected.

[#6]

hi,

I need to write in a local file using a action. but similarly I get the permission error. do you have any idea?