I have tried to reproduce your environment as below. HDP 2.6.2 Ambari 2.5.2, I don't think the version difference is an issue. Created group data_team,dfusers and users abisuer,usera and userb,please try to follow the steps I used to understand and compare with your own. I set the dfs.namenode.acls.enabled to true using Ambari which is the recommended way.
Created groups and users
[root@nakuru ~]# groupadd data_team [root@nakuru ~]# useradd -G data_team usera [root@nakuru ~]# useradd -G data_team userb [root@nakuru ~]# groupadd dfsusers [root@nakuru ~]# useradd abiuser
Switched to user abiuser belonging to group dfsusers and created a file file1.txt with the below contents
[root@nakuru ~]# su - abiuser [abiuser@nakuru ~]$ vi file1.txt /*contents*/ I have enabled ACL on the ambari console and restarted the required services and I'm able to set the permissions for specific group as well. But when they try to execute it is not working. Need your suggestions. My HDP version is 2.4 and hadoop 2.7.
Checked the saved file
[abiuser@nakuru ~]$ ls -al -rw-r--r-- 1 abiuser abiuser 250 Jan 10 22:24 file1.txt
Enabled ACL (custom hdfs-site.xml) through Ambari.
dfs.namenode.acls.enabled=true
Restart all stale configs in my case
HDFS
YARN
MapReduces2
Atlas
As hdfs user created the directory and change ownership and permission
[hdfs@nakuru ~]$ hdfs dfs -mkdir -p /abc/month=12 [hdfs@nakuru ~]$ hdfs dfs -chown -R abiuser:dfsusers /abc/month=12
Validate the above
[hdfs@nakuru ~]$ hdfs dfs -ls /abc Found 1 items drwxr-xr-x - abiuser dfsusers 0 2018-01-10 22:40 /abc/month=12
Copy the file1.txt from local to hdfs
[abiuser@nakuru ~]$ hdfs dfs -put file1.txt /abc/month=12 [abiuser@nakuru ~]$ hdfs dfs -ls /abc/month=12 Found 1 items -rw-r--r-- 3 abiuser dfsusers 250 2018-01-10 22:46 /abc/month=12/file1.txt
Now see the ACL's on the file
[abiuser@nakuru ~]$ hdfs dfs -getfacl -R /abc/month=12/ # file: /abc/month=12 # owner: abiuser # group: dfsusers user::rwx group::r-x other::r-x # file: /abc/month=12/file1.txt # owner: abiuser # group: dfsusers user::rw- group::r-- other::r--
Now set the ACL rwx for usera and userb as the file owner abiuser
[abiuser@nakuru ~]$ hdfs dfs -setfacl -m user:usera:rwx /abc/month=12/file1.txt [abiuser@nakuru ~]$ hdfs dfs -setfacl -m user:userb:rwx /abc/month=12/file1.txt
Validate the above ACL's for the file1.txt
[abiuser@nakuru ~]$ hdfs dfs -getfacl -R /abc/month=12/ # file: /abc/month=12 # owner: abiuser # group: dfsusers user::rwx group::r-x other::r-x # file: /abc/month=12/file1.txt # owner: abiuser # group: dfsusers user::rw- user:usera:rwx user:userb:rwx group::r-- mask::rwx other::r--
See if usera can read the file
[root@nakuru ~]# su - usera [usera@nakuru ~]$ hdfs dfs -cat /abc/month=12/file1.txt I have enabled ACL on the ambari console and restarted the required services and I'm able to set the permissions for specific group as well. But when they try to execute it is not working. Need your suggestions. My HDP version is 2.4 and hadoop 2.7.
I get exactly the contents of the file1.txt
See if userb can read the file
[root@nakuru ~]# su - userb [userb@nakuru ~]$ hdfs dfs -cat /abc/month=12/file1.txt I have enabled ACL on the ambari console and restarted the required services and I'm able to set the permissions for specific group as well. But when they try to execute it is not working. Need your suggestions. My HDP version is 2.4 and hadoop 2.7.
Voila , that answers your question the file owner and group is abiuser:dfsuser but usera and userb from a different group data_team can successfully read the file1.txt
Could you Accept the answer by Clicking on Accept button below, if this answers your problem that would be great help to Community users to find solution quickly.
