Return-Path: X-Original-To: apmail-hadoop-common-commits-archive@www.apache.org Delivered-To: apmail-hadoop-common-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id AB0E39E47 for ; Wed, 10 Dec 2014 21:41:38 +0000 (UTC) Received: (qmail 85061 invoked by uid 500); 10 Dec 2014 21:41:38 -0000 Delivered-To: apmail-hadoop-common-commits-archive@hadoop.apache.org Received: (qmail 84989 invoked by uid 500); 10 Dec 2014 21:41:38 -0000 Mailing-List: contact common-commits-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: common-dev@hadoop.apache.org Delivered-To: mailing list common-commits@hadoop.apache.org Received: (qmail 84980 invoked by uid 99); 10 Dec 2014 21:41:38 -0000 Received: from tyr.zones.apache.org (HELO tyr.zones.apache.org) (140.211.11.114) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 10 Dec 2014 21:41:38 +0000 Received: by tyr.zones.apache.org (Postfix, from userid 65534) id E8728A24B30; Wed, 10 Dec 2014 21:41:37 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: aw@apache.org To: common-commits@hadoop.apache.org Message-Id: X-Mailer: ASF-Git Admin Mailer Subject: hadoop git commit: HADOOP-6590. Add a username check for hadoop sub-commands (John Smith via aw) Date: Wed, 10 Dec 2014 21:41:37 +0000 (UTC) Repository: hadoop Updated Branches: refs/heads/trunk a7c6c710b -> c53614269 HADOOP-6590. Add a username check for hadoop sub-commands (John Smith via aw) Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/c5361426 Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/c5361426 Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/c5361426 Branch: refs/heads/trunk Commit: c536142699099c0e6da3413f1bbb01784577e28e Parents: a7c6c71 Author: Allen Wittenauer Authored: Wed Dec 10 13:41:28 2014 -0800 Committer: Allen Wittenauer Committed: Wed Dec 10 13:41:28 2014 -0800 ---------------------------------------------------------------------- hadoop-common-project/hadoop-common/CHANGES.txt | 2 ++ hadoop-common-project/hadoop-common/src/main/bin/hadoop | 2 ++ .../hadoop-common/src/main/bin/hadoop-functions.sh | 12 ++++++++++++ .../hadoop-common/src/main/conf/hadoop-env.sh | 6 ++++++ hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs | 2 ++ hadoop-mapreduce-project/bin/mapred | 2 ++ hadoop-yarn-project/hadoop-yarn/bin/yarn | 2 ++ 7 files changed, 28 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/CHANGES.txt ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt index 7310dd4..6e1cc11 100644 --- a/hadoop-common-project/hadoop-common/CHANGES.txt +++ b/hadoop-common-project/hadoop-common/CHANGES.txt @@ -24,6 +24,8 @@ Trunk (Unreleased) (Dexter Bradshaw, Mostafa Elhemali, Xi Fang, Johannes Klein, David Lao, Mike Liddell, Chuan Liu, Lengning Liu, Ivan Mitic, Michael Rys, Alexander Stojanovich, Brian Swan, and Min Wei via cnauroth) + + HADOOP-6590. Add a username check for hadoop sub-commands (John Smith via aw) IMPROVEMENTS http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/src/main/bin/hadoop ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/bin/hadoop b/hadoop-common-project/hadoop-common/src/main/bin/hadoop index be38382..b216b8f 100755 --- a/hadoop-common-project/hadoop-common/src/main/bin/hadoop +++ b/hadoop-common-project/hadoop-common/src/main/bin/hadoop @@ -179,6 +179,8 @@ case ${COMMAND} in ;; esac +hadoop_verify_user "${COMMAND}" + # Always respect HADOOP_OPTS and HADOOP_CLIENT_OPTS hadoop_debug "Appending HADOOP_CLIENT_OPTS onto HADOOP_OPTS" HADOOP_OPTS="${HADOOP_OPTS} ${HADOOP_CLIENT_OPTS}" http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh b/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh index 3e353d9..dfd7315 100644 --- a/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh +++ b/hadoop-common-project/hadoop-common/src/main/bin/hadoop-functions.sh @@ -1154,3 +1154,15 @@ function hadoop_secure_daemon_handler esac } +function hadoop_verify_user +{ + local command=$1 + local uservar="HADOOP_${command}_USER" + + if [[ -n ${!uservar} ]]; then + if [[ ${!uservar} != ${USER} ]]; then + hadoop_error "ERROR: ${command} can only be executed by ${!uservar}." + exit 1 + fi + fi +} http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh ---------------------------------------------------------------------- diff --git a/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh b/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh index 588b02a..ae18542 100644 --- a/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh +++ b/hadoop-common-project/hadoop-common/src/main/conf/hadoop-env.sh @@ -398,3 +398,9 @@ esac # via this special env var: # export HADOOP_ENABLE_BUILD_PATHS="true" +# +# To prevent accidents, shell commands be (superficially) locked +# to only allow certain users to execute certain subcommands. +# +# For example, to limit who can execute the namenode command, +# export HADOOP_namenode_USER=hdfs http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs ---------------------------------------------------------------------- diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs b/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs index 8140f18..98a89b7 100755 --- a/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs +++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/bin/hdfs @@ -247,6 +247,8 @@ case ${COMMAND} in ;; esac +hadoop_verify_user "${COMMAND}" + if [[ -n "${secure_service}" ]]; then HADOOP_SECURE_USER="${secure_user}" hadoop_verify_secure_prereq http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-mapreduce-project/bin/mapred ---------------------------------------------------------------------- diff --git a/hadoop-mapreduce-project/bin/mapred b/hadoop-mapreduce-project/bin/mapred index 9f28471..066c438 100755 --- a/hadoop-mapreduce-project/bin/mapred +++ b/hadoop-mapreduce-project/bin/mapred @@ -135,6 +135,8 @@ case ${COMMAND} in ;; esac +hadoop_verify_user "${COMMAND}" + daemon_outfile="${HADOOP_LOG_DIR}/hadoop-${HADOOP_IDENT_STRING}-${COMMAND}-${HOSTNAME}.out" daemon_pidfile="${HADOOP_PID_DIR}/hadoop-${HADOOP_IDENT_STRING}-${COMMAND}.pid" http://git-wip-us.apache.org/repos/asf/hadoop/blob/c5361426/hadoop-yarn-project/hadoop-yarn/bin/yarn ---------------------------------------------------------------------- diff --git a/hadoop-yarn-project/hadoop-yarn/bin/yarn b/hadoop-yarn-project/hadoop-yarn/bin/yarn index 760d8e6..ab9f7dd 100644 --- a/hadoop-yarn-project/hadoop-yarn/bin/yarn +++ b/hadoop-yarn-project/hadoop-yarn/bin/yarn @@ -184,6 +184,8 @@ case "${COMMAND}" in ;; esac +hadoop_verify_user "${COMMAND}" + # set HADOOP_OPTS to YARN_OPTS so that we can use # finalize, etc, without doing anything funky hadoop_debug "Resetting HADOOP_OPTS=YARN_OPTS"