Mailing-List: contact hdfs-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Date: Fri, 8 Dec 2017 01:11:00 +0000 (UTC)
From: "Rushabh S Shah (JIRA)" <jira@apache.org>
To: hdfs-issues@hadoop.apache.org
Message-ID: <JIRA.13123327.1512601562000.414215.1512695460189@Atlassian.JIRA>
In-Reply-To: <JIRA.13123327.1512601562000@Atlassian.JIRA>
References: <JIRA.13123327.1512601562000@Atlassian.JIRA> <JIRA.13123327.1512601562833@jira-lw-us.apache.org>
Subject: [jira] [Comment Edited] (HDFS-12907) Allow read-only access to
 reserved raw for non-superusers
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 08 Dec 2017 03:07:16 -0000


    [ https://issues.apache.org/jira/browse/HDFS-12907?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16282860#comment-16282860 ] 

Rushabh S Shah edited comment on HDFS-12907 at 12/8/17 1:10 AM:
----------------------------------------------------------------

Following are the tests that failed.
{noformat}
TestUnbuffer
TestJournalNodeSync
TestDataNodeVolumeFailureReporting
TestNameNodeXAttr
TestWebHDFSXAttr
TestFileContextXAttr
{noformat}

Last 3 tests {{TestNameNodeXAttr,TestWebHDFSXAttr,TestFileContextXAttr}} are failed by my patch.
Remaining are just flaky tests.
{{TestUnbuffer}} -- Tracked by HADOOP-15056. This jira is almost closed to being resolved.
Remaining 2 tests passed locally.
{noformat}
[INFO] Running org.apache.hadoop.hdfs.qjournal.server.TestJournalNodeSync
[INFO] Tests run: 10, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 52.376 s - in org.apache.hadoop.hdfs.qjournal.server.TestJournalNodeSync
[INFO] Running org.apache.hadoop.hdfs.server.datanode.TestDataNodeVolumeFailureReporting
[INFO] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 86.746 s - in org.apache.hadoop.hdfs.server.datanode.TestDataNodeVolumeFailureReporting
{noformat}
Will attach a new patch soon which fixes the 3 test failures.


Regarding the findbugs warning, it is not related to my patch.


was (Author: shahrs87):
Following are the tests that failed.
{noformat}
TestUnbuffer
TestJournalNodeSync
TestDataNodeVolumeFailureReporting
TestNameNodeXAttr
TestWebHDFSXAttr
TestFileContextXAttr
{noformat}

Last 3 tests {{TestNameNodeXAttr,TestWebHDFSXAttr,TestFileContextXAttr}} are failed by my patch.
Remaining are just flaky tests.
{{TestUnbuffer}} -- Tracked by HADOOP-15056. This jira is almost closed to being resolved.
Remaining 2 tests passed locally.
{noformat}
[INFO] Running org.apache.hadoop.hdfs.qjournal.server.TestJournalNodeSync
[INFO] Tests run: 10, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 52.376 s - in org.apache.hadoop.hdfs.qjournal.server.TestJournalNodeSync
[INFO] Running org.apache.hadoop.hdfs.server.datanode.TestDataNodeVolumeFailureReporting
[INFO] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 86.746 s - in org.apache.hadoop.hdfs.server.datanode.TestDataNodeVolumeFailureReporting
{noformat}
Will attach a new patch soon which fixes the 3 test failures.


> Allow read-only access to reserved raw for non-superusers
> ---------------------------------------------------------
>
>                 Key: HDFS-12907
>                 URL: https://issues.apache.org/jira/browse/HDFS-12907
>             Project: Hadoop HDFS
>          Issue Type: Bug
>          Components: namenode
>    Affects Versions: 2.6.0
>            Reporter: Daryn Sharp
>            Assignee: Rushabh S Shah
>         Attachments: HDFS-12907.001.patch, HDFS-12907.patch
>
>
> HDFS-6509 added a special /.reserved/raw path prefix to access the raw file contents of EZ files.  In the simplest sense it doesn't return the FE info in the {{LocatedBlocks}} so the dfs client doesn't try to decrypt the data.  This facilitates allowing tools like distcp to copy raw bytes.
> Access to the raw hierarchy is restricted to superusers.  This seems like an overly broad restriction designed to prevent non-admins from munging the EZ related xattrs.  I believe we should relax the restriction to allow non-admins to perform read-only operations.  Allowing non-superusers to easily read the raw bytes will be extremely useful for regular users, esp. for enabling webhdfs client-side encryption.


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-help@hadoop.apache.org