Uploaded image for project: 'Ambari'
  1. Ambari
  2. AMBARI-9279

MapReduce2 Service Check fails after enabling Kerberos with permission issue in local filesystem

    XMLWordPrintableJSON

    Details

      Description

      After enabling Kerberos MapReduce2 Service Check failed with issue writing to local file system:

      Init:
      drwxrwxr-x 5 yarn hadoop 4096 Jan 22 00:01 /hadoop/yarn/local
      drwxr-xr-x 3 yarn hadoop 4096 Jan 22 00:00 /hadoop/yarn/local/usercache
      drwxr-x--- 4 yarn hadoop 4096 Jan 22 00:00 /hadoop/yarn/local/usercache/ambari-qa
      drwx--x--- 2 yarn hadoop 4096 Jan 22 00:01 /hadoop/yarn/local/usercache/ambari-qa/appcache
      
      Kerb:
      drwxrwxr-x 5 yarn hadoop 4096 Jan 22 01:23 /hadoop/yarn/local
      drwxr-xr-x 3 yarn hadoop 4096 Jan 22 00:00 /hadoop/yarn/local/usercache
      drwxr-s--- 4 ambari-qa hadoop 4096 Jan 22 00:00 /hadoop/yarn/local/usercache/ambari-qa
      drwx--x--- 2 yarn hadoop 4096 Jan 22 00:01 /hadoop/yarn/local/usercache/ambari-qa/appcache
      
      Can't create directory /hadoop/yarn/local/usercache/ambari-qa/appcache/application_1421889721625_0001 - Permission denied
      main : user is ambari-qa
      main : requested yarn user is ambari-qa
      

      The service check does not fail when run before enabling Kerberos.

      Filesystem BEFORE enabling Kerberos
      drwxrwxr-x 5 yarn hadoop 4096 Jan 22 00:01 /hadoop/yarn/local
      drwxr-xr-x 3 yarn hadoop 4096 Jan 22 00:00 /hadoop/yarn/local/usercache
      drwxr-x--- 4 yarn hadoop 4096 Jan 22 00:00 /hadoop/yarn/local/usercache/ambari-qa
      drwx--x--- 2 yarn hadoop 4096 Jan 22 00:01 /hadoop/yarn/local/usercache/ambari-qa/appcache
      
      Filesystem AFTER enabling Kerberos
      drwxrwxr-x 5 yarn hadoop 4096 Jan 22 01:23 /hadoop/yarn/local
      drwxr-xr-x 3 yarn hadoop 4096 Jan 22 00:00 /hadoop/yarn/local/usercache
      drwxr-s--- 4 ambari-qa hadoop 4096 Jan 22 00:00 /hadoop/yarn/local/usercache/ambari-qa
      drwx--x--- 2 yarn hadoop 4096 Jan 22 00:01 /hadoop/yarn/local/usercache/ambari-qa/appcache
      

      It appears that the user executing the task is ambari-qa after enabling Kerberos, there is no indication what user is executing the task before enabling Kerberos.

        Attachments

        1. AMBARI-9279_01.patch
          2 kB
          Robert Levas

          Issue Links

            Activity

              People

              • Assignee:
                rlevas Robert Levas
                Reporter:
                rlevas Robert Levas
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: