[HADOOP-8225] DistCp fails when invoked by Oozie

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 0.23.1, 2.0.0-alpha, 3.0.0-alpha1
• Fix Version/s: 0.23.3, 2.0.2-alpha
• Component/s: security
• Target Version/s: 0.23.3, 2.0.2-alpha
• Assignee: Daryn Sharp
• Reporter: Mithun Radhakrishnan
• Created: 13/Mar/12 20:33
• Updated: 12/May/16 18:21
• Resolved: 23/Aug/12 18:11

Description

When DistCp is invoked through a proxy-user (e.g. through Oozie), the delegation-token-store isn't picked up by DistCp correctly. One sees failures such as:

ERROR [main] org.apache.hadoop.tools.DistCp: Couldn't complete DistCp
operation:
java.lang.SecurityException: Intercepted System.exit(-999)
at
org.apache.oozie.action.hadoop.LauncherSecurityManager.checkExit(LauncherMapper.java:651)
at java.lang.Runtime.exit(Runtime.java:88)
at java.lang.System.exit(System.java:904)
at org.apache.hadoop.tools.DistCp.main(DistCp.java:357)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at
org.apache.oozie.action.hadoop.LauncherMapper.map(LauncherMapper.java:394)
at org.apache.hadoop.mapred.MapRunner.run(MapRunner.java:54)
at org.apache.hadoop.mapred.MapTask.runOldMapper(MapTask.java:399)
at org.apache.hadoop.mapred.MapTask.run(MapTask.java:334)
at org.apache.hadoop.mapred.YarnChild$2.run(YarnChild.java:147)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:396)
at
org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1177)
at org.apache.hadoop.mapred.YarnChild.main(YarnChild.java:142)

Looking over the DistCp code, one sees that HADOOP_TOKEN_FILE_LOCATION isn't being copied to mapreduce.job.credentials.binary, in the job-conf. I'll post a patch for this shortly.

Issue Links

• breaks: HADOOP-8725 MR is broken when security is off
• breaks: HADOOP-8726 The Secrets in Credentials are not available to MR tasks
• breaks: HDFS-3852 TestHftpDelegationToken is broken after HADOOP-8225