[HDFS-10673] Optimize FSPermissionChecker's internal path usage

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8.0, 2.7.4, 3.0.0-alpha1
• Component/s: hdfs
• Target Version/s: 2.9.0, 2.7.6
• Hadoop Flags: Reviewed
• Assignee: Daryn Sharp
• Reporter: Daryn Sharp
• Created: 21/Jul/16 19:15
• Updated: 05/Jan/18 18:27
• Resolved: 12/Sep/16 23:12

Description

The INodeAttributeProvider and AccessControlEnforcer features degrade performance and generate excessive garbage even when neither is used. Main issues:

1. A byte[][] of components is unnecessarily created. Each path component lookup converts a subrange of the byte[][] to a new String[] - then not used by default attribute provider.
2. Subaccess checks are insanely expensive. The full path of every subdir is created by walking up the inode tree, creating a INode[], building a string by converting each inode's byte[] name to a string, etc. Which will only be used if there's an exception.

The expensive of #1 should only be incurred when using the provider/enforcer feature. For #2, paths should be created on-demand for exceptions.

Issue Links

• is related to: HDFS-12614 FSPermissionChecker#getINodeAttrs() throws NPE when INodeAttributesProvider configured
• is related to: HDFS-6826 Plugin interface to enable delegation of HDFS authorization assertions
• is required by: HDFS-10711 Optimize FSPermissionChecker group membership check