Uploaded image for project: 'Hadoop HDFS'
  1. Hadoop HDFS
  2. HDFS-11053

Unnecessary superuser check in versionRequest()

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.7.4, 3.0.0-alpha2
    • Component/s: namenode, security
    • Labels:
      None
    • Target Version/s:
    • Hadoop Flags:
      Reviewed

      Description

      The versionRequest() call does not return any sensitive information. It is mainly used for sanity checks. The presence of checkSuperuserPrivilege() forces users to run datanode as a hdfs superuser.

      In secure setup, a keytab obtained from a compromised datanode can allow the intruder to gain hdfs superuser privilege. We should allow datanodes to be run as non-hdfs-superuser by removing checkSuperuserPrivilege() from versionRequest().

        Issue Links

          Activity

          Hide
          hudson Hudson added a comment -

          SUCCESS: Integrated in Jenkins build Hadoop-trunk-Commit #10686 (See https://builds.apache.org/job/Hadoop-trunk-Commit/10686/)
          HDFS-11053. Unnecessary superuser check in versionRequest(). Contributed (kihwal: rev e90af4a89ba2741aeca20ead47699587b14f0de8)

          • (edit) hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/NameNodeRpcServer.java
          Show
          hudson Hudson added a comment - SUCCESS: Integrated in Jenkins build Hadoop-trunk-Commit #10686 (See https://builds.apache.org/job/Hadoop-trunk-Commit/10686/ ) HDFS-11053 . Unnecessary superuser check in versionRequest(). Contributed (kihwal: rev e90af4a89ba2741aeca20ead47699587b14f0de8) (edit) hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/NameNodeRpcServer.java
          Hide
          kihwal Kihwal Lee added a comment -

          Thanks for the reviews. I've committed it to trunk through branch-2.7.

          Show
          kihwal Kihwal Lee added a comment - Thanks for the reviews. I've committed it to trunk through branch-2.7.
          Hide
          brahmareddy Brahma Reddy Battula added a comment -

          Nice Catch,me too +1.

          Show
          brahmareddy Brahma Reddy Battula added a comment - Nice Catch,me too +1.
          Hide
          daryn Daryn Sharp added a comment -

          +1 Good change for secure setups. I checked the jira that added the line and it appeared to just be a blanket change to a protocol interface, not necessarily intended.

          Show
          daryn Daryn Sharp added a comment - +1 Good change for secure setups. I checked the jira that added the line and it appeared to just be a blanket change to a protocol interface, not necessarily intended.
          Hide
          kihwal Kihwal Lee added a comment -

          Ran three times. They all pass.

          -------------------------------------------------------
           T E S T S
          -------------------------------------------------------
          Running org.apache.hadoop.hdfs.server.datanode.TestHSync
          Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 14.18 sec - in org.apache.hadoop.hdfs.server.datanode.TestHSync
          Running org.apache.hadoop.hdfs.server.datanode.TestBlockScanner
          Tests run: 13, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 62.069 sec - in org.apache.hadoop.hdfs.server.datanode.TestBlockScanner
          Running org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestSpaceReservation
          Tests run: 10, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 90.937 sec - in org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestSpaceReservation
          Running org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestLazyWriter
          Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 112.881 sec - in org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestLazyWriter
          Running org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestWriteToReplica
          Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 12.629 sec - in org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestWriteToReplica
          Running org.apache.hadoop.hdfs.server.datanode.TestDataNodeErasureCodingMetrics
          Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 12.712 sec - in org.apache.hadoop.hdfs.server.datanode.TestDataNodeErasureCodingMetrics
          Running org.apache.hadoop.hdfs.server.namenode.TestAddStripedBlockInFBR
          Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.412 sec - in org.apache.hadoop.hdfs.server.namenode.TestAddStripedBlockInFBR
          Running org.apache.hadoop.cli.TestAclCLIWithPosixAclInheritance
          Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 5.635 sec - in org.apache.hadoop.cli.TestAclCLIWithPosixAclInheritance
          
          Results :
          
          Tests run: 44, Failures: 0, Errors: 0, Skipped: 0
          
          Show
          kihwal Kihwal Lee added a comment - Ran three times. They all pass. ------------------------------------------------------- T E S T S ------------------------------------------------------- Running org.apache.hadoop.hdfs.server.datanode.TestHSync Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 14.18 sec - in org.apache.hadoop.hdfs.server.datanode.TestHSync Running org.apache.hadoop.hdfs.server.datanode.TestBlockScanner Tests run: 13, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 62.069 sec - in org.apache.hadoop.hdfs.server.datanode.TestBlockScanner Running org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestSpaceReservation Tests run: 10, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 90.937 sec - in org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestSpaceReservation Running org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestLazyWriter Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 112.881 sec - in org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestLazyWriter Running org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestWriteToReplica Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 12.629 sec - in org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestWriteToReplica Running org.apache.hadoop.hdfs.server.datanode.TestDataNodeErasureCodingMetrics Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 12.712 sec - in org.apache.hadoop.hdfs.server.datanode.TestDataNodeErasureCodingMetrics Running org.apache.hadoop.hdfs.server.namenode.TestAddStripedBlockInFBR Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 8.412 sec - in org.apache.hadoop.hdfs.server.namenode.TestAddStripedBlockInFBR Running org.apache.hadoop.cli.TestAclCLIWithPosixAclInheritance Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 5.635 sec - in org.apache.hadoop.cli.TestAclCLIWithPosixAclInheritance Results : Tests run: 44, Failures: 0, Errors: 0, Skipped: 0
          Hide
          hadoopqa Hadoop QA added a comment -
          -1 overall



          Vote Subsystem Runtime Comment
          0 reexec 0m 14s Docker mode activated.
          +1 @author 0m 0s The patch does not contain any @author tags.
          -1 test4tests 0m 0s The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
          +1 mvninstall 6m 58s trunk passed
          +1 compile 0m 44s trunk passed
          +1 checkstyle 0m 26s trunk passed
          +1 mvnsite 0m 52s trunk passed
          +1 mvneclipse 0m 12s trunk passed
          +1 findbugs 1m 41s trunk passed
          +1 javadoc 0m 37s trunk passed
          +1 mvninstall 0m 43s the patch passed
          +1 compile 0m 41s the patch passed
          +1 javac 0m 41s the patch passed
          +1 checkstyle 0m 23s the patch passed
          +1 mvnsite 0m 48s the patch passed
          +1 mvneclipse 0m 9s the patch passed
          +1 whitespace 0m 0s The patch has no whitespace issues.
          +1 findbugs 1m 47s the patch passed
          +1 javadoc 0m 35s the patch passed
          -1 unit 48m 23s hadoop-hdfs in the patch failed.
          +1 asflicense 0m 20s The patch does not generate ASF License warnings.
          66m 42s



          Reason Tests
          Failed junit tests hadoop.hdfs.server.namenode.TestAddStripedBlockInFBR
          Timed out junit tests org.apache.hadoop.hdfs.server.datanode.TestHSync
            org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestLazyWriter
            org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestWriteToReplica
            org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestSpaceReservation
            org.apache.hadoop.hdfs.server.datanode.TestBlockScanner
            org.apache.hadoop.hdfs.server.datanode.TestDataNodeErasureCodingMetrics
            org.apache.hadoop.cli.TestAclCLIWithPosixAclInheritance



          Subsystem Report/Notes
          Docker Image:yetus/hadoop:9560f25
          JIRA Issue HDFS-11053
          JIRA Patch URL https://issues.apache.org/jira/secure/attachment/12835197/HDFS-11053.patch
          Optional Tests asflicense compile javac javadoc mvninstall mvnsite unit findbugs checkstyle
          uname Linux d876a6677491 3.13.0-92-generic #139-Ubuntu SMP Tue Jun 28 20:42:26 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
          Build tool maven
          Personality /testptch/hadoop/patchprocess/precommit/personality/provided.sh
          git revision trunk / de6faae
          Default Java 1.8.0_101
          findbugs v3.0.0
          unit https://builds.apache.org/job/PreCommit-HDFS-Build/17280/artifact/patchprocess/patch-unit-hadoop-hdfs-project_hadoop-hdfs.txt
          Test Results https://builds.apache.org/job/PreCommit-HDFS-Build/17280/testReport/
          modules C: hadoop-hdfs-project/hadoop-hdfs U: hadoop-hdfs-project/hadoop-hdfs
          Console output https://builds.apache.org/job/PreCommit-HDFS-Build/17280/console
          Powered by Apache Yetus 0.4.0-SNAPSHOT http://yetus.apache.org

          This message was automatically generated.

          Show
          hadoopqa Hadoop QA added a comment - -1 overall Vote Subsystem Runtime Comment 0 reexec 0m 14s Docker mode activated. +1 @author 0m 0s The patch does not contain any @author tags. -1 test4tests 0m 0s The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch. +1 mvninstall 6m 58s trunk passed +1 compile 0m 44s trunk passed +1 checkstyle 0m 26s trunk passed +1 mvnsite 0m 52s trunk passed +1 mvneclipse 0m 12s trunk passed +1 findbugs 1m 41s trunk passed +1 javadoc 0m 37s trunk passed +1 mvninstall 0m 43s the patch passed +1 compile 0m 41s the patch passed +1 javac 0m 41s the patch passed +1 checkstyle 0m 23s the patch passed +1 mvnsite 0m 48s the patch passed +1 mvneclipse 0m 9s the patch passed +1 whitespace 0m 0s The patch has no whitespace issues. +1 findbugs 1m 47s the patch passed +1 javadoc 0m 35s the patch passed -1 unit 48m 23s hadoop-hdfs in the patch failed. +1 asflicense 0m 20s The patch does not generate ASF License warnings. 66m 42s Reason Tests Failed junit tests hadoop.hdfs.server.namenode.TestAddStripedBlockInFBR Timed out junit tests org.apache.hadoop.hdfs.server.datanode.TestHSync   org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestLazyWriter   org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestWriteToReplica   org.apache.hadoop.hdfs.server.datanode.fsdataset.impl.TestSpaceReservation   org.apache.hadoop.hdfs.server.datanode.TestBlockScanner   org.apache.hadoop.hdfs.server.datanode.TestDataNodeErasureCodingMetrics   org.apache.hadoop.cli.TestAclCLIWithPosixAclInheritance Subsystem Report/Notes Docker Image:yetus/hadoop:9560f25 JIRA Issue HDFS-11053 JIRA Patch URL https://issues.apache.org/jira/secure/attachment/12835197/HDFS-11053.patch Optional Tests asflicense compile javac javadoc mvninstall mvnsite unit findbugs checkstyle uname Linux d876a6677491 3.13.0-92-generic #139-Ubuntu SMP Tue Jun 28 20:42:26 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux Build tool maven Personality /testptch/hadoop/patchprocess/precommit/personality/provided.sh git revision trunk / de6faae Default Java 1.8.0_101 findbugs v3.0.0 unit https://builds.apache.org/job/PreCommit-HDFS-Build/17280/artifact/patchprocess/patch-unit-hadoop-hdfs-project_hadoop-hdfs.txt Test Results https://builds.apache.org/job/PreCommit-HDFS-Build/17280/testReport/ modules C: hadoop-hdfs-project/hadoop-hdfs U: hadoop-hdfs-project/hadoop-hdfs Console output https://builds.apache.org/job/PreCommit-HDFS-Build/17280/console Powered by Apache Yetus 0.4.0-SNAPSHOT http://yetus.apache.org This message was automatically generated.
          Hide
          kihwal Kihwal Lee added a comment - - edited

          The check was added in the process of fixing HDFS-2264.
          The datanode user is restricted by "dfs.datanode.kerberos.principal" on connection.

          Show
          kihwal Kihwal Lee added a comment - - edited The check was added in the process of fixing HDFS-2264 . The datanode user is restricted by "dfs.datanode.kerberos.principal" on connection.

            People

            • Assignee:
              kihwal Kihwal Lee
              Reporter:
              kihwal Kihwal Lee
            • Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development