Hadoop HDFS
  1. Hadoop HDFS
  2. HDFS-3608

fuse_dfs: detect changes in UID ticket cache

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Minor Minor
    • Resolution: Fixed
    • Affects Version/s: 2.0.0-alpha
    • Fix Version/s: 2.0.2-alpha
    • Component/s: None
    • Labels:
      None

      Description

      Currently in fuse_dfs, if one kinits as some principal "foo" and then does some operation on fuse_dfs, then kdestroy and kinit as some principal "bar", subsequent operations done via fuse_dfs will still use cached credentials for "foo". The reason for this is that fuse_dfs caches Filesystem instances using the UID of the user running the command as the key into the cache. This is a very uncommon scenario, since it's pretty uncommon for a single user to want to use credentials for several different principals on the same box.

      However, we can use inotify to detect changes in the Kerberos ticket cache file and force the next operation to create a new FileSystem instance in that case. This will also require a reference counting mechanism in fuse_dfs so that we can free the FileSystem classes when they refer to previous Kerberos ticket caches.

      Another mechanism is to run a stat periodically on the ticket cache file. This is a good fallback mechanism if inotify does not work on the file (for example, because it's on an NFS mount.)

      1. HDFS-3608.004.patch
        93 kB
        Colin Patrick McCabe
      2. HDFS-3608.006.patch
        94 kB
        Colin Patrick McCabe
      3. HDFS-3608.007.patch
        95 kB
        Colin Patrick McCabe
      4. HDFS-3608.008.patch
        81 kB
        Colin Patrick McCabe
      5. HDFS-3608.009.patch
        89 kB
        Colin Patrick McCabe
      6. HDFS-3608.010.patch
        89 kB
        Colin Patrick McCabe
      7. HDFS-3608.011.patch
        90 kB
        Colin Patrick McCabe
      8. HDFS-3608.patch
        90 kB
        Aaron T. Myers

        Issue Links

          Activity

          Colin Patrick McCabe created issue -
          Colin Patrick McCabe made changes -
          Field Original Value New Value
          Issue Type Improvement [ 4 ] Bug [ 1 ]
          Affects Version/s 2.0.1-alpha [ 12321440 ]
          Target Version/s 2.0.1-alpha [ 12321440 ]
          Colin Patrick McCabe made changes -
          Link This issue relates to HDFS-3568 [ HDFS-3568 ]
          Colin Patrick McCabe made changes -
          Summary fuse_dfs: use inotify to detect changes in UID ticket cache fuse_dfs: detect changes in UID ticket cache
          Description Currently in fuse_dfs, if one kinits as some principal "foo" and then does some operation on fuse_dfs, then kdestroy and kinit as some principal "bar", subsequent operations done via fuse_dfs will still use cached credentials for "foo". The reason for this is that fuse_dfs caches Filesystem instances using the UID of the user running the command as the key into the cache. This is a very uncommon scenario, since it's pretty uncommon for a single user to want to use credentials for several different principals on the same box.

          However, we can use inotify to detect changes in the Kerberos ticket cache file and force the next operation to create a new FileSystem instance in that case. This will also require a reference counting mechanism in fuse_dfs so that we can free the FileSystem classes when they refer to previous Kerberos ticket caches.
          Currently in fuse_dfs, if one kinits as some principal "foo" and then does some operation on fuse_dfs, then kdestroy and kinit as some principal "bar", subsequent operations done via fuse_dfs will still use cached credentials for "foo". The reason for this is that fuse_dfs caches Filesystem instances using the UID of the user running the command as the key into the cache. This is a very uncommon scenario, since it's pretty uncommon for a single user to want to use credentials for several different principals on the same box.

          However, we can use inotify to detect changes in the Kerberos ticket cache file and force the next operation to create a new FileSystem instance in that case. This will also require a reference counting mechanism in fuse_dfs so that we can free the FileSystem classes when they refer to previous Kerberos ticket caches.

          Another mechanism is to run a stat periodically on the ticket cache file. This is a good fallback mechanism if inotify does not work on the file (for example, because it's on an NFS mount.)
          Colin Patrick McCabe made changes -
          Attachment HDFS-3608.004.patch [ 12536867 ]
          Colin Patrick McCabe made changes -
          Status Open [ 1 ] Patch Available [ 10002 ]
          Colin Patrick McCabe made changes -
          Attachment HDFS-3608.006.patch [ 12536906 ]
          Colin Patrick McCabe made changes -
          Link This issue is related to HDFS-3676 [ HDFS-3676 ]
          Colin Patrick McCabe made changes -
          Attachment HDFS-3608.007.patch [ 12537087 ]
          Colin Patrick McCabe made changes -
          Attachment HDFS-3608.008.patch [ 12537104 ]
          Colin Patrick McCabe made changes -
          Attachment HDFS-3608.009.patch [ 12537261 ]
          Colin Patrick McCabe made changes -
          Attachment HDFS-3608.009.patch [ 12537261 ]
          Colin Patrick McCabe made changes -
          Attachment HDFS-3608.009.patch [ 12537263 ]
          Colin Patrick McCabe made changes -
          Attachment HDFS-3608.010.patch [ 12537266 ]
          Colin Patrick McCabe made changes -
          Attachment HDFS-3608.011.patch [ 12537275 ]
          Aaron T. Myers made changes -
          Attachment HDFS-3608.patch [ 12537389 ]
          Aaron T. Myers made changes -
          Target Version/s 2.1.0-alpha [ 12321440 ] 2.2.0-alpha [ 12322472 ]
          Aaron T. Myers made changes -
          Status Patch Available [ 10002 ] Resolved [ 5 ]
          Hadoop Flags Reviewed [ 10343 ]
          Fix Version/s 2.2.0-alpha [ 12322472 ]
          Resolution Fixed [ 1 ]
          Arun C Murthy made changes -
          Affects Version/s 2.0.0-alpha [ 12320353 ]
          Affects Version/s 2.1.0-alpha [ 12321440 ]
          Arun C Murthy made changes -
          Status Resolved [ 5 ] Closed [ 6 ]

            People

            • Assignee:
              Colin Patrick McCabe
              Reporter:
              Colin Patrick McCabe
            • Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development