[HDFS-4685] Implementation of ACLs in HDFS

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1.2
• Fix Version/s: 2.4.0
• Component/s: hdfs-client, namenode, security
• Target Version/s: 2.4.0
• Hadoop Flags: Reviewed
• Release Note: HDFS now supports ACLs (Access Control Lists). ACLs can specify fine-grained file permissions for specific named users or named groups.
• Assignee: Chris Nauroth
• Reporter: Sachin Jose
• Created: 11/Apr/13 09:44
• Updated: 12/Feb/15 17:12
• Resolved: 19/Mar/14 22:33

Description

Currenly hdfs doesn't support Extended file ACL. In unix extended ACL can be achieved using getfacl and setfacl utilities. Is there anybody working on this feature ?

Issue Links

• breaks: HDFS-6326 WebHdfs ACL compatibility is broken
• breaks: HADOOP-10354 TestWebHDFS fails after merge of HDFS-4685 to trunk
• incorporates: HADOOP-10184 Hadoop Common changes required to support HDFS ACLs.
• is duplicated by: HDFS-5117 Allow the owner of an HDFS path to be a group
• is related to: HDFS-5923 Do not persist the ACL bit in the FsPermission
• is related to: HDFS-5932 Ls should display the ACL bit
• is related to: HDFS-5933 Optimize the FSImage layout for ACLs
• is related to: HDFS-6962 ACL inheritance conflicts with umaskmode
• is related to: HDFS-5737 Replacing only the default ACL can fail to copy unspecified base entries from the access ACL.
• is related to: HDFS-5739 ACL RPC must allow null name or unspecified permissions in ACL entries.
• is related to: HDFS-5799 Make audit logging consistent across ACL APIs.
• is related to: HDFS-5849 Removing ACL from an inode fails if it has only a default ACL.
• is related to: HDFS-6711 FSNamesystem#getAclStatus does not write to the audit log.
• is related to: HDFS-6039 Uploading a File under a Dir with default acls throws "Duplicated ACLFeature"
• is related to: HDFS-6232 OfflineEditsViewer throws a NPE on edits containing ACL modifications
• is related to: HDFS-7456 De-duplicate AclFeature instances with same AclEntries do reduce memory footprint of NameNode
• is related to: HDFS-7218 FSNamesystem ACL operations should write to audit log on failure
• is related to: HDFS-6028 Print clearer error message when user attempts to delete required mask entry from ACL.
• is related to: HDFS-6128 Implement libhdfs bindings for HDFS ACL APIs.
• is related to: HDFS-5621 NameNode: add indicator in web UI file system browser if a file has an ACL.
• is related to: HDFS-5925 ACL configuration flag must only reject ACL API calls, not ACLs present in fsimage or edits.
• is related to: HDFS-5860 Refactor INodeDirectory getDirectoryXFeature methods to use common getFeature helper method.
• is related to: HDFS-7384 'getfacl' command and 'getAclStatus' output should be in sync
• is related to: MAPREDUCE-5809 Enhance distcp to support preserving HDFS ACLs.
• is related to: HDFS-5908 Change AclFeature to capture list of ACL entries in an ImmutableList.
• is related to: HDFS-6069 Quash stack traces when ACLs are disabled
• is related to: HDFS-5858 Refactor common ACL test cases to be run through multiple FileSystem implementations.
• is related to: HDFS-5937 Fix TestOfflineEditsViewer on HDFS-4685 branch.
• is related to: HDFS-5995 TestFSEditLogLoader#testValidateEditLogWithCorruptBody gets OutOfMemoryError and dumps heap.
• is related to: HDFS-5624 Add HDFS tests for ACLs in combination with viewfs.
• is related to: HDFS-6063 TestAclCLI fails intermittently when running test 24: copyFromLocal
• relates to: HDFS-5827 Children are not inheriting parent's default ACLs
• relates to: HADOOP-9671 Improve Hadoop security - Use cases, Threat Model and Problems