[IMPALA-11027] Support for ShellBasedUnixGroupMapping for Impala's user delegation via groups

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Impala 4.1.0
• Epic Color: ghx-label-1
• Assignee: Amogh Margoor
• Reporter: Amogh Margoor
• Created: 18/Nov/21 15:33
• Updated: 03/Dec/21 05:33
• Resolved: 24/Nov/21 12:17

Description

When impala.doAs.user is set for user delegation, Impala checks if the delegation is allowed or not based on either of the following:

1. user mapping: Specified using 

   authorized_proxy_user_config

1. groups mapping:  Specified using. authorized_proxy_group_config
    

 

For checking group mapping currently JNIBasedUnixGroupMapping is supported and not ShellBasedUnixGroupMapping. Ref: https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-common/GroupsMapping.html

This was done because of caveats that ShellBasedUnixGroupMapping spawns a new shell command to figure out groups for 'impala.doAs.user' when group mapping is specified. Many numerous shell commands could potentially cause issues like resource crunch, file descriptor issues and also zombie processes. Hence it is discouraged. However, we should support it for users that understand these caveats well and still want to use it. One reason could be that other components of impala might not have moved to JNI based group mapping and still be using Shell based.

Regarding caveats few things help:

1. Chances are zombie process are very low.
2. Due to vfork being used we do not see too much of resource consumption during process spawning. On memory it takes around 8KB and duration of process is around 16-17ms.
3. immediate exec after vfork would ensure other resources that might get cloned via vfork are present for very short duration.