[IMPALA-3143] False warning on Impala permission check if Impala belongs to supergroup

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Impala 2.3.0, Impala 2.5.0
• Fix Version/s: Impala 2.6.0
• Component/s: Frontend
• Labels: ramp-up security supportability
• Target Version: Impala 2.6.0
• Assignee: Dimitris Tsirogiannis
• Reporter: Juan Yu
• Created: 04/Mar/16 19:29
• Updated: 24/May/16 03:37
• Resolved: 24/May/16 03:37

Description

Impala hdfs permission check doesn't consider supergroup and gives false warning that Impala doesn't have READ_WRITE permission.

[alanj@lannister-002 ~]$ groups impala
impala : impala hadoop hdfs hive cops supergroup

[westeros.edh.cloudera.com:21000] > create database u_alanj_test location '/user/alanj/TestDB';
Query: create database u_alanj_test location '/user/alanj/TestDB'

WARNINGS: Impala does not have READ_WRITE access to path 'hdfs://nameservice1/user/alanj'
Fetched 0 row(s) in 4.62s

Query: create table u_alanj_test.test_conversion stored as parquet as select * from sfdc.datedconversionrate
----------------------

summary

----------------------

Inserted 3572 row(s)

----------------------
Fetched 1 row(s) in 11.42s

And the data was in the HDFS path it said it couldn't write:
-sh-4.1$ hadoop fs -ls -R /user/alanj/TestDB
drwxr-xr-x - impala alanj 0 2016-02-19 16:14 /user/alanj/TestDB/test_conversion
rw-rr- 3 impala alanj 101347 2016-02-19 16:14 /user/alanj/TestDB/test_conversion/7e4845ddffcab2b4-2447e943b950caa9_2071610925_data.0.parq
drwxr-xr-x - impala alanj 0 2016-02-19 16:14 /user/alanj/TestDB/test_conversion/_impala_insert_staging

  private FsPermissionChecker() throws IOException {
    UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
    groups_.addAll(Arrays.asList(ugi.getGroupNames()));
    // Todo: should add HDFS supergroup as well
    user_ = ugi.getShortUserName();
  }