TestMiniMRWithDFSWithDistinctUsers.mkdir(fs, "/user");
TestMiniMRWithDFSWithDistinctUsers.mkdir(fs, "/mapred");
TestMiniMRWithDFSWithDistinctUsers.mkdir(fs,
conf.get("mapreduce.jobtracker.staging.root.dir",
"/tmp/hadoop/mapred/staging"));
UserGroupInformation MR_UGI = UserGroupInformation.getLoginUser();
mr = new MiniMRCluster(0, 0, 1, dfs.getFileSystem().getUri().toString(),
1, null, null, MR_UGI);
JobTracker jt = mr.getJobTrackerRunner().getJobTracker();
String jobTrackerName = "localhost:" + mr.getJobTrackerPort();
// cleanup
dfs.getFileSystem().delete(TEST_DIR, true);
final Path mapSignalFile = new Path(TEST_DIR, "map-signal");
final Path reduceSignalFile = new Path(TEST_DIR, "reduce-signal");
// create a ugi for user 1
UserGroupInformation user1 =
TestMiniMRWithDFSWithDistinctUsers.createUGI("user1", false);
Path inDir = new Path("/user/input");
Path outDir = new Path("/user/output");
final JobConf job = mr.createJobConf();
UtilsForTests.configureWaitingJobConf(job, inDir, outDir, 2, 0,
"test-submit-job", mapSignalFile.toString(),
reduceSignalFile.toString());
job.set(UtilsForTests.getTaskSignalParameter(true),
mapSignalFile.toString());
job.set(UtilsForTests.getTaskSignalParameter(false),
reduceSignalFile.toString());
LOG.info("Submit job as the actual user (" + user1.getUserName() + ")");
final JobClient jClient =
user1.doAs(new PrivilegedExceptionAction<JobClient>() {
public JobClient run() throws IOException {
return new JobClient(job);
}
});
RunningJob rJob = user1.doAs(new PrivilegedExceptionAction<RunningJob>() {
public RunningJob run() throws IOException {
return jClient.submitJob(job);
}
});
JobID id = rJob.getID();
LOG.info("Running job " + id);
// create user2
UserGroupInformation user2 =
TestMiniMRWithDFSWithDistinctUsers.createUGI("user2", false);
JobConf conf_other = mr.createJobConf();
org.apache.hadoop.hdfs.protocol.ClientProtocol client =
getDFSClient(conf_other, user2);
// try accessing mapred.system.dir/jobid/*
try {
String path = new URI(jt.getSystemDir()).getPath();
LOG.info("Try listing the mapred-system-dir as the user ("
+ user2.getUserName() + ")");
client.getListing(path, HdfsFileStatus.EMPTY_NAME);
fail("JobTracker system dir is accessible to others");
} catch (IOException ioe) {
assertTrue(ioe.toString(),
ioe.toString().contains("Permission denied"));
}
// try accessing ~/.staging/jobid/*
JobInProgress jip = jt.getJob(id);
Path jobSubmitDirpath =
new Path(jip.getJobConf().get("mapreduce.job.dir"));
try {
LOG.info("Try accessing the job folder for job " + id + " as the user ("
+ user2.getUserName() + ")");
client.getListing(jobSubmitDirpath.toUri().getPath(), HdfsFileStatus.EMPTY_NAME);
fail("User's staging folder is accessible to others");
} catch (IOException ioe) {
assertTrue(ioe.toString(),
ioe.toString().contains("Permission denied"));