org.apache.hadoop.hdfs.server.namenode

Interface INodeAttributeProvider.AccessControlEnforcer

Enclosing class:

INodeAttributeProvider

public static interface INodeAttributeProvider.AccessControlEnforcer

The AccessControlEnforcer allows implementations to override the default File System permission checking logic enforced on a file system object

Method Summary

Methods

Modifier and Type

Method and Description

void

checkPermission(String fsOwner, String supergroup, org.apache.hadoop.security.UserGroupInformation callerUgi, org.apache.hadoop.hdfs.server.namenode.INodeAttributes[] inodeAttrs, org.apache.hadoop.hdfs.server.namenode.INode[] inodes, byte[][] pathByNameArr, int snapshotId, String path, int ancestorIndex, boolean doCheckOwner, org.apache.hadoop.fs.permission.FsAction ancestorAccess, org.apache.hadoop.fs.permission.FsAction parentAccess, org.apache.hadoop.fs.permission.FsAction access, org.apache.hadoop.fs.permission.FsAction subAccess, boolean ignoreEmptyDir) Checks permission on a file system object.

Method Detail

checkPermission

void checkPermission(String fsOwner,
                   String supergroup,
                   org.apache.hadoop.security.UserGroupInformation callerUgi,
                   org.apache.hadoop.hdfs.server.namenode.INodeAttributes[] inodeAttrs,
                   org.apache.hadoop.hdfs.server.namenode.INode[] inodes,
                   byte[][] pathByNameArr,
                   int snapshotId,
                   String path,
                   int ancestorIndex,
                   boolean doCheckOwner,
                   org.apache.hadoop.fs.permission.FsAction ancestorAccess,
                   org.apache.hadoop.fs.permission.FsAction parentAccess,
                   org.apache.hadoop.fs.permission.FsAction access,
                   org.apache.hadoop.fs.permission.FsAction subAccess,
                   boolean ignoreEmptyDir)
                     throws org.apache.hadoop.security.AccessControlException

Checks permission on a file system object. Has to throw an Exception if the filesystem object is not accessessible by the calling Ugi.

Parameters:

fsOwner - Filesystem owner (The Namenode user)

supergroup - super user geoup

callerUgi - UserGroupInformation of the caller

inodeAttrs - Array of INode attributes for each path element in the the path

inodes - Array of INodes for each path element in the path

pathByNameArr - Array of byte arrays of the LocalName

snapshotId - the snapshotId of the requested path

path - Path String

ancestorIndex - Index of ancestor

doCheckOwner - perform ownership check

ancestorAccess - The access required by the ancestor of the path.

parentAccess - The access required by the parent of the path.

access - The access required by the path.

subAccess - If path is a directory, It is the access required of the path and all the sub-directories. If path is not a directory, there should ideally be no effect.

ignoreEmptyDir - Ignore permission checking for empty directory?

Throws:

org.apache.hadoop.security.AccessControlException