ACL On Group Level

@Mudassar Hussain

Prerequisite for question 1,2 and 3

I am assuming you are creating the ACL's from scratch, below are steps to prepare the groups and users

Create the 2 groups

# groupadd Marketing
# groupadd Account 

Add the 3 users to Marketing group

# useradd -G  Marketing Mark1 
# useradd -G  Marketing Mark2
# useradd -G  Marketing Mark3 

Add 3 users to Accounting group

# useradd -G Account AC1
# useradd -G Account AC2
# useradd -G Account AC3 

Answer to question 1

There are 2 variations to get the all memebers of a group in linux the 2 versions of the command are below
grep 'Account' /etc/group
awk -F':' '/Marketing/{print $4}' /etc/group 

Expected output

[root@nakuru ~]# grep 'Account' /etc/group
Account:x:1029:AC1,AC2,AC3
[root@nakuru ~]# awk -F':' '/Marketing/{print $4}' /etc/group
Mark1,Mark2,Mark3 

To enable ACL's in HDP you need to set the dfs.namenode.acls.enabled to true using Ambari in custom hdfs-site.xml which is the recommended way. And restart all stale service typicall HDFS,MapReduce,YARN,ATLAS in my case see attached screenshot

Answer to question 2

Task Set user "AC1" (group: "Account") to have "Read/Write/Execute" privilege in Group "Marketing".

This will entail creating a file in hdfs with owner Mark1or 2 or 3 and group Marketing, as root switch to any user in group Marketing. First create a directory in hdfs and change the ownership to Mark1 and group Marketing

As hdfs user created the directory and change ownership and permission

# su - hdfs [hdfs@nakuru ~]
$ hdfs dfs -mkdir -p /marketing/acldemo 
[hdfs@nakuru ~]$ hdfs dfs -chown -R Mark1:marketing /marketing/acldemo 

Validate the above commands were successful.

[hdfs@nakuru ~]$ hdfs dfs -ls /marketing 
Found 1 items drwxr-xr-x - Mark1 marketing 0 2018-01-12 21:54 /marketing/acldemo 

Get the current ACL

[hdfs@nakuru ~]$ hdfs dfs -getfacl -R /marketing/acldemo 
# file: /marketing/acldemo 
# owner: Mark1 
# group: marketing 
user::rwx 
group::r-x 
other::r-x 

I removed the r-x for other to be sure and revalidate note the others now had no r-x

[Mark1@nakuru ~]$ hdfs dfs -chmod 750 /marketing/acldemo 
[Mark1@nakuru ~]$ hdfs dfs -getfacl -R /marketing/acldemo 
# file: /marketing/acldemo 
# owner: Mark1 
# group: marketing 
user::rwx 
group::r-x 
other::--- 

Switch to user Mark1 create a local file and copy to

hdfs # su - Mark1 
[Mark1@nakuru ~]$ echo "This is Hussain testing ACL ser "AC1" (group: "Account") will have the Right Read/Write/Execute in Group "Marketing"" > test1.txt 
[Mark1@nakuru ~]$ ls -al -rw-r--r-- 1 Mark1 Marketing 113 Jan 12 21:51 test1.txt 

Copy the above file to hdfs in previously created directory and check that it was successfully copied to hdfs

[Mark1@nakuru ~]$ hdfs dfs -put test1.txt /marketing/acldemo 
[Mark1@nakuru ~]$ hdfs dfs -ls /marketing/acldemo 
Found 1 items -rw-r--r-- 3 Mark1 marketing 113 2018-01-12 22:05 /marketing/acldemo/test1.txt 

Testing

Switched to user AC1 in group Account to see if he could read the file, it failed that's normal

[root@nakuru ~]# su AC1 
[AC1@nakuru root]$ hdfs dfs -cat /marketing/acldemo/test1.txt 
cat: Permission denied: user=AC1, access=EXECUTE, inode="/marketing/acldemo/test1.txt":Mark1:marketing:drwxr-x- 

Change the ACL for user AC1 of group Account to have rwx as you requested

[Mark1@nakuru ~]$ hdfs dfs -setfacl -m user:AC1:rwx /marketing/acldemo 

Check the new ACL,note now the user ACI now has rwx on the file test1

[Mark1@nakuru ~]$ hdfs dfs -getfacl /marketing/acldemo/test1.txt 
# file: /marketing/acldemo/test1.txt 
# owner: Mark1 
# group: marketing 
user::rw- 
user:AC1:rwx 
group::r-- 
mask::rwx 
other::r-- 

Switch to user AC1 and test that user AC1 can now read the file.

[root@nakuru ~]# su AC1 
[AC1@nakuru root]$ hdfs dfs -cat /marketing/acldemo/test1.txt 
This is Hussain testing ACL ser AC1 (group: Account) will have the Right Read/Write/Execute in Group Marketing 

SUCCESS !

Answer to question 3

User Mark1 of Marketing should not able to copy the file into "Account" user, create directory and change ownership to any user in Account group

[root@nakuru ~]# su - hdfs 
[hdfs@nakuru ~]$ hdfs dfs -mkdir -p /Account/acldemo2 
[hdfs@nakuru ~]$ hdfs dfs -chown AC1:Account /Account/acldemo2 

Get the ACL of newly created directory, note the 3 octets (other is r-x)

[root@nakuru ~]# su AC1 
[AC1@nakuru root]$ hdfs dfs -getfacl /Account/acldemo2 
# file: /Account/acldemo2 
# owner: AC1 
# group: Account 
user::rwx 
group::r-x 
other::r-x 

Test with user Mark1 can't copy a file to the directory /Account/acldemo2 from local

[root@nakuru ~]# su - Mark1 
[Mark1@nakuru ~]$ hdfs dfs -put test1.txt /Account/acldemo2 
put: Permission denied: user=Mark1, access=WRITE, inode="/Account/acldemo2/test1.txt._COPYING_":AC1:Account:drwxr-xr-x 

The above is quite straightforward Mark1 belongs to Marketing and doesn't have any permissions on this directory, I hope that's what you meant?

Please if that answers your question then please Accept the answer by Clicking on Accept button below, That would be a great help to Community users to find a solution quickly for these kinds of ACL issues.