set check chown llb 權限 ase see min 簡單

1.權限模式 簡單：啟動HDFS的操作系統用戶即為超級用戶，可以通過HADOOP_USER_NAME指定
kerberos：

2.group mapping 組列表由group mapping service完成，該服務由hadoop.security.group.mapping參數決定，默認值是org.apache.hadoop.security.JniBasedUnixGroupsMappingWithFallback，即由JNI. 如果沒有JNI, 使用org.apache.hadoop.security.ShellBasedUnixGroupsMapping，意思是使用shell命令bash -c groups決定group. group mapping 服務由namenode提供

3.如何執行權限 每次執行一個操作之前都會檢查權限。客戶端會把用戶標識發給namenode.

4.改變文件系統權限的API

• public FSDataOutputStream create(Path f, FsPermission permission, boolean overwrite, int bufferSize, short replication, long blockSize, Progressable progress) throws IOException;
• public boolean mkdirs(Path f, FsPermission permission) throws IOException;
• public void setPermission(Path p, FsPermission permission) throws IOException;
• public void setOwner(Path p, String username, String groupname) throws IOException;
• public FileStatus getFileStatus(Path f) throws IOException;
  來源： http://hadoop.apache.org/docs/r2.6.4/hadoop-project-dist/hadoop-hdfs/HdfsPermissionsGuide.html

5.改變文件系統權限的shell

• chmod [-R] mode file …

  Only the owner of a file or the super-user is permitted to change the mode of a file.

• chgrp [-R] group file …

  The user invoking chgrp must belong to the specified group and be the owner of the file, or be the super-user.

• chown [-R] [owner][:[group]] file …

  The owner of a file may only be altered by a super-user.
• ls file …
• lsr file …

以上命令使用bin/hdfs dfs -執行
6.配置參數

• dfs.permissions.enabled = true 是否啟用權限

  If yes use the permissions system as described here. If no, permission checking is turned off, but all other behavior is unchanged. Switching from one parameter value to the other does not change the mode, owner or group of files or directories. Regardless of whether permissions are on or off, chmod, chgrp, chown and setfacl always check permissions. These functions are only useful in the permissions context, and so there is no backwards compatibility issue. Furthermore, this allows administrators to reliably set owners and permissions in advance of turning on regular permissions checking.

• dfs.web.ugi = webuser,webgroup

  The user name to be used by the web server. Setting this to the name of the super-user allows any web client to see everything. Changing this to an otherwise unused identity allows web clients to see only those things visible using "other" permissions. Additional groups may be added to the comma-separated list.

• dfs.permissions.superusergroup = supergroup 超級用戶組

  The name of the group of super-users.

• fs.permissions.umask-mode = 0022

  The umask used when creating files and directories. For configuration files, the decimal value 18 may be used.

• dfs.cluster.administrators = ACL-for-admins

  The administrators for the cluster specified as an ACL. This controls who can access the default servlets, etc. in the HDFS.

• dfs.namenode.acls.enabled = true

  Set to true to enable support for HDFS ACLs (Access Control Lists). By default, ACLs are disabled. When ACLs are disabled, the NameNode rejects all attempts to set an ACL.

來自為知筆記(Wiz)

七：HDFS Permissions Guide 權限