فهرست منبع

[oozie] Fix HDFS permissions of shared workflows

If is_shared is false
workspace: 711
deployment: 711

If is_shared is true
workspace: 755
deployment: 711

Prevent a non owner to add a new action to a shared workflow
Romain Rigaux 13 سال پیش
والد
کامیت
c51f116c61

+ 1 - 1
apps/oozie/src/oozie/forms.py

@@ -40,7 +40,7 @@ class WorkflowForm(forms.ModelForm):
       'description': forms.TextInput(attrs={'class': 'span5'}),
       'deployment_dir': forms.TextInput(attrs={'class': 'pathChooser', 'style': "width:535px"}),
       'parameters': forms.widgets.HiddenInput(),
-      'job_xml': forms.widgets.HiddenInput(attrs={'class': 'span5'}),
+      'job_xml': forms.widgets.TextInput(attrs={'class': 'pathChooser span5'}),
       'job_properties': forms.widgets.HiddenInput(),
       'schema_version': forms.widgets.HiddenInput(),
     }

+ 17 - 5
apps/oozie/src/oozie/models.py

@@ -199,11 +199,17 @@ class WorkflowManager(models.Manager):
     workflow.end = end
     workflow.save()
 
-    # Recheck if deployement dir exists
+    self.check_workspace(workflow, fs)
+
+  def check_workspace(self, workflow, fs):
     oozie_setup.create_data_dir(fs)
-    Submission(workflow.owner, workflow, fs, {})._create_dir(workflow.deployment_dir)
 
-    return workflow
+    if workflow.is_shared:
+      perms = 0755
+    else:
+      perms = 0711
+
+    Submission(workflow.owner, workflow, fs, {})._create_dir(workflow.deployment_dir, perms=perms)
 
   def destroy(self, workflow, fs):
     Submission(workflow.owner, workflow, fs, {}).remove_deployment_dir()
@@ -445,9 +451,15 @@ class Workflow(Job):
     copy.save()
 
     try:
-      fs.copy_remote_dir(source_deployment_dir, copy.deployment_dir, owner=copy.owner)
+      if copy.is_shared:
+        perms = 0755
+      else:
+        perms = 0711
+      fs.copy_remote_dir(source_deployment_dir, copy.deployment_dir, owner=copy.owner, dir_mode=perms)
     except WebHdfsException, e:
-      LOG.error('The copy of the deployment directory failed: %s', e)
+      msg = _('The copy of the deployment directory failed: %s') % e
+      LOG.error(msg)
+      raise PopupException(msg)
 
     return copy
 

+ 13 - 3
apps/oozie/src/oozie/templates/editor/edit_workflow.mako

@@ -33,13 +33,15 @@ ${ layout.menubar(section='workflows') }
   <div class="well">
     ${ _('Description:') } ${ workflow.description or "N/A" }
     <div class="pull-right" style="margin-top:-5px">
+      % if user_can_edit_job:
         <label>
             <a href="/filebrowser/view${ workflow.deployment_dir }" class="btn">
               ${ _('Upload') }
             </a>
             ${ _('files to deployment directory') }
         </label>
-      </div>
+      % endif
+    </div>
   </div>
 
   <ul class="nav nav-tabs">
@@ -56,6 +58,7 @@ ${ layout.menubar(section='workflows') }
       <div class="tab-pane active" id="editor">
         <div class="row-fluid">
           <div class="span2">
+            % if user_can_edit_job:
             <h2>${ _('Actions') }</h2>
             <br/>
             <ul class="nav nav-tabs">
@@ -128,6 +131,7 @@ ${ layout.menubar(section='workflows') }
                 <p/>
               </div>
             </div>
+            % endif
           </div>
 
           <div class="span9">
@@ -172,13 +176,19 @@ ${ layout.menubar(section='workflows') }
                 </div>
 
                <div id="advanced-container" class="hide">
-                 ${ utils.render_field(workflow_form['deployment_dir']) }
+                 % if user_can_edit_job:
+                   ${ utils.render_field(workflow_form['deployment_dir']) }
+                 % endif
+                 ## to remove
                  ${ properties.print_key_value(workflow_form['parameters'], 'parameters', parameters) }
                  ${ workflow_form['parameters'] }
+                 ## to remove
                  ${ properties.print_key_value(workflow_form['job_properties'], 'job_properties', job_properties) }
                  ${ workflow_form['job_properties'] }
                  ${ workflow_form['schema_version'] }
-                 ${ utils.render_field(workflow_form['job_xml']) }
+                 % if user_can_edit_job:
+                   ${ utils.render_field(workflow_form['job_xml']) }
+                 % endif
                </div>
 
              </fieldset>

+ 1 - 1
apps/oozie/src/oozie/templates/editor/edit_workflow_action.mako

@@ -61,7 +61,7 @@ ${ layout.menubar(section='workflows') }
           <p class="alert alert-warn span5">
             ${ _('The ssh server requires passwordless login') }.
           </p>
-        % endif        
+        % endif
         </div>
       </div>
 

+ 4 - 1
apps/oozie/src/oozie/views/editor.py

@@ -245,12 +245,14 @@ def edit_workflow(request, workflow):
       if 'move_down_action' in request.POST: return move_down_action(request, action=request.POST['move_down_action'])
 
       if workflow_form.is_valid() and actions_formset.is_valid():
-        workflow_form.save()
+        workflow = workflow_form.save()
         actions_formset.save()
 
         if workflow.has_cycle():
           raise PopupException(_('Sorry, this operation is not creating a cycle which would break the workflow.'))
 
+        Workflow.objects.check_workspace(workflow, request.fs)
+
         request.info(_("Workflow saved!"))
         return redirect(reverse('oozie:edit_workflow', kwargs={'workflow': workflow.id}))
     except Exception, e:
@@ -369,6 +371,7 @@ def schedule_workflow(request, workflow):
 
 
 @check_job_access_permission
+@check_job_edition_permission()
 def new_action(request, workflow, node_type, parent_action_id):
   ActionForm = design_form_by_type(node_type)
 

+ 5 - 2
desktop/libs/liboozie/src/liboozie/submittion.py

@@ -123,14 +123,17 @@ class Submission(object):
         msg = _("Path is not a directory: %s") % (path,)
         LOG.error(msg)
         raise Exception(msg)
-      return path
     except IOError, ex:
       if ex.errno != errno.ENOENT:
         msg = _("Error accessing directory '%s': %s") % (path, ex)
         LOG.exception(msg)
         raise IOError(ex.errno, msg)
+
     if not self.fs.exists(path):
       self._do_as(self.user.username , self.fs.mkdir, path, perms)
+
+    self._do_as(self.user.username , self.fs.chmod, path, perms)
+
     return path
 
   def _copy_files(self, deployment_dir, oozie_xml):
@@ -146,7 +149,7 @@ class Submission(object):
     files = []
     if hasattr(self.job, 'node_list'):
       for node in self.job.node_list:
-        if hasattr(node, 'jar_path'):
+        if hasattr(node, 'jar_path') and node.jar_path.startswith('/'):
           files.append(node.jar_path)
 
     if files: