[refpolicy] SELinux policy for Hadoop

[dwalsh@redhat.com (Daniel J Walsh)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/13/2012 05:25 PM, Jean Khosalim wrote:
> I am using Cloudera CDH3 (I followed instructions found in 
> https://ccp.cloudera.com/display/CDHDOC/CDH3+Installation to
> install it).
> 
> Using the above installation: /etc/init.d/hadoop-0.20-jobtracker
> (labeled system_u:object_r:hadoop_jobtracker_initrc_exec_t:s0) Its
> 'start()' calls: daemon /usr/lib/hadoop-0.20/bin/hadoop-daemon.sh
> --config "/etc/hadoop-0.20/conf" start jobtracker $DAEMON_FLAGS
> 
> 
> The script /usr/lib/hadoop-0.20/bin/hadoop-daemon.sh (labeled 
> system_u:object_r:hadoop_exec_t:s0) in turn calls nice -n
> $HADOOP_NICENESS "$HADOOP_HOME"/bin/hadoop --config
> $HADOOP_CONF_DIR $command "$@" < /dev/null
> 
> 
> Then /usr/lib/hadoop-0.20/bin/hadoop script (labeled 
> system_u:object_r:hadoop_exec_t:s0) invoke java: nohup su
> $HADOOP_DAEMON_USER -s $JAVA -- -Dproc_$COMMAND_JAVA.....
> 
Ok what label does this run as?
> 
> If I try to run: runcon -t hadoop_t su hdfs -s
> /usr/java/jdk1.6.0_30/bin/java -- -Dproc_$COMMAND_JAVA..... I got 
> runcon: invalid contect: unconfined_u:
> unconfined_r:hadoop_t:s0-s0:c0.c1023: Invalid argument.
> 
Try

runcon system_u:system_r:hadoop_t:s0  su hdfs -s
/usr/java/jdk1.6.0_30/bin/java --

> 
> Thanks, Jean Khosalim
> 
> 
> 
>> -----Original Message----- From: Daniel J Walsh
>> [mailto:dwalsh at redhat.com] Sent: Monday, February 13, 2012 1:44
>> PM To: Jean Khosalim Cc: 'Christopher J. PeBenito';
>> refpolicy at oss1.tresys.com Subject: Re: [refpolicy] SELinux policy
>> for Hadoop
>> 
> On 02/13/2012 04:26 PM, Jean Khosalim wrote:
>>>> Hi Daniel,
>>>> 
>>>> Thank you for responding. To try your suggestion, I did the 
>>>> following: 1. First stop all the services: service 
>>>> hadoop-0.20-datanode stop service hadoop-0.20-namenode stop
>>>> service hadoop-0.20-secondarynamenode stop service
>>>> hadoop-0.20-jobtracker stop service hadoop-0.20-tasktracker
>>>> stop (Make sure all Hadoop processes are stopped. And ps no
>>>> longer show them). 2. Modified 
>>>> /usr/lib/hadoop-0.20/conf/hadoop-env.sh, by adding the
>>>> following lines: export HADOOP_DATANODE_USER=hdfs export 
>>>> HADOOP_NAMENODE_USER=hdfs export 
>>>> HADOOP_SECONDARYNAMENODE_USER=hdfs export 
>>>> HADOOP_JOBTRACKER_USER=mapred export 
>>>> HADOOP_TASKTRACKER_USER=mapred 3. Start the Hadoop processes 
>>>> manually: /usr/lib/hadoop-0.20/bin/start-all.sh
>>>> 
>>>> But the result of the ps output is still the same, i.e.,
>>>> running with unconfined_java_t.
>>>> 
>>>> Is this what you meant by "a shell script that would execute
>>>> the java for each different user" method?
>>>> 
>>>> I am trying to figure how to use runcon (what arguments to
>>>> use).
>>>> 
>>>> Thanks, Jean Khosalim
>>>> 
> 
> The problem is haddoop-0.20-jobtracker is executing java --class.
> So no transition happens.
> 
> If hadoop-0.20-jobtracker executing /usr/bin/hadoop-jobtracker
> which had java --class within it, then we could label 
> /usr/bin/hadoop-jobtracker hadoop_exec_t, and the transitions
> would happen.
> 
> Alternatively you could attempt
> 
> runcon -t hadpoop_t -- java --class ...
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk86buUACgkQrlYvE4MpobMh/wCgnhgP7RhyASBXD4p+9R4CWRJk
ec8An27OGLwk2KE6rAWM1p1EWgRYoeyP
=SpEF
-----END PGP SIGNATURE-----