Access permission concepts and usage-Apsara File Storage for HDFS(HDFS)-阿里云帮助中心

Access permissions

In an Apsara File Storage for HDFS file system, every file and directory has three sets of permissions. These sets apply to the file's or directory's owner, its associated group, and all other users. Each set can include Read (R), Write (W), and Execute (X) permissions. A user must have the required permissions to perform a specific operation.

The following table describes the permissions for files and directories.

Permission	File	Directory
Read (R)	Allows reading the contents of the file.	Requires Read and Execute permissions to list the directory's contents.
Write (W)	Allows writing to or appending to the file.	Requires Write and Execute permissions to create a node in the directory.
Execute (X)	The Execute permission has no effect on files in HDFS.	Requires the Execute permission to traverse the directory.

The following example shows the permission information in a file system.

-rw-r--r--   3 root  supergroup      0 2022-05-07 09:08 /file
drwxr-xr-x   - root  supergroup      0 2022-01-14 03:33 /rmstate
drwxr-xr-x   - user1 user1           0 2022-03-31 09:51 /testDelete
drwxr-xr-x   - user1 supergroup      0 2022-04-01 07:16 /testMkdir
drwxrwxrwx   - root  supergroup      0 2022-03-31 11:53 /testRoot

The first permission triplet defines the owner's permissions.
The second permission triplet defines the group's permissions.
The third permission triplet defines the permissions for other.

Numeric representation of permissions

Permissions can be represented by letters (R for Read, W for Write, X for Execute) or by numbers (Read=4, Write=2, Execute=1). A permission set's numeric value is the sum of its individual numbers, as shown in the following table.

Numeric form	Format	Description
7	RWX	All permissions
5	R-X	Read and Execute permissions
4	R--	Read permission
0	---	No permissions

Permission examples

Consider the path /Dir1/Dir2/file in HDFS. To perform an operation on any node in this path (such as /, Dir1, Dir2, or file), you must have the required permissions. The following table lists the required permissions for common operations. For more information about the Hadoop permission model, see HDFS Permissions Guide.

Action	/	Dir1/	Dir2/	file
Create Directory /Dir1	-WX	---	---	---
Create Directory /Dir1/Dir2	--X	-WX	---	---
Create File /Dir1/Dir2/file	--X	--X	-WX	---
Open for Read /Dir1/Dir2/file	--X	--X	--X	R--
Open for Write /Dir1/Dir2/file	--X	--X	--X	-W-
Delete Directory /Dir1	-WX	RWX	RWX	---
Delete File /Dir1/Dir2/file	--X	--X	-WX	---
Stat /Dir1/Dir2/file	--X	--X	--X	---
list /Dir1	--X	R-X	---	---
list /Dir1/Dir2	--X	--X	R-X	---

Superuser

Apsara File Storage for HDFS provides the concept of a superuser group (supergroup). Users who belong to the supergroup are superusers and can bypass permission checks. The default superuser group for Apsara File Storage for HDFS is named supergroup, and the default superuser is root.

Apsara File Storage for HDFS provides a user and group mapping feature to manage these relationships. You can use this feature to create, delete, and view user and group mappings. For more information, see Manage user and group mappings by using OpenAPI.

umask

When you create a file or directory without specifying permissions, a default set of permissions is applied. The default permissions are calculated as 0777 & (~umask) for directories and 0666 & (~umask) for files. The default umask value is 022. You can modify the default umask by configuring the fs.permissions.umask-mode option.

Usage notes

User authentication

Apsara File Storage for HDFS supports only simple user authentication and does not support Kerberos.
User and group mapping management

Apsara File Storage for HDFS supports user and group management for a single file system only through OpenAPI. It does not support integration with third-party systems such as LDAP or Ranger.
Permission management

Apsara File Storage for HDFS permission checks are compatible with the POSIX file system permission model. It does not support Access Control Lists (ACLs) for fine-grained permission management.

FAQ

What are a superuser and a superuser group?

A superuser is a member of the superuser group and can bypass all permission checks when accessing the file system.

What are the default superuser and superuser group?

The default superuser is root, and the default superuser group is supergroup.

How do I disable permission checks?

Apsara File Storage for HDFS does not provide an option to disable permission checks. To bypass these checks, add the user to the supergroup.

Ensuring services are unaffected by permissions

Currently, Apsara File Storage for HDFS does not provide an option to disable permission checks. You can bypass permission checks by using a superuser. To do this, you have two options:

Use the default superuser root to access the file system.
Add any users who will access the file system to the supergroup. This grants them superuser permissions.

Fixing "permission denied" on a new file system

Cause: The permissions for the root directory of a new file system are drwxr-xr-x (0755), and the owner and group are root:supergroup. As a result, non-superusers do not have write permission.
Solution:
- Grant the necessary permissions to the user who cannot access the file system.
- Use a superuser to access the file system.

Fixing corrupted permissions after an SDK update

If the file system permissions are corrupted because you used SDK version 1.0.5, use SDK version 2.1.0 as a superuser to restore the correct permissions. We recommend using only SDK version 2.1.0 to access the file system.