ApplicationACLsManager { public boolean checkAccess(UserGroupInformation callerUGI, ApplicationAccessType applicationAccessType, String applicationOwner, ApplicationId applicationId) { if (LOG.isDebugEnabled()) { LOG.debug("Verifying access-type " + applicationAccessType + " for " + callerUGI + " on application " + applicationId + " owned by " + applicationOwner); } String user = callerUGI.getShortUserName(); if (!areACLsEnabled()) { return true; } AccessControlList applicationACL = DEFAULT_YARN_APP_ACL; Map<ApplicationAccessType, AccessControlList> acls = this.applicationACLS .get(applicationId); if (acls == null) { if (LOG.isDebugEnabled()) { LOG.debug("ACL not found for application " + applicationId + " owned by " + applicationOwner + ". Using default [" + YarnConfiguration.DEFAULT_YARN_APP_ACL + "]"); } } else { AccessControlList applicationACLInMap = acls.get(applicationAccessType); if (applicationACLInMap != null) { applicationACL = applicationACLInMap; } else if (LOG.isDebugEnabled()) { LOG.debug("ACL not found for access-type " + applicationAccessType + " for application " + applicationId + " owned by " + applicationOwner + ". Using default [" + YarnConfiguration.DEFAULT_YARN_APP_ACL + "]"); } } if (this.adminAclsManager.isAdmin(callerUGI) || user.equals(applicationOwner) || applicationACL.isUserAllowed(callerUGI)) { return true; } return false; } @VisibleForTesting  ApplicationACLsManager();  ApplicationACLsManager(Configuration conf); boolean areACLsEnabled(); void addApplication(ApplicationId appId,
      Map<ApplicationAccessType, String> acls); void removeApplication(ApplicationId appId); boolean checkAccess(UserGroupInformation callerUGI,
      ApplicationAccessType applicationAccessType, String applicationOwner,
      ApplicationId applicationId); final boolean isAdmin(final UserGroupInformation calledUGI);  }
@Test public void testCheckAccess() { Configuration conf = new Configuration(); conf.setBoolean(YarnConfiguration.YARN_ACL_ENABLE, true); conf.set(YarnConfiguration.YARN_ADMIN_ACL, ADMIN_USER); ApplicationACLsManager aclManager = new ApplicationACLsManager(conf); Map<ApplicationAccessType, String> aclMap = new HashMap<ApplicationAccessType, String>(); aclMap.put(ApplicationAccessType.VIEW_APP, TESTUSER1 + "," + TESTUSER3); aclMap.put(ApplicationAccessType.MODIFY_APP, TESTUSER1); ApplicationId appId = ApplicationId.newInstance(1, 1); aclManager.addApplication(appId, aclMap); UserGroupInformation testUser1 = UserGroupInformation .createRemoteUser(TESTUSER1); assertTrue(aclManager.checkAccess(testUser1, ApplicationAccessType.VIEW_APP, APP_OWNER, appId)); assertTrue(aclManager.checkAccess(testUser1, ApplicationAccessType.MODIFY_APP, APP_OWNER, appId)); UserGroupInformation testUser2 = UserGroupInformation .createRemoteUser(TESTUSER2); assertFalse(aclManager.checkAccess(testUser2, ApplicationAccessType.VIEW_APP, APP_OWNER, appId)); assertFalse(aclManager.checkAccess(testUser2, ApplicationAccessType.MODIFY_APP, APP_OWNER, appId)); UserGroupInformation testUser3 = UserGroupInformation .createRemoteUser(TESTUSER3); assertTrue(aclManager.checkAccess(testUser3, ApplicationAccessType.VIEW_APP, APP_OWNER, appId)); assertFalse(aclManager.checkAccess(testUser3, ApplicationAccessType.MODIFY_APP, APP_OWNER, appId)); UserGroupInformation appOwner = UserGroupInformation .createRemoteUser(APP_OWNER); assertTrue(aclManager.checkAccess(appOwner, ApplicationAccessType.VIEW_APP, APP_OWNER, appId)); assertTrue(aclManager.checkAccess(appOwner, ApplicationAccessType.MODIFY_APP, APP_OWNER, appId)); UserGroupInformation adminUser = UserGroupInformation .createRemoteUser(ADMIN_USER); assertTrue(aclManager.checkAccess(adminUser, ApplicationAccessType.VIEW_APP, APP_OWNER, appId)); assertTrue(aclManager.checkAccess(adminUser, ApplicationAccessType.MODIFY_APP, APP_OWNER, appId)); }
@Test public void testCheckAccessWithNullACLS() { Configuration conf = new Configuration(); conf.setBoolean(YarnConfiguration.YARN_ACL_ENABLE, true); conf.set(YarnConfiguration.YARN_ADMIN_ACL, ADMIN_USER); ApplicationACLsManager aclManager = new ApplicationACLsManager(conf); UserGroupInformation appOwner = UserGroupInformation .createRemoteUser(APP_OWNER); ApplicationId appId = ApplicationId.newInstance(1, 1); assertTrue(aclManager.checkAccess(appOwner, ApplicationAccessType.MODIFY_APP, APP_OWNER, appId)); assertTrue(aclManager.checkAccess(appOwner, ApplicationAccessType.VIEW_APP, APP_OWNER, appId)); UserGroupInformation adminUser = UserGroupInformation .createRemoteUser(ADMIN_USER); assertTrue(aclManager.checkAccess(adminUser, ApplicationAccessType.VIEW_APP, APP_OWNER, appId)); assertTrue(aclManager.checkAccess(adminUser, ApplicationAccessType.MODIFY_APP, APP_OWNER, appId)); UserGroupInformation testUser1 = UserGroupInformation .createRemoteUser(TESTUSER1); assertFalse(aclManager.checkAccess(testUser1, ApplicationAccessType.VIEW_APP, APP_OWNER, appId)); assertFalse(aclManager.checkAccess(testUser1, ApplicationAccessType.MODIFY_APP, APP_OWNER, appId)); }