CreateKeytabFilesServerAction extends KerberosServerAction { protected void ensureAmbariOnlyAccess(File file) throws AmbariException { if (file.exists()) { if (!file.setReadable(false, false) || !file.setReadable(true, true)) { String message = String.format("Failed to set %s readable only by Ambari", file.getAbsolutePath()); LOG.warn(message); throw new AmbariException(message); } if (!file.setWritable(false, false) || !file.setWritable(true, true)) { String message = String.format("Failed to set %s writable only by Ambari", file.getAbsolutePath()); LOG.warn(message); throw new AmbariException(message); } if (file.isDirectory()) { if (!file.setExecutable(false, false) || !file.setExecutable(true, true)) { String message = String.format("Failed to set %s executable by Ambari", file.getAbsolutePath()); LOG.warn(message); throw new AmbariException(message); } } else { if (!file.setExecutable(false, false)) { String message = String.format("Failed to set %s not executable", file.getAbsolutePath()); LOG.warn(message); throw new AmbariException(message); } } } }  @Override CommandReport execute(ConcurrentMap<String, Object> requestSharedDataContext); Keytab createKeytab(String principal, String password, Integer keyNumber,
                             KerberosOperationHandler operationHandler, boolean checkCache,
                             boolean canCache, ActionLog actionLog);  }
@Test public void testEnsureAmbariOnlyAccess() throws Exception { Assume.assumeTrue(ShellCommandUtil.UNIX_LIKE); Path path; Set<PosixFilePermission> permissions; File directory = testFolder.newFolder(); Assert.assertNotNull(directory); new CreateKeytabFilesServerAction().ensureAmbariOnlyAccess(directory); path = Paths.get(directory.getAbsolutePath()); Assert.assertNotNull(path); permissions = Files.getPosixFilePermissions(path); Assert.assertNotNull(permissions); Assert.assertNotNull(permissions); Assert.assertEquals(3, permissions.size()); Assert.assertTrue(permissions.contains(PosixFilePermission.OWNER_READ)); Assert.assertTrue(permissions.contains(PosixFilePermission.OWNER_WRITE)); Assert.assertTrue(permissions.contains(PosixFilePermission.OWNER_EXECUTE)); Assert.assertFalse(permissions.contains(PosixFilePermission.GROUP_READ)); Assert.assertFalse(permissions.contains(PosixFilePermission.GROUP_WRITE)); Assert.assertFalse(permissions.contains(PosixFilePermission.GROUP_EXECUTE)); Assert.assertFalse(permissions.contains(PosixFilePermission.OTHERS_READ)); Assert.assertFalse(permissions.contains(PosixFilePermission.OTHERS_WRITE)); Assert.assertFalse(permissions.contains(PosixFilePermission.OTHERS_EXECUTE)); File file = File.createTempFile("temp_", "", directory); Assert.assertNotNull(file); Assert.assertTrue(file.exists()); new CreateKeytabFilesServerAction().ensureAmbariOnlyAccess(file); path = Paths.get(file.getAbsolutePath()); Assert.assertNotNull(path); permissions = Files.getPosixFilePermissions(path); Assert.assertNotNull(permissions); Assert.assertEquals(2, permissions.size()); Assert.assertTrue(permissions.contains(PosixFilePermission.OWNER_READ)); Assert.assertTrue(permissions.contains(PosixFilePermission.OWNER_WRITE)); Assert.assertFalse(permissions.contains(PosixFilePermission.OWNER_EXECUTE)); Assert.assertFalse(permissions.contains(PosixFilePermission.GROUP_READ)); Assert.assertFalse(permissions.contains(PosixFilePermission.GROUP_WRITE)); Assert.assertFalse(permissions.contains(PosixFilePermission.GROUP_EXECUTE)); Assert.assertFalse(permissions.contains(PosixFilePermission.OTHERS_READ)); Assert.assertFalse(permissions.contains(PosixFilePermission.OTHERS_WRITE)); Assert.assertFalse(permissions.contains(PosixFilePermission.OTHERS_EXECUTE)); }