AMBARI-8665. Run services in secured mode as non-root on HDP1 (aonishuk)

ambari-server/src/main/resources/stacks/HDP/1.3.2/hooks/before-ANY/files/changeToSecureUid.sh

@@ -42,9 +42,12 @@ then
   exit 1
 fi
 
+set -e
+
 dir_array=($(echo $directories | sed 's/,/\n/g'))
 old_uid=$(id -u $username)
+sudo_prefix="sudo -H -E"
 echo "Changing uid of $username from $old_uid to $newUid"
 echo "Changing directory permisions for ${dir_array[@]}"
-usermod -u $newUid $username && for dir in ${dir_array[@]} ; do chown -Rh $newUid $dir ; done
+$sudo_prefix usermod -u $newUid $username && for dir in ${dir_array[@]} ; do ls $dir && echo "Changing permission for $dir" && $sudo_prefix chown -Rh $newUid $dir ; done
 exit 0

ambari-server/src/main/resources/stacks/HDP/1.3.2/hooks/before-ANY/scripts/shared_initialization.py

@@ -95,7 +95,7 @@ def set_uid(user, user_dirs):
   File(format("{tmp_dir}/changeUid.sh"),
        content=StaticFile("changeToSecureUid.sh"),
        mode=0555)
-  Execute(format("{tmp_dir}/changeUid.sh {user} {user_dirs} 2>/dev/null"),
+  Execute(format("{tmp_dir}/changeUid.sh {user} {user_dirs}"),
           not_if = format("test $(id -u {user}) -gt 1000"))
     
 def setup_hadoop_env():

ambari-server/src/main/resources/stacks/HDP/1.3.2/services/SQOOP/package/scripts/service_check.py

@@ -26,7 +26,9 @@ class SqoopServiceCheck(Script):
     import params
     env.set_params(params)
     if params.security_enabled:
-        Execute(format("{kinit_path_local}  -kt {smoke_user_keytab} {smokeuser}"))
+      Execute(format("{kinit_path_local}  -kt {smoke_user_keytab} {smokeuser}"),
+              user = params.smokeuser,
+      )
     Execute("sqoop version",
             user = params.smokeuser,
             logoutput = True

ambari-server/src/main/resources/stacks/HDP/2.0.6/hooks/before-ANY/files/changeToSecureUid.sh

@@ -42,9 +42,12 @@ then
   exit 1
 fi
 
+set -e
+
 dir_array=($(echo $directories | sed 's/,/\n/g'))
 old_uid=$(id -u $username)
+sudo_prefix="sudo -H -E"
 echo "Changing uid of $username from $old_uid to $newUid"
 echo "Changing directory permisions for ${dir_array[@]}"
-usermod -u $newUid $username && for dir in ${dir_array[@]} ; do chown -Rh $newUid $dir ; done
+$sudo_prefix usermod -u $newUid $username && for dir in ${dir_array[@]} ; do ls $dir && echo "Changing permission for $dir" && $sudo_prefix chown -Rh $newUid $dir ; done
 exit 0

ambari-server/src/main/resources/stacks/HDP/2.0.6/hooks/before-ANY/scripts/shared_initialization.py

@@ -94,7 +94,7 @@ def set_uid(user, user_dirs):
   File(format("{tmp_dir}/changeUid.sh"),
        content=StaticFile("changeToSecureUid.sh"),
        mode=0555)
-  Execute(format("{tmp_dir}/changeUid.sh {user} {user_dirs} 2>/dev/null"),
+  Execute(format("{tmp_dir}/changeUid.sh {user} {user_dirs}"),
           not_if = format("test $(id -u {user}) -gt 1000"))
     
 def setup_hadoop_env():

ambari-server/src/main/resources/stacks/HDP/2.0.6/services/SQOOP/package/scripts/service_check.py

@@ -27,7 +27,9 @@ class SqoopServiceCheck(Script):
     import params
     env.set_params(params)
     if params.security_enabled:
-        Execute(format("{kinit_path_local}  -kt {smoke_user_keytab} {smokeuser}"))
+      Execute(format("{kinit_path_local}  -kt {smoke_user_keytab} {smokeuser}"),
+              user = params.smokeuser,
+      )
     Execute("sqoop version",
             user = params.smokeuser,
             path = params.sqoop_bin_dir,

ambari-server/src/test/python/stacks/1.3.2/SQOOP/test_service_check.py

@@ -27,7 +27,9 @@ class TestSqoopServiceCheck(RMFTestCase):
                        classname = "SqoopServiceCheck",
                        command = "service_check",
                        config_file="secured.json")
-    self.assertResourceCalled('Execute', '/usr/bin/kinit  -kt /etc/security/keytabs/smokeuser.headless.keytab ambari-qa',)
+    self.assertResourceCalled('Execute', '/usr/bin/kinit  -kt /etc/security/keytabs/smokeuser.headless.keytab ambari-qa',
+                              user = 'ambari-qa'
+    )
     self.assertResourceCalled('Execute', 'sqoop version',
                               logoutput = True,
                               user = 'ambari-qa',)

ambari-server/src/test/python/stacks/1.3.2/hooks/before-ANY/test_before_any.py

@@ -124,14 +124,14 @@ class TestHookBeforeInstall(RMFTestCase):
         content = StaticFile('changeToSecureUid.sh'),
         mode = 0555,
     )
-    self.assertResourceCalled('Execute', '/tmp/changeUid.sh ambari-qa /tmp/hadoop-ambari-qa,/tmp/hsperfdata_ambari-qa,/home/ambari-qa,/tmp/ambari-qa,/tmp/sqoop-ambari-qa 2>/dev/null',
+    self.assertResourceCalled('Execute', '/tmp/changeUid.sh ambari-qa /tmp/hadoop-ambari-qa,/tmp/hsperfdata_ambari-qa,/home/ambari-qa,/tmp/ambari-qa,/tmp/sqoop-ambari-qa',
         not_if = 'test $(id -u ambari-qa) -gt 1000',
     )
     self.assertResourceCalled('File', '/tmp/changeUid.sh',
         content = StaticFile('changeToSecureUid.sh'),
         mode = 0555,
     )
-    self.assertResourceCalled('Execute', '/tmp/changeUid.sh hbase /home/hbase,/tmp/hbase,/usr/bin/hbase,/var/log/hbase,/hadoop/hbase 2>/dev/null',
+    self.assertResourceCalled('Execute', '/tmp/changeUid.sh hbase /home/hbase,/tmp/hbase,/usr/bin/hbase,/var/log/hbase,/hadoop/hbase',
         not_if = 'test $(id -u hbase) -gt 1000',
     )
     self.assertResourceCalled('Directory', '/etc/hadoop/conf.empty',

ambari-server/src/test/python/stacks/2.0.6/SQOOP/test_service_check.py

@@ -28,7 +28,9 @@ class TestSqoopServiceCheck(RMFTestCase):
                        command = "service_check",
                        config_file="secured.json"
     )
-    self.assertResourceCalled('Execute', '/usr/bin/kinit  -kt /etc/security/keytabs/smokeuser.headless.keytab ambari-qa',)
+    self.assertResourceCalled('Execute', '/usr/bin/kinit  -kt /etc/security/keytabs/smokeuser.headless.keytab ambari-qa',
+                              user = 'ambari-qa'
+    )
     self.assertResourceCalled('Execute', 'sqoop version',
                               logoutput = True,
                               path = ['/usr/bin'],

ambari-server/src/test/python/stacks/2.0.6/hooks/before-ANY/test_before_any.py

@@ -124,14 +124,14 @@ class TestHookBeforeInstall(RMFTestCase):
         content = StaticFile('changeToSecureUid.sh'),
         mode = 0555,
     )
-    self.assertResourceCalled('Execute', '/tmp/changeUid.sh ambari-qa /tmp/hadoop-ambari-qa,/tmp/hsperfdata_ambari-qa,/home/ambari-qa,/tmp/ambari-qa,/tmp/sqoop-ambari-qa 2>/dev/null',
+    self.assertResourceCalled('Execute', '/tmp/changeUid.sh ambari-qa /tmp/hadoop-ambari-qa,/tmp/hsperfdata_ambari-qa,/home/ambari-qa,/tmp/ambari-qa,/tmp/sqoop-ambari-qa',
         not_if = 'test $(id -u ambari-qa) -gt 1000',
     )
     self.assertResourceCalled('File', '/tmp/changeUid.sh',
         content = StaticFile('changeToSecureUid.sh'),
         mode = 0555,
     )
-    self.assertResourceCalled('Execute', '/tmp/changeUid.sh hbase /home/hbase,/tmp/hbase,/usr/bin/hbase,/var/log/hbase,/hadoop/hbase 2>/dev/null',
+    self.assertResourceCalled('Execute', '/tmp/changeUid.sh hbase /home/hbase,/tmp/hbase,/usr/bin/hbase,/var/log/hbase,/hadoop/hbase',
         not_if = 'test $(id -u hbase) -gt 1000',
     )
     self.assertResourceCalled('Directory', '/hadoop',