AMBARI-8645. Run services in secured mode as non-root (aonishuk)

ambari-server/src/main/resources/stacks/HDP/1.3.2/services/HIVE/package/files/addMysqlUser.sh

@@ -26,7 +26,7 @@ mysqldbpasswd=$3
 mysqldbhost=$4
 myhostname=$(hostname -f)
 
-sudo su mysql -s /bin/bash - -c "service $mysqldservice start"
+sudo service $mysqldservice start
 echo "Adding user $mysqldbuser@$mysqldbhost and $mysqldbuser@localhost"
 sudo su mysql -s /bin/bash - -c "mysql -u root -e \"CREATE USER '$mysqldbuser'@'$mysqldbhost' IDENTIFIED BY '$mysqldbpasswd';\""
 sudo su mysql -s /bin/bash - -c "mysql -u root -e \"CREATE USER '$mysqldbuser'@'localhost' IDENTIFIED BY '$mysqldbpasswd';\""
@@ -38,4 +38,4 @@ if [ '$(sudo su mysql -s /bin/bash - -c "mysql -u root -e \"select user from mys
   sudo su mysql -s /bin/bash - -c "mysql -u root -e \"GRANT ALL PRIVILEGES ON *.* TO '$mysqldbuser'@'$myhostname';\";"
 fi
 sudo su mysql -s /bin/bash - -c "mysql -u root -e \"flush privileges;\""
-sudo su mysql -s /bin/bash - -c "service $mysqldservice stop"
+sudo service $mysqldservice stop

ambari-server/src/main/resources/stacks/HDP/1.3.2/services/HIVE/package/scripts/hive.py

@@ -64,7 +64,7 @@ def hive(name=None):
                "-o {check_db_connection_jar_name}'")
 
   Execute(cmd,
-          not_if=format("[ -f {check_db_connection_jar_name}]"),
+          not_if=format("[ -f {check_db_connection_jar} ]"),
           environment = environment)
 
   if name == 'metastore':

ambari-server/src/main/resources/stacks/HDP/1.3.2/services/HIVE/package/scripts/mysql_service.py

@@ -22,18 +22,20 @@ from resource_management import *
 
 
 def mysql_service(daemon_name=None, action='start'):
-  cmd = format('service {daemon_name} {action}')
+  cmd = ('service', daemon_name, action)
 
   if action == 'status':
     Execute(cmd,
             path="/usr/local/bin/:/bin/:/sbin/",
-            logoutput=False)
+            logoutput=False,
+            sudo=True,
+    )
   else:
-    import params
     Execute(cmd,
             path="/usr/local/bin/:/bin/:/sbin/",
-            user=params.mysql_user,
-            logoutput=True)
+            logoutput=True,
+            sudo=True,
+    )
 
 
 

ambari-server/src/main/resources/stacks/HDP/1.3.2/services/HIVE/package/scripts/params.py

@@ -87,8 +87,6 @@ start_hiveserver2_script = 'startHiveserver2.sh'
 
 hadoop_home = '/usr'
 
-mysql_user = 'mysql'
-
 ##Starting metastore
 start_metastore_script = 'startMetastore.sh'
 hive_metastore_pid = status_params.hive_metastore_pid

ambari-server/src/main/resources/stacks/HDP/2.0.6/services/HDFS/package/scripts/service_check.py

@@ -42,7 +42,7 @@ class HdfsServiceCheck(Script):
     test_cmd = format("fs -test -e {tmp_file}")
     if params.security_enabled:
       Execute(format("{kinit_path_local} -kt {smoke_user_keytab} {smoke_user}"),
-        users=params.smoke_user
+        user=params.smoke_user
       )
     ExecuteHadoop(safemode_command,
                   user=params.smoke_user,

ambari-server/src/main/resources/stacks/HDP/2.0.6/services/HIVE/package/files/addMysqlUser.sh

@@ -25,10 +25,10 @@ mysqldbuser=$2
 mysqldbpasswd=$3
 userhost=$4
 
-service $mysqldservice start
+sudo service $mysqldservice start
 echo "Adding user $mysqldbuser@$userhost and $mysqldbuser@localhost"
 sudo su mysql -s /bin/bash - -c "mysql -u root -e \"CREATE USER '$mysqldbuser'@'$userhost' IDENTIFIED BY '$mysqldbpasswd';\""
 sudo su mysql -s /bin/bash - -c "mysql -u root -e \"GRANT ALL PRIVILEGES ON *.* TO '$mysqldbuser'@'$userhost';\""
 sudo su mysql -s /bin/bash - -c "mysql -u root -e \"flush privileges;\""
 
-sudo su mysql -s /bin/bash - -c "service $mysqldservice stop"
+sudo service $mysqldservice stop

ambari-server/src/main/resources/stacks/HDP/2.0.6/services/HIVE/package/scripts/hive.py

@@ -76,7 +76,7 @@ def hive(name=None):
                "-o {check_db_connection_jar_name}'")
 
   Execute(cmd,
-          not_if=format("[ -f {check_db_connection_jar_name}]"),
+          not_if=format("[ -f {check_db_connection_jar} ]"),
           environment = environment)
 
   if name == 'metastore':

ambari-server/src/main/resources/stacks/HDP/2.0.6/services/HIVE/package/scripts/mysql_service.py

@@ -23,7 +23,7 @@ from resource_management import *
 
 def mysql_service(daemon_name=None, action='start'): 
   status_cmd = format('service {daemon_name} status | grep running')
-  cmd = format('service {daemon_name} {action}')
+  cmd = ('service', daemon_name, action)
 
   if action == 'status':
     Execute(status_cmd)
@@ -32,7 +32,7 @@ def mysql_service(daemon_name=None, action='start'):
     Execute(cmd,
             logoutput = True,
             only_if = status_cmd,
-            user = params.mysql_user
+            sudo = True,
     )
   elif action == 'start':
     import params
@@ -45,7 +45,7 @@ def mysql_service(daemon_name=None, action='start'):
     Execute(cmd,
       logoutput = True,
       not_if = status_cmd,
-      user = params.mysql_user
+      sudo = True,
     )
 
 

ambari-server/src/main/resources/stacks/HDP/2.0.6/services/HIVE/package/scripts/params.py

@@ -165,7 +165,6 @@ java64_home = config['hostLevelParams']['java_home']
 ##### MYSQL
 
 db_name = config['configurations']['hive-env']['hive_database_name']
-mysql_user = "mysql"
 mysql_group = 'mysql'
 mysql_host = config['clusterHostInfo']['hive_mysql_host']
 

ambari-server/src/test/python/stacks/1.3.2/HIVE/test_hive_client.py

@@ -39,7 +39,7 @@ class TestHiveClient(RMFTestCase):
       recursive = True,
     )
     self.assertResourceCalled('Execute', "/bin/sh -c 'cd /usr/lib/ambari-agent/ && curl -kf -x \"\" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar'",
-      not_if = '[ -f DBConnectionVerification.jar]',
+      not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
       environment = {'no_proxy': 'c6401.ambari.apache.org'}
     )
     self.assertResourceCalled('XmlConfig', 'hive-site.xml',
@@ -98,7 +98,7 @@ class TestHiveClient(RMFTestCase):
       recursive = True,
     )
     self.assertResourceCalled('Execute', "/bin/sh -c 'cd /usr/lib/ambari-agent/ && curl -kf -x \"\" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar'",
-      not_if = '[ -f DBConnectionVerification.jar]',
+      not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
       environment = {'no_proxy': 'c6401.ambari.apache.org'}
     )
     self.assertResourceCalled('XmlConfig', 'hive-site.xml',

ambari-server/src/test/python/stacks/1.3.2/HIVE/test_hive_metastore.py

@@ -184,7 +184,7 @@ class TestHiveMetastore(RMFTestCase):
       recursive = True,
     )
     self.assertResourceCalled('Execute', "/bin/sh -c 'cd /usr/lib/ambari-agent/ && curl -kf -x \"\" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar'",
-      not_if = '[ -f DBConnectionVerification.jar]',
+      not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
       environment = {'no_proxy': 'c6401.ambari.apache.org'}
     )
     self.assertResourceCalled('File', '/tmp/start_metastore_script',
@@ -251,7 +251,7 @@ class TestHiveMetastore(RMFTestCase):
       recursive = True,
     )
     self.assertResourceCalled('Execute', "/bin/sh -c 'cd /usr/lib/ambari-agent/ && curl -kf -x \"\" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar'",
-      not_if = '[ -f DBConnectionVerification.jar]',
+      not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
       environment = {'no_proxy': 'c6401.ambari.apache.org'}
     )
     self.assertResourceCalled('File', '/tmp/start_metastore_script',

ambari-server/src/test/python/stacks/1.3.2/HIVE/test_hive_server.py

@@ -233,7 +233,7 @@ class TestHiveServer(RMFTestCase):
       recursive = True,
     )
     self.assertResourceCalled('Execute', "/bin/sh -c 'cd /usr/lib/ambari-agent/ && curl -kf -x \"\" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar'",
-      not_if = '[ -f DBConnectionVerification.jar]',
+      not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
       environment = {'no_proxy': 'c6401.ambari.apache.org'}
     )
     self.assertResourceCalled('File', '/tmp/start_hiveserver2_script',
@@ -328,7 +328,7 @@ class TestHiveServer(RMFTestCase):
       recursive = True,
     )
     self.assertResourceCalled('Execute', "/bin/sh -c 'cd /usr/lib/ambari-agent/ && curl -kf -x \"\" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar'",
-      not_if = '[ -f DBConnectionVerification.jar]',
+      not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
       environment = {'no_proxy': 'c6401.ambari.apache.org'}
     )
     self.assertResourceCalled('File', '/tmp/start_hiveserver2_script',

ambari-server/src/test/python/stacks/1.3.2/HIVE/test_mysql_server.py

@@ -37,10 +37,10 @@ class TestMySqlServer(RMFTestCase):
                        config_file="default.json"
     )
 
-    self.assertResourceCalled('Execute', 'service mysql start',
+    self.assertResourceCalled('Execute', ('service','mysql','start'),
         logoutput = True,
         path = ['/usr/local/bin/:/bin/:/sbin/'],
-        user = 'mysql',
+        sudo = True,
     )
     self.assertNoMoreResources()
 
@@ -51,10 +51,10 @@ class TestMySqlServer(RMFTestCase):
                        config_file="default.json"
     )
 
-    self.assertResourceCalled('Execute', 'service mysql stop',
+    self.assertResourceCalled('Execute', ('service','mysql','stop'),
         logoutput = True,
         path = ['/usr/local/bin/:/bin/:/sbin/'],
-        user = 'mysql',
+        sudo = True,
     )
     self.assertNoMoreResources()
 
@@ -75,10 +75,10 @@ class TestMySqlServer(RMFTestCase):
                        config_file="secured.json"
     )
 
-    self.assertResourceCalled('Execute', 'service mysql start',
+    self.assertResourceCalled('Execute', ('service','mysql','start'),
         logoutput = True,
         path = ['/usr/local/bin/:/bin/:/sbin/'],
-        user = 'mysql',
+        sudo = True,
     )
     self.assertNoMoreResources()
 
@@ -88,18 +88,18 @@ class TestMySqlServer(RMFTestCase):
                        command = "stop",
                        config_file="secured.json"
     )
-    self.assertResourceCalled('Execute', 'service mysql stop',
+    self.assertResourceCalled('Execute', ('service','mysql','stop'),
         logoutput = True,
         path = ['/usr/local/bin/:/bin/:/sbin/'],
-        user = 'mysql',
+        sudo = True,
     )
     self.assertNoMoreResources()
 
   def assert_configure_default(self):
-    self.assertResourceCalled('Execute', 'service mysql start',
+    self.assertResourceCalled('Execute', ('service','mysql','start'),
         logoutput = True,
         path = ['/usr/local/bin/:/bin/:/sbin/'],
-        user = 'mysql',
+        sudo = True,
     )
     self.assertResourceCalled('File', '/tmp/addMysqlUser.sh',
       content = StaticFile('addMysqlUser.sh'),
@@ -110,17 +110,17 @@ class TestMySqlServer(RMFTestCase):
       tries = 3,
       try_sleep = 5,
     )
-    self.assertResourceCalled('Execute', 'service mysql stop',
+    self.assertResourceCalled('Execute', ('service','mysql','stop'),
       logoutput = True,
       path = ['/usr/local/bin/:/bin/:/sbin/'],
-      user = 'mysql',
+      sudo = True,
     )
 
   def assert_configure_secured(self):
-    self.assertResourceCalled('Execute', 'service mysql start',
+    self.assertResourceCalled('Execute', ('service','mysql','start'),
       logoutput = True,
       path = ['/usr/local/bin/:/bin/:/sbin/'],
-      user = 'mysql',
+      sudo = True,
     )
     self.assertResourceCalled('File', '/tmp/addMysqlUser.sh',
       content = StaticFile('addMysqlUser.sh'),
@@ -131,8 +131,8 @@ class TestMySqlServer(RMFTestCase):
       tries = 3,
       try_sleep = 5,
     )
-    self.assertResourceCalled('Execute', 'service mysql stop',
+    self.assertResourceCalled('Execute', ('service','mysql','stop'),
       logoutput = True,
       path = ['/usr/local/bin/:/bin/:/sbin/'],
-      user = 'mysql',
+      sudo = True,
     )

ambari-server/src/test/python/stacks/2.0.6/HIVE/test_hive_client.py

@@ -112,7 +112,7 @@ class TestHiveClient(RMFTestCase):
                               )
     self.assertResourceCalled('Execute', '/bin/sh -c \'cd /usr/lib/ambari-agent/ && curl -kf -x "" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar\'',
         environment = {'no_proxy': 'c6401.ambari.apache.org'},
-        not_if = '[ -f DBConnectionVerification.jar]',
+        not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
     )
     self.assertNoMoreResources()
 
@@ -208,6 +208,6 @@ class TestHiveClient(RMFTestCase):
                               )
     self.assertResourceCalled('Execute', '/bin/sh -c \'cd /usr/lib/ambari-agent/ && curl -kf -x "" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar\'',
         environment = {'no_proxy': 'c6401.ambari.apache.org'},
-        not_if = '[ -f DBConnectionVerification.jar]',
+        not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
     )
     self.assertNoMoreResources()

ambari-server/src/test/python/stacks/2.0.6/HIVE/test_hive_metastore.py

@@ -208,7 +208,7 @@ class TestHiveMetastore(RMFTestCase):
     )
     self.assertResourceCalled('Execute', '/bin/sh -c \'cd /usr/lib/ambari-agent/ && curl -kf -x "" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar\'',
         environment = {'no_proxy': 'c6401.ambari.apache.org'},
-        not_if = '[ -f DBConnectionVerification.jar]',
+        not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
     )
     self.assertResourceCalled('File', '/tmp/start_metastore_script',
         content = StaticFile('startMetastore.sh'),
@@ -329,7 +329,7 @@ class TestHiveMetastore(RMFTestCase):
     )
     self.assertResourceCalled('Execute', '/bin/sh -c \'cd /usr/lib/ambari-agent/ && curl -kf -x "" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar\'',
         environment = {'no_proxy': 'c6401.ambari.apache.org'},
-        not_if = '[ -f DBConnectionVerification.jar]',
+        not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
     )
     self.assertResourceCalled('File', '/tmp/start_metastore_script',
         content = StaticFile('startMetastore.sh'),

ambari-server/src/test/python/stacks/2.0.6/HIVE/test_hive_server.py

@@ -328,7 +328,7 @@ class TestHiveServer(RMFTestCase):
     )
     self.assertResourceCalled('Execute', '/bin/sh -c \'cd /usr/lib/ambari-agent/ && curl -kf -x "" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar\'',
         environment = {'no_proxy': 'c6401.ambari.apache.org'},
-        not_if = '[ -f DBConnectionVerification.jar]',
+        not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
     )
     self.assertResourceCalled('File', '/tmp/start_hiveserver2_script',
         content = Template('startHiveserver2.sh.j2'),
@@ -480,7 +480,7 @@ class TestHiveServer(RMFTestCase):
     )
     self.assertResourceCalled('Execute', '/bin/sh -c \'cd /usr/lib/ambari-agent/ && curl -kf -x "" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar\'',
         environment = {'no_proxy': 'c6401.ambari.apache.org'},
-        not_if = '[ -f DBConnectionVerification.jar]',
+        not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
     )
     self.assertResourceCalled('File', '/tmp/start_hiveserver2_script',
         content = Template('startHiveserver2.sh.j2'),

ambari-server/src/test/python/stacks/2.0.6/HIVE/test_mysql_server.py

@@ -44,10 +44,10 @@ class TestMySqlServer(RMFTestCase):
      '/etc/my.cnf'),
         sudo = True,
     )
-    self.assertResourceCalled('Execute', 'service mysql start',
+    self.assertResourceCalled('Execute', ('service','mysql','start'),
                        logoutput = True,
                        not_if = 'service mysql status | grep running',
-                       user = 'mysql',
+                       sudo = True,
     )
     self.assertNoMoreResources()
 
@@ -57,10 +57,10 @@ class TestMySqlServer(RMFTestCase):
                        command = "stop",
                        config_file="default.json"
     )
-    self.assertResourceCalled('Execute', 'service mysql stop',
+    self.assertResourceCalled('Execute', ('service','mysql','stop'),
                               logoutput = True,
                               only_if = 'service mysql status | grep running',
-                              user = 'mysql',
+                              sudo = True,
     )
     self.assertNoMoreResources()
 
@@ -87,10 +87,10 @@ class TestMySqlServer(RMFTestCase):
      '/etc/my.cnf'),
         sudo = True,
     )
-    self.assertResourceCalled('Execute', 'service mysql start',
+    self.assertResourceCalled('Execute', ('service','mysql','start'),
                               logoutput = True,
                               not_if = 'service mysql status | grep running',
-                              user = 'mysql',
+                              sudo = True,
                               )
     self.assertNoMoreResources()
 
@@ -101,10 +101,10 @@ class TestMySqlServer(RMFTestCase):
                        config_file="secured.json"
     )
     
-    self.assertResourceCalled('Execute', 'service mysql stop',
+    self.assertResourceCalled('Execute', ('service','mysql','stop'),
                               logoutput = True,
                               only_if = 'service mysql status | grep running',
-                              user = 'mysql',
+                              sudo = True,
                               )
     self.assertNoMoreResources()
 

ambari-server/src/test/python/stacks/2.1/HIVE/test_hive_metastore.py

@@ -186,7 +186,7 @@ class TestHiveMetastore(RMFTestCase):
     )
     self.assertResourceCalled('Execute', '/bin/sh -c \'cd /usr/lib/ambari-agent/ && curl -kf -x "" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar\'',
         environment = {'no_proxy': 'c6401.ambari.apache.org'},
-        not_if = '[ -f DBConnectionVerification.jar]',
+        not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
     )
     self.assertResourceCalled('File', '/tmp/start_metastore_script',
         content = StaticFile('startMetastore.sh'),
@@ -286,7 +286,7 @@ class TestHiveMetastore(RMFTestCase):
     )
     self.assertResourceCalled('Execute', '/bin/sh -c \'cd /usr/lib/ambari-agent/ && curl -kf -x "" --retry 5 http://c6401.ambari.apache.org:8080/resources/DBConnectionVerification.jar -o DBConnectionVerification.jar\'',
         environment = {'no_proxy': 'c6401.ambari.apache.org'},
-        not_if = '[ -f DBConnectionVerification.jar]',
+        not_if = '[ -f /usr/lib/ambari-agent/DBConnectionVerification.jar ]',
     )
     self.assertResourceCalled('File', '/tmp/start_metastore_script',
         content = StaticFile('startMetastore.sh'),