AMBARI-1241. non-root ambari server + umask 027 fails on ubuntu (aonishuk)

ambari-server/src/main/python/ambari_server/serverSetup.py

@@ -23,6 +23,7 @@ import os
 import re
 import shutil
 import sys
+import subprocess
 
 from ambari_commons.exceptions import FatalException
 from ambari_commons.firewall import Firewall
@@ -537,6 +538,7 @@ class JDKSetup(object):
     try:
       jdk_path = properties.get_property(JAVA_HOME_PROPERTY)
       JDKSetup.unpack_jce_policy(jdk_path, resources_dir, jdk_cfg.dest_jcpol_file)
+      self.adjust_jce_permissions(jdk_path)
     except FatalException, e:
       print err_msg_stdout
       print_error_msg("Failed to install JCE policy files:")
@@ -612,7 +614,10 @@ class JDKSetup(object):
   # Base implementation, overriden in the subclasses
   def _install_jdk(self, java_inst_file, java_home_dir):
     pass
-
+  
+  def adjust_jce_permissions(self, jdk_path):
+    pass
+  
   # Base implementation, overriden in the subclasses
   def _ensure_java_home_env_var_is_set(self, java_home_dir):
     pass
@@ -707,6 +712,7 @@ class JDKSetupLinux(JDKSetup):
 
     self.CREATE_JDK_DIR_CMD = "/bin/mkdir -p {0}"
     self.CHMOD_JDK_DIR_CMD = "chmod a+x {0}"
+    self.SET_JCE_PERMISSIONS = "chown {0} {1}/{2}/*"
 
     # use --no-same-owner when running as root to prevent uucp as the user (AMBARI-6478)
     self.UNTAR_JDK_ARCHIVE = "tar --no-same-owner -xvf {0}"
@@ -742,6 +748,17 @@ class JDKSetupLinux(JDKSetup):
   def _ensure_java_home_env_var_is_set(self, java_home_dir):
     #No way to do this in Linux. Best we can is to set the process environment variable.
     os.environ[JAVA_HOME] = java_home_dir
+    
+  def adjust_jce_permissions(self, jdk_path):
+    ambari_user = read_ambari_user()
+    cmd = self.SET_JCE_PERMISSIONS.format(ambari_user, jdk_path,configDefaults.JDK_SECURITY_DIR)
+    process = subprocess.Popen(cmd,
+                           stdout=subprocess.PIPE,
+                           stdin=subprocess.PIPE,
+                           stderr=subprocess.PIPE,
+                           shell=True
+                           )
+    (stdoutdata, stderrdata) = process.communicate()
 
 def download_and_install_jdk(options):
   properties = get_ambari_properties()

ambari-server/src/test/python/TestAmbariServer.py

@@ -2068,6 +2068,7 @@ MIIFHjCCAwYCCQDpHKOBI+Lt0zANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJV
     pass
 
   @patch.object(OSCheck, "os_distribution", new = MagicMock(return_value = os_distro_value))
+  @patch("ambari_server.serverSetup.read_ambari_user")
   @patch("os.stat")
   @patch("os.path.isfile")
   @patch("os.path.exists")
@@ -2087,7 +2088,7 @@ MIIFHjCCAwYCCQDpHKOBI+Lt0zANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJV
   def test_download_jdk(self, exit_mock, copyfile_mock, get_ambari_properties_mock, get_JAVA_HOME_mock, \
                         validate_jdk_mock, print_info_msg_mock, get_validated_string_input_mock, update_properties_mock, \
                         run_os_command_mock, get_YN_input_mock, force_download_file_mock, expand_jce_zip_file_mock,
-                        os_chdir_mock, path_existsMock, path_isfileMock, statMock):
+                        os_chdir_mock, path_existsMock, path_isfileMock, statMock, read_ambari_user_mock):
     args = MagicMock()
     args.java_home = "somewhere"
     args.silent = False
@@ -2105,6 +2106,7 @@ MIIFHjCCAwYCCQDpHKOBI+Lt0zANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJV
     validate_jdk_mock.return_value = False
     path_existsMock.return_value = False
     get_JAVA_HOME_mock.return_value = False
+    read_ambari_user_mock.return_value = "ambari"
     get_ambari_properties_mock.return_value = p
     # Test case: ambari.properties not found
     try: