Securing Tenant Isolated Directories
To secure a tenant isolated directory it is necessary to secure the directory both against unauthorized detection
and against unauthorized use. Securing tenant isolated directories against unauthorized observation involves
securing the parent of the tenant isolated directory against reading by tenants while permitting the parent directory
to be traversed in a pathname lookup. This can be achieved by removing group and world read permission on the
directory, while retaining the group and world search (execute) permissions. The permission value 711 (
rwx----
)
does this while allowing users to reach their authorized tenant sub-directories.
Securing the tenant sub-directory (or any directory containing tenant private data) against unauthorized use
involves the following additional steps.
1. Assign a different group for each tenant and assign each target directory to its respective tenant group.
2. Assign all users who belong to the tenant to the group associated with the tenant so they will have access to
the directory.
3. Secure each target directory against reading, writing or searching by anyone outside the tenant group. A
mode of
1770
(
trwxrwx----
) does this while only permitting tenant members to see the files in the
directory.
If users within the tenant are expected to share write access to the target directory, creating their own files and
directories in the target directory, then a mode of 1770 (trw---) may be helpful because it allows all members of the
tenant group to read and write the directory but does not permit users to remove or rename files they do not own.
If users within the tenant are not expected to share write access to the target directory the mode 750 (rwx-r-x---)
may be helpful since this only allows the owner of the directory to create/remove/rename files and directories in it.
Automatic Assignment of Tenant Group Ownership and mode 0750 to an automatically
Created Directory Defined in a 'mount' Configuration.
The mechanism of automatically assigning the tenant group ownership and mode 0750 to an automatically
created directory defined in a 'mount' configuration is controlled by a setting in the tenant configuration file
(
/etc/sysconfig/uxtenant/tenants/
tenantName
) called
UXTENANT_TENANT_GROUP_NAME
. This is an
optional setting that. If set, this setting causes any directory created as the result of setting up a mount
(
/etc/sysconfig/uxtenant/mounts/
mountName
) that has the
UXTENANT_MOUNT_EXPORT_CREATE
value
set to '
yes
' with a permission of 0750 (rwxr-x---) and a group ownership equivalent to the named group. If the
named group does not exist on the host node, the
ux-tenant-create
command will fail for that tenant. If
UXTENANT_TENANT_GROUP_NAME
is not set in the tenant configuration, newly created directories are created
with mode 0755 (rwx-r-xr-x) and group
root
.
assigning the Tenant group ownership and 0750 mode to an automatically created
Securing Non-isolated Directories
Securing non-isolated directories containing tenant data (if such directories exist) is achieved using the approach
described above for securing tenant isolated sub-directories against unauthorized use .
7.5.8
Multi-tenant HDFS
When the system is in the default service mode, tenants and non-restricted users use the same (default)
NameNode. When the system is in the secure mode, tenants each have their own HDFS NameNode (name
space) isolating them from non-restricted users and other restricted users in different tenants. Non-restricted
users have access to the same NameNode that is used in default mode, with HDFS security enabled.
Security
S3016
203
