Java PrivilegedOperationException类代码示例

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
private void initializeState() throws ResourceHandlerException {
  LOG.info("Initializing tc state.");

  BatchBuilder builder = new BatchBuilder(PrivilegedOperation.
      OperationType.TC_MODIFY_STATE)
      .addRootQDisc()
      .addCGroupFilter()
      .addClassToRootQDisc(rootBandwidthMbit)
      .addDefaultClass(defaultClassBandwidthMbit, rootBandwidthMbit)
          //yarn bandwidth is capped with rate = ceil
      .addYARNRootClass(yarnBandwidthMbit, yarnBandwidthMbit);
  PrivilegedOperation op = builder.commitBatchToTempFile();

  try {
    privilegedOperationExecutor.executePrivilegedOperation(op, false);
  } catch (PrivilegedOperationException e) {
    LOG.warn("Failed to bootstrap outbound bandwidth configuration");

    throw new ResourceHandlerException(
        "Failed to bootstrap outbound bandwidth configuration", e);
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
private void recoverAcquireContainerClasses(int containerBandwidthMbit, boolean strictMode) throws ResourceHandlerException {
  LOG.info("Recovering acquired container's tc state.");

  BatchBuilder builder = new BatchBuilder(PrivilegedOperation.
      OperationType.TC_MODIFY_STATE);

  for (int i = this.classIdSet.nextSetBit(0); i >= 0; i = this.classIdSet.nextSetBit(i+1)) {
    int classId = i + MIN_CONTAINER_CLASS_ID;
    builder.addContainerClass(classId, containerBandwidthMbit, strictMode);
    LOG.info("Recovered container classid: " + classId);
  }

  PrivilegedOperation op = builder.commitBatchToTempFile();

  try {
    privilegedOperationExecutor.executePrivilegedOperation(op, false);
  } catch (PrivilegedOperationException e) {
    LOG.warn("Failed to bootstrap outbound bandwidth configuration");

    throw new ResourceHandlerException(
        "Failed to bootstrap outbound bandwidth configuration", e);
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
private void wipeState() throws ResourceHandlerException {
  BatchBuilder builder = new BatchBuilder(PrivilegedOperation.
      OperationType.TC_MODIFY_STATE)
      .wipeState();
  PrivilegedOperation op = builder.commitBatchToTempFile();

  try {
    LOG.info("Wiping tc state.");
    privilegedOperationExecutor.executePrivilegedOperation(op, false);
  } catch (PrivilegedOperationException e) {
    LOG.warn("Failed to wipe tc state. This could happen if the interface" +
        " is already in its default state. Ignoring.");
    //Ignoring this exception. This could happen if the interface is already
    //in its default state. For this reason we don't throw a
    //ResourceHandlerException here.
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
public Map<Integer, Integer> readStats() throws ResourceHandlerException {
  BatchBuilder builder = new BatchBuilder(PrivilegedOperation.
      OperationType.TC_READ_STATS)
      .readClasses();
  PrivilegedOperation op = builder.commitBatchToTempFile();

  try {
    String output =
        privilegedOperationExecutor.executePrivilegedOperation(op, true);

    if (LOG.isDebugEnabled()) {
      LOG.debug("TC stats output:" + output);
    }

    Map<Integer, Integer> classIdBytesStats = parseStatsString(output);

    if (LOG.isDebugEnabled()) {
      LOG.debug("classId -> bytes sent %n" + classIdBytesStats);
    }

    return classIdBytesStats;
  } catch (PrivilegedOperationException e) {
    LOG.warn("Failed to get tc stats");
    throw new ResourceHandlerException("Failed to get tc stats", e);
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
private void executeDockerLoadCommand(DockerLoadCommand cmd,
    ContainerRuntimeContext ctx)
    throws ContainerExecutionException {
  Container container = ctx.getContainer();
  String containerIdStr = container.getContainerId().toString();
  String commandFile = dockerClient.writeCommandToTempFile(cmd,
      containerIdStr);
  PrivilegedOperation launchOp = new PrivilegedOperation(
      PrivilegedOperation.OperationType.RUN_DOCKER_CMD);

  launchOp.appendArgs(commandFile);

  try {
    privilegedOperationExecutor.executePrivilegedOperation(null,
        launchOp, null, container.getLaunchContext().getEnvironment(),
        false);
  } catch (PrivilegedOperationException e) {
    LOG.warn("Docker load operation failed. Exception: ", e);
    throw new ContainerExecutionException("Docker load operation failed", e
        .getExitCode(), e.getOutput(), e.getErrorOutput());
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
public void mountCgroups(List<String> cgroupKVs, String hierarchy)
    throws IOException {
  try {
    PrivilegedOperation mountCGroupsOp = new PrivilegedOperation(
        PrivilegedOperation.OperationType.MOUNT_CGROUPS, hierarchy);
    Configuration conf = super.getConf();

    mountCGroupsOp.appendArgs(cgroupKVs);
    PrivilegedOperationExecutor privilegedOperationExecutor =
        PrivilegedOperationExecutor.getInstance(conf);

    privilegedOperationExecutor.executePrivilegedOperation(mountCGroupsOp,
        false);
  } catch (PrivilegedOperationException e) {
    int exitCode = e.getExitCode();
    LOG.warn("Exception in LinuxContainerExecutor mountCgroups ", e);

    throw new IOException("Problem mounting cgroups " + cgroupKVs +
        "; exit code = " + exitCode + " and output: " + e.getOutput(),
        e);
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private PrivilegedOperation capturePrivilegedOperation()
    throws PrivilegedOperationException {
  ArgumentCaptor<PrivilegedOperation> opCaptor = ArgumentCaptor.forClass(
      PrivilegedOperation.class);

  //single invocation expected
  //due to type erasure + mocking, this verification requires a suppress
  // warning annotation on the entire method
  verify(mockExecutor, times(1))
      .executePrivilegedOperation(anyList(), opCaptor.capture(), any(
          File.class), any(Map.class), eq(false));

  //verification completed. we need to isolate specific invications.
  // hence, reset mock here
  Mockito.reset(mockExecutor);

  return opCaptor.getValue();
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private PrivilegedOperation captureDockerLoadPrivilegedOperationAndVerifyArgs()
    throws PrivilegedOperationException {
  ArgumentCaptor<PrivilegedOperation> opCaptor = ArgumentCaptor.forClass(
      PrivilegedOperation.class);
  verify(mockExecutor, times(1))
      .executePrivilegedOperation(anyList(), opCaptor.capture(), any(
          File.class), any(Map.class), eq(false));

  PrivilegedOperation op = opCaptor.getValue();

  Assert.assertEquals(PrivilegedOperation.OperationType
      .RUN_DOCKER_CMD, op.getOperationType());
  List<String> args = op.getArguments();
  Assert.assertEquals(1, args.size());
  return op;
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
@Test
public void testDockerContainerPrepare()
    throws ContainerExecutionException, PrivilegedOperationException, IOException {
  String validImageFileRegex = "busybox.*";
  DockerLinuxContainerRuntime runtime = new DockerLinuxContainerRuntime(
      mockExecutor, mockCGroupsHandler);
  runtime.initialize(conf);
  Map<Path, List<String>> localizedResources = new HashMap<Path,List<String>>();
  localizedResources.put(new Path(containerWorkDir+ "/busybox.tar"),null);
  env.put(DockerLinuxContainerRuntime.ENV_DOCKER_CONTAINER_IMAGE_FILE, validImageFileRegex);
  builder.setExecutionAttribute(LOCALIZED_RESOURCES, localizedResources);
  runtime.prepareContainer(builder.build());
  PrivilegedOperation op = captureDockerLoadPrivilegedOperationAndVerifyArgs();
  List<String> args = op.getArguments();
  String dockerCommandFile = args.get(0);
  String expectedCommand = "load --input " + containerWorkDir+ "/busybox.tar";
  List<String> dockerCommands = Files.readAllLines(Paths.get
      (dockerCommandFile), Charset.forName("UTF-8"));
  Assert.assertEquals(expectedCommand, dockerCommands.get(0));
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
@Test
public void testLaunchPrivilegedContainersWithDisabledSetting()
    throws ContainerExecutionException, PrivilegedOperationException,
    IOException{
  DockerLinuxContainerRuntime runtime = new DockerLinuxContainerRuntime(
      mockExecutor, mockCGroupsHandler);
  runtime.initialize(conf);

  env.put("YARN_CONTAINER_RUNTIME_DOCKER_RUN_PRIVILEGED_CONTAINER",
      "true");

  try {
    runtime.launchContainer(builder.build());
    Assert.fail("Expected a privileged launch container failure.");
  } catch (ContainerExecutionException e) {
    LOG.info("Caught expected exception : " + e);
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
@Test
public void testLaunchPrivilegedContainersWithEnabledSettingAndDefaultACL()
    throws ContainerExecutionException, PrivilegedOperationException,
    IOException{
  //Enable privileged containers.
  conf.setBoolean(YarnConfiguration.NM_DOCKER_ALLOW_PRIVILEGED_CONTAINERS,
      true);

  DockerLinuxContainerRuntime runtime = new DockerLinuxContainerRuntime(
      mockExecutor, mockCGroupsHandler);
  runtime.initialize(conf);

  env.put("YARN_CONTAINER_RUNTIME_DOCKER_RUN_PRIVILEGED_CONTAINER",
      "true");
  //By default
  // yarn.nodemanager.runtime.linux.docker.privileged-containers.acl
  // is empty. So we expect this launch to fail.

  try {
    runtime.launchContainer(builder.build());
    Assert.fail("Expected a privileged launch container failure.");
  } catch (ContainerExecutionException e) {
    LOG.info("Caught expected exception : " + e);
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
@Test
public void
testLaunchPrivilegedContainersEnabledAndUserNotInWhitelist()
    throws ContainerExecutionException, PrivilegedOperationException,
    IOException{
  //Enable privileged containers.
  conf.setBoolean(YarnConfiguration.NM_DOCKER_ALLOW_PRIVILEGED_CONTAINERS,
      true);
  //set whitelist of users.
  conf.set(YarnConfiguration.NM_DOCKER_PRIVILEGED_CONTAINERS_ACL,
      whitelistedUser);

  DockerLinuxContainerRuntime runtime = new DockerLinuxContainerRuntime(
      mockExecutor, mockCGroupsHandler);
  runtime.initialize(conf);

  env.put("YARN_CONTAINER_RUNTIME_DOCKER_RUN_PRIVILEGED_CONTAINER",
      "true");

  try {
    runtime.launchContainer(builder.build());
    Assert.fail("Expected a privileged launch container failure.");
  } catch (ContainerExecutionException e) {
    LOG.info("Caught expected exception : " + e);
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
@Test
public void testMountSourceOnly()
    throws ContainerExecutionException, PrivilegedOperationException,
    IOException{
  DockerLinuxContainerRuntime runtime = new DockerLinuxContainerRuntime(
      mockExecutor, mockCGroupsHandler);
    runtime.initialize(conf);

    env.put(
            DockerLinuxContainerRuntime.ENV_DOCKER_CONTAINER_LOCAL_RESOURCE_MOUNTS,
      "source");

  try {
    runtime.launchContainer(builder.build());
    Assert.fail("Expected a launch container failure due to invalid mount.");
  } catch (ContainerExecutionException e) {
    LOG.info("Caught expected exception : " + e);
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
@Test
public void testMountInvalid()
    throws ContainerExecutionException, PrivilegedOperationException,
    IOException{
  DockerLinuxContainerRuntime runtime = new DockerLinuxContainerRuntime(
      mockExecutor, mockCGroupsHandler);
  runtime.initialize(conf);

  env.put(
      DockerLinuxContainerRuntime.ENV_DOCKER_CONTAINER_LOCAL_RESOURCE_MOUNTS,
      "source:target:other");

  try {
    runtime.launchContainer(builder.build());
    Assert.fail("Expected a launch container failure due to invalid mount.");
  } catch (ContainerExecutionException e) {
    LOG.info("Caught expected exception : " + e);
  }
}
 

import org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.privileged.PrivilegedOperationException; //导入依赖的package包/类
@Test
public void testContainerLivelinessCheck()
    throws ContainerExecutionException, PrivilegedOperationException {

  DockerLinuxContainerRuntime runtime = new DockerLinuxContainerRuntime(
      mockExecutor, mockCGroupsHandler);
  builder.setExecutionAttribute(RUN_AS_USER, runAsUser)
      .setExecutionAttribute(USER, user)
      .setExecutionAttribute(PID, signalPid)
          .setExecutionAttribute(SIGNAL, ContainerExecutor.Signal.NULL);
    runtime.initialize(getConfigurationWithMockContainerExecutor());
    runtime.signalContainer(builder.build());

  PrivilegedOperation op = capturePrivilegedOperation();
  Assert.assertEquals(op.getOperationType(),
      PrivilegedOperation.OperationType.SIGNAL_CONTAINER);
  Assert.assertEquals("run_as_user", op.getArguments().get(0));
  Assert.assertEquals("user", op.getArguments().get(1));
  Assert.assertEquals("2", op.getArguments().get(2));
  Assert.assertEquals("1234", op.getArguments().get(3));
    Assert.assertEquals("0", op.getArguments().get(4));
}