Hi, A user logged an issue with Yarn that I finally got around to looking at. The proposed patch submitted by the user is here:
https://reviews.apache.org/r/56094/ The problem is that a user "alice" can have the "submit-app" permission, but be denied the "admin-queue" permission. This should work in theory, but it doesn't. "admin-queue" implies "submit-app", but the Ranger policy logic seems to interpret this implication incorrectly, in that a "negative" admin-queue policy overrides a "positive" submit-app policy. As the change is in the core policy logic I'd like an experienced reviewer to take a look. Colm. -- Colm O hEigeartaigh Talend Community Coder http://coders.talend.com
