[
https://issues.apache.org/jira/browse/TEZ-4741?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
László Bodor updated TEZ-4741:
------------------------------
Description: Tez exposes two profiler endpoints on the AM Web UI: /prof
(triggers async-profiler and produces an output file under /tmp/prof-output)
and /prof-output (serves those files). /prof correctly gated itself with
HttpServer2.isInstrumentationAccessAllowed(...), Hadoop's admin ACL check.
/prof-output had no auth check whatsoever. Anyone who could reach the AM web
port could enumerate that directory and read every profile file — SVG flame
graphs, JFR traces, stack dumps — including any generated by a legitimate
admin. There was a path-normalization check to prevent reads outside
/tmp/prof-output, but nothing to prevent reads within it.
> ProfileOutputServlet: require instrumentation ACL to read profiler output
> -------------------------------------------------------------------------
>
> Key: TEZ-4741
> URL: https://issues.apache.org/jira/browse/TEZ-4741
> Project: Apache Tez
> Issue Type: Improvement
> Reporter: László Bodor
> Priority: Major
>
> Tez exposes two profiler endpoints on the AM Web UI: /prof (triggers
> async-profiler and produces an output file under /tmp/prof-output) and
> /prof-output (serves those files). /prof correctly gated itself with
> HttpServer2.isInstrumentationAccessAllowed(...), Hadoop's admin ACL check.
> /prof-output had no auth check whatsoever. Anyone who could reach the AM web
> port could enumerate that directory and read every profile file — SVG flame
> graphs, JFR traces, stack dumps — including any generated by a legitimate
> admin. There was a path-normalization check to prevent reads outside
> /tmp/prof-output, but nothing to prevent reads within it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
