[
https://issues.apache.org/jira/browse/TEZ-4741?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
László Bodor updated TEZ-4741:
------------------------------
Fix Version/s: 1.0.0
0.10.6
> ProfileOutputServlet: require instrumentation ACL to read profiler output
> -------------------------------------------------------------------------
>
> Key: TEZ-4741
> URL: https://issues.apache.org/jira/browse/TEZ-4741
> Project: Apache Tez
> Issue Type: Improvement
> Reporter: László Bodor
> Assignee: Raghav Aggarwal
> Priority: Major
> Fix For: 1.0.0, 0.10.6
>
> Time Spent: 1h 50m
> Remaining Estimate: 0h
>
> Tez exposes two profiler endpoints on the AM Web UI: /prof (triggers
> async-profiler and produces an output file under /tmp/prof-output) and
> /prof-output (serves those files). /prof correctly gated itself with
> HttpServer2.isInstrumentationAccessAllowed(...), Hadoop's admin ACL check.
> /prof-output had no auth check whatsoever. Anyone who could reach the AM web
> port could enumerate that directory and read every profile file — SVG flame
> graphs, JFR traces, stack dumps — including any generated by a legitimate
> admin. There was a path-normalization check to prevent reads outside
> /tmp/prof-output, but nothing to prevent reads within it.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
