[jira] [Resolved] (YARN-11066) Flexible AQC doesn't check the Queue ACLs when submitting apps
[
https://issues.apache.org/jira/browse/YARN-11066?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tamas Domok resolved YARN-11066.
Resolution: Fixed
It's fixed in YARN-11069, branch-3.3 is not affected there is no
auto-queue-creation-v2 there yet.
> Flexible AQC doesn't check the Queue ACLs when submitting apps
> --
>
> Key: YARN-11066
> URL: https://issues.apache.org/jira/browse/YARN-11066
> Project: Hadoop YARN
> Issue Type: Bug
> Components: capacityscheduler, yarn
>Affects Versions: 3.4.0
>Reporter: Tamas Domok
>Assignee: Tamas Domok
>Priority: Critical
> Attachments: Screenshot 2022-01-21 at 10.00.32.png,
> capacity-scheduler.xml
>
>
> Reproduction steps:
> 1. Use the attached configuration: [^capacity-scheduler.xml]
> 2. Enable *yarn.acl.enable* in yarn-site.xml.
> 3. Try to submit an application with any user other than *user1, user2,
> user3*.
> {code}
> yarn jar hadoop-mapreduce-examples-3.4.0-SNAPSHOT.jar pi 1 10
> {code}
> The *first* app submission will succeed with *someuser:somegroup* the
> *root.parent.somegroup.someuser* queue will be created. When the
> *root.parent.somegroup* dynamic parent queue already exists then the ACLs in
> *root.parent* will be checked and the *someuser* won't be able to submit an
> another app. But queues are deleted automatically, so this is a serious
> security issue.
> This issue doesn't happen when dynamic parent queue is not created just a
> dynamic leaf queue.
> Another inconsistency is that the ACLs configured with templates works on
> dynamic leaf queues, but not when there is a dynamic parent queue too.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
-
To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org
[jira] [Created] (YARN-11106) Fix the test failure due to missing conf of yarn.resourcemanager.node-labels.am.default-node-label-expression
Junfan Zhang created YARN-11106: --- Summary: Fix the test failure due to missing conf of yarn.resourcemanager.node-labels.am.default-node-label-expression Key: YARN-11106 URL: https://issues.apache.org/jira/browse/YARN-11106 Project: Hadoop YARN Issue Type: Bug Reporter: Junfan Zhang -- This message was sent by Atlassian Jira (v8.20.1#820001) - To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org
[jira] [Assigned] (YARN-11106) Fix the test failure due to missing conf of yarn.resourcemanager.node-labels.am.default-node-label-expression
[ https://issues.apache.org/jira/browse/YARN-11106?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Junfan Zhang reassigned YARN-11106: --- Assignee: Junfan Zhang > Fix the test failure due to missing conf of > yarn.resourcemanager.node-labels.am.default-node-label-expression > - > > Key: YARN-11106 > URL: https://issues.apache.org/jira/browse/YARN-11106 > Project: Hadoop YARN > Issue Type: Bug >Reporter: Junfan Zhang >Assignee: Junfan Zhang >Priority: Major > -- This message was sent by Atlassian Jira (v8.20.1#820001) - To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org
[jira] [Updated] (YARN-11106) Fix the test failure due to missing conf of yarn.resourcemanager.node-labels.am.default-node-label-expression
[ https://issues.apache.org/jira/browse/YARN-11106?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] ASF GitHub Bot updated YARN-11106: -- Labels: pull-request-available (was: ) > Fix the test failure due to missing conf of > yarn.resourcemanager.node-labels.am.default-node-label-expression > - > > Key: YARN-11106 > URL: https://issues.apache.org/jira/browse/YARN-11106 > Project: Hadoop YARN > Issue Type: Bug >Reporter: Junfan Zhang >Assignee: Junfan Zhang >Priority: Major > Labels: pull-request-available > Time Spent: 10m > Remaining Estimate: 0h > -- This message was sent by Atlassian Jira (v8.20.1#820001) - To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org
[jira] [Resolved] (YARN-11106) Fix the test failure due to missing conf of yarn.resourcemanager.node-labels.am.default-node-label-expression
[ https://issues.apache.org/jira/browse/YARN-11106?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Benjamin Teke resolved YARN-11106. -- Fix Version/s: 3.4.0 Hadoop Flags: Reviewed Resolution: Fixed > Fix the test failure due to missing conf of > yarn.resourcemanager.node-labels.am.default-node-label-expression > - > > Key: YARN-11106 > URL: https://issues.apache.org/jira/browse/YARN-11106 > Project: Hadoop YARN > Issue Type: Bug >Reporter: Junfan Zhang >Assignee: Junfan Zhang >Priority: Major > Labels: pull-request-available > Fix For: 3.4.0 > > Time Spent: 50m > Remaining Estimate: 0h > -- This message was sent by Atlassian Jira (v8.20.1#820001) - To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org
