[
https://issues.apache.org/jira/browse/YARN-9583?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16898824#comment-16898824
]
Prabhu Joseph commented on YARN-9583:
-------------------------------------
[~magnum] The patch looks good. +1 (non-binding).
Have verified below testcases on a Secure Cluster with ACLs enabled.
{code}
1. Admin user (yarn.admin.acl) and user specified in View ACL
(mapreduce.job.acl-view-job) are allowed to view.
2. Other users are not allowed to view.
{code}
[~snemeth] Can you review this Jira when you get time. Thanks.
> Failed job which is submitted unknown queue is showed all users
> ---------------------------------------------------------------
>
> Key: YARN-9583
> URL: https://issues.apache.org/jira/browse/YARN-9583
> Project: Hadoop YARN
> Issue Type: Bug
> Components: security
> Affects Versions: 3.1.2
> Reporter: KWON BYUNGCHANG
> Assignee: KWON BYUNGCHANG
> Priority: Major
> Attachments: YARN-9583-screenshot.png, YARN-9583.001.patch,
> YARN-9583.002.patch, YARN-9583.003.patch, YARN-9583.004.patch,
> YARN-9583.005.patch
>
>
> In secure mode, Failed job which is submitted unknown queue is showed all
> users.
> I attached RM UI screen shot.
> reproduction senario
> 1. user foo submit job to unknown queue without view-acl and job will fail
> immediately.
> 2. user bar can access the job of user foo which previously failed.
> According to comments in QueueACLsManager .java that caused the problem,
> This situation can happen when RM is restarted after deleting queue.
> I think showing app of non existing queue to all users is the problem after
> RM start.
> It will become a security hole.
> I fixed it a little bit.
> After fixing it, Both owner of job and admin of yarn can access job which is
> submitted unknown queue.
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
