[
https://issues.apache.org/jira/browse/YARN-9583?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16900619#comment-16900619
]
Sunil Govindan commented on YARN-9583:
--------------------------------------
Thanks [~magnum]
[~Prabhu Joseph] and [~magnum], i am worried about one scenario here. Assume an
application has been submitted on to a queue named "queueA" and successfully
completed. Now delete queueA and restart RM. Will RM be able to recover this
app and keep the state as SUCCESS.
Could you please cross check this case as well?
> Failed job which is submitted unknown queue is showed all users
> ---------------------------------------------------------------
>
> Key: YARN-9583
> URL: https://issues.apache.org/jira/browse/YARN-9583
> Project: Hadoop YARN
> Issue Type: Bug
> Components: security
> Affects Versions: 3.1.2
> Reporter: KWON BYUNGCHANG
> Assignee: KWON BYUNGCHANG
> Priority: Major
> Attachments: YARN-9583-screenshot.png, YARN-9583.001.patch,
> YARN-9583.002.patch, YARN-9583.003.patch, YARN-9583.004.patch,
> YARN-9583.005.patch
>
>
> In secure mode, Failed job which is submitted unknown queue is showed all
> users.
> I attached RM UI screen shot.
> reproduction senario
> 1. user foo submit job to unknown queue without view-acl and job will fail
> immediately.
> 2. user bar can access the job of user foo which previously failed.
> According to comments in QueueACLsManager .java that caused the problem,
> This situation can happen when RM is restarted after deleting queue.
> I think showing app of non existing queue to all users is the problem after
> RM start.
> It will become a security hole.
> I fixed it a little bit.
> After fixing it, Both owner of job and admin of yarn can access job which is
> submitted unknown queue.
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
