[
https://issues.apache.org/jira/browse/YARN-5554?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Wilfred Spiegelenburg updated YARN-5554:
----------------------------------------
Attachment: YARN-5554.4.patch
Sorry for the delayed response, I tried to add a new test which test just the
getAccess call in the client but did not get it to work nicely.
I have updated the patch with the check for an non existing queue including an
extra test.
I did not move the check for a non existent queue into the {{ClientRMService}}
because each scheduler checks the queue existence in its own way and we would
have had to introduce a number of new dependencies into the client. I left it
in {{QueueACLsManager}} which already has the CS as a dependency. It now also
logs that the target queue does not exists.
For the check that [~jianhe] mentioned: we have an existing check for
MODIFY_APP in the code. That check also takes into account the administrator
access for the origin queue, covering the {{application_acl}} part. The new
check added handles the first part {{submit_acl_on_target_queue ||
target_queue_adminAcl)}} Both need to pass to move the application.
> MoveApplicationAcrossQueues does not check user permission on the target queue
> ------------------------------------------------------------------------------
>
> Key: YARN-5554
> URL: https://issues.apache.org/jira/browse/YARN-5554
> Project: Hadoop YARN
> Issue Type: Bug
> Components: resourcemanager
> Affects Versions: 2.7.2
> Reporter: Haibo Chen
> Assignee: Wilfred Spiegelenburg
> Attachments: YARN-5554.2.patch, YARN-5554.3.patch, YARN-5554.4.patch
>
>
> moveApplicationAcrossQueues operation currently does not check user
> permission on the target queue. This incorrectly allows one user to move
> his/her own applications to a queue that the user has no access to
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
