[ https://issues.apache.org/jira/browse/HIVE-25929?focusedWorklogId=782310&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-782310 ]
ASF GitHub Bot logged work on HIVE-25929: ----------------------------------------- Author: ASF GitHub Bot Created on: 17/Jun/22 08:44 Start Date: 17/Jun/22 08:44 Worklog Time Spent: 10m Work Description: abstractdog commented on code in PR #3019: URL: https://github.com/apache/hive/pull/3019#discussion_r899907375 ########## common/src/java/org/apache/hadoop/hive/conf/HiveConf.java: ########## @@ -5455,6 +5455,22 @@ public static enum ConfVars { + ",hive.zookeeper.ssl.truststore.location" + ",hive.zookeeper.ssl.truststore.password", "Comma separated list of configuration options which should not be read by normal user like passwords"), + HIVE_CONF_PROPAGATE_EXEC_ENGINES("hive.conf.propagate.exec.engines", + "fs.s3.awsAccessKeyId" Review Comment: yes, if configs are dumped in logs then it's a security risk, but currently, we have no other way to support 'less secure' option ('more secure' uses hadoop credential provider) I don't have strong opinions about this one, so I'm closing this as invalid, until we're not facing customer pressure to support it Issue Time Tracking ------------------- Worklog Id: (was: 782310) Time Spent: 3h (was: 2h 50m) > Let secret config properties to be propagated to Tez > ---------------------------------------------------- > > Key: HIVE-25929 > URL: https://issues.apache.org/jira/browse/HIVE-25929 > Project: Hive > Issue Type: Bug > Reporter: László Bodor > Assignee: László Bodor > Priority: Major > Labels: pull-request-available > Time Spent: 3h > Remaining Estimate: 0h > > History in chronological order: > HIVE-10508: removed some passwords from config that's propagated to execution > engines > HIVE-9013: introduced hive.conf.hidden.list, which is used instead of the > hardcoded list in HIVE-10508 > the problem with HIVE-9013 is it's about to introduce a common method for > removing sensitive data from Configuration, which absolutely makes sense in > most of the cases (set command showing sensitive data), but can cause issues > e.g. while using non-secure cloud connectors on a cluster, where instead of > the hadoop credential provider API (which is considered the secure and proper > way), passwords/secrets appear in the Configuration object (like: > "fs.azure.account.oauth2.client.secret") > 2 possible solutions: > 1. introduce a new property like: "hive.conf.hidden.list.exec.engines" -> > which defaults to "hive.conf.hidden.list" (configurable, but maybe just more > confusing to users, having a new config property which should be understood > and maintained on a cluster) > 2. simply revert DAGUtils to use to old stripHivePasswordDetails introduced > by HIVE-10508 (convenient, less confusing for users, but cannot be configured) -- This message was sent by Atlassian Jira (v8.20.7#820007)