[
https://issues.apache.org/jira/browse/YARN-9583?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16900622#comment-16900622
]
KWON BYUNGCHANG commented on YARN-9583:
---------------------------------------
[~sunilg]
thank you for feedback.
I checked as you mentioned. RM recovered app as SUCCESS.
This patch does not changed App state. It just changed checking of permission.
Need test code?
> Failed job which is submitted unknown queue is showed all users
> ---------------------------------------------------------------
>
> Key: YARN-9583
> URL: https://issues.apache.org/jira/browse/YARN-9583
> Project: Hadoop YARN
> Issue Type: Bug
> Components: security
> Affects Versions: 3.1.2
> Reporter: KWON BYUNGCHANG
> Assignee: KWON BYUNGCHANG
> Priority: Major
> Attachments: YARN-9583-screenshot.png, YARN-9583.001.patch,
> YARN-9583.002.patch, YARN-9583.003.patch, YARN-9583.004.patch,
> YARN-9583.005.patch
>
>
> In secure mode, Failed job which is submitted unknown queue is showed all
> users.
> I attached RM UI screen shot.
> reproduction senario
> 1. user foo submit job to unknown queue without view-acl and job will fail
> immediately.
> 2. user bar can access the job of user foo which previously failed.
> According to comments in QueueACLsManager .java that caused the problem,
> This situation can happen when RM is restarted after deleting queue.
> I think showing app of non existing queue to all users is the problem after
> RM start.
> It will become a security hole.
> I fixed it a little bit.
> After fixing it, Both owner of job and admin of yarn can access job which is
> submitted unknown queue.
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org
