[ https://issues.apache.org/jira/browse/YARN-10345?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Prabhu Joseph updated YARN-10345: --------------------------------- Parent: YARN-10025 Issue Type: Sub-task (was: Bug) > HsWebServices containerlogs does not honor ACLs for completed jobs > ------------------------------------------------------------------ > > Key: YARN-10345 > URL: https://issues.apache.org/jira/browse/YARN-10345 > Project: Hadoop YARN > Issue Type: Sub-task > Components: yarn > Affects Versions: 3.3.0, 3.2.2, 3.4.0 > Reporter: Prabhu Joseph > Assignee: Prabhu Joseph > Priority: Critical > Attachments: Screen Shot 2020-07-08 at 12.54.21 PM.png > > > HsWebServices containerlogs does not honor ACLs. User who does not have > permission to view a job is allowed to view the job logs for completed jobs > from YARN UI2 through HsWebServices. > *Repro:* > Secure cluster + yarn.admin.acl=yarn,mapred + Root Queue ACLs set to " " + > HistoryServer runs as mapred > # Run a sample MR job using systest user > # Once the job is complete, access the job logs using hue user from YARN > UI2. > !Screen Shot 2020-07-08 at 12.54.21 PM.png|height=300! > > YARN CLI works fine and does not allow hue user to view systest user job logs. > {code:java} > [hue@pjoseph-cm-2 /]$ > [hue@pjoseph-cm-2 /]$ yarn logs -applicationId application_1594188841761_0002 > WARNING: YARN_OPTS has been replaced by HADOOP_OPTS. Using value of YARN_OPTS. > 20/07/08 07:23:08 INFO client.RMProxy: Connecting to ResourceManager at > rmhostname:8032 > Permission denied: user=hue, access=EXECUTE, > inode="/tmp/logs/systest":systest:hadoop:drwxrwx--- > at > org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.check(FSPermissionChecker.java:496) > {code} -- This message was sent by Atlassian Jira (v8.3.4#803005) --------------------------------------------------------------------- To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org