Uploaded image for project: 'Hadoop YARN'
  1. Hadoop YARN
  2. YARN-11392

ClientRMService implemented getCallerUgi and verifyUserAccessForRMApp methods but forget to use sometimes, caused audit log missing.

VotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    Description

      ClientRMService implemented getCallerUgi and verifyUserAccessForRMApp methods.

      private UserGroupInformation getCallerUgi(ApplicationId applicationId,
            String operation) throws YarnException {
          UserGroupInformation callerUGI;
          try {
            callerUGI = UserGroupInformation.getCurrentUser();
          } catch (IOException ie) {
            LOG.info("Error getting UGI ", ie);
            RMAuditLogger.logFailure("UNKNOWN", operation, "UNKNOWN",
                "ClientRMService", "Error getting UGI", applicationId);
            throw RPCUtil.getRemoteException(ie);
          }
          return callerUGI;
        }
      

      Privileged operations like "getContainerReport" (which called checkAccess before op) will call them and record audit logs when an exception happens, but forget to use sometimes, caused audit log missing

      // getApplicationReport
          UserGroupInformation callerUGI;
          try {
            callerUGI = UserGroupInformation.getCurrentUser();
          } catch (IOException ie) {
            LOG.info("Error getting UGI ", ie);
           // a logFailure should be called here. 
           throw RPCUtil.getRemoteException(ie);
          }
      

      So, I will replace some code blocks like this with getCallerUgi or verifyUserAccessForRMApp.

      Attachments

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            chino71 Beibei Zhao
            chino71 Beibei Zhao
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment