Uploaded image for project: 'Hadoop YARN'
  1. Hadoop YARN
  2. YARN-11392

ClientRMService implemented getCallerUgi and verifyUserAccessForRMApp methods but forget to use sometimes, caused audit log missing.

    XMLWordPrintableJSON

Details

    Description

      ClientRMService implemented getCallerUgi and verifyUserAccessForRMApp methods.

      private UserGroupInformation getCallerUgi(ApplicationId applicationId,
            String operation) throws YarnException {
          UserGroupInformation callerUGI;
          try {
            callerUGI = UserGroupInformation.getCurrentUser();
          } catch (IOException ie) {
            LOG.info("Error getting UGI ", ie);
            RMAuditLogger.logFailure("UNKNOWN", operation, "UNKNOWN",
                "ClientRMService", "Error getting UGI", applicationId);
            throw RPCUtil.getRemoteException(ie);
          }
          return callerUGI;
        }
      

      Privileged operations like "getContainerReport" (which called checkAccess before op) will call them and record audit logs when an exception happens, but forget to use sometimes, caused audit log missing

      // getApplicationReport
          UserGroupInformation callerUGI;
          try {
            callerUGI = UserGroupInformation.getCurrentUser();
          } catch (IOException ie) {
            LOG.info("Error getting UGI ", ie);
           // a logFailure should be called here. 
           throw RPCUtil.getRemoteException(ie);
          }
      

      So, I will replace some code blocks like this with getCallerUgi or verifyUserAccessForRMApp.

      Attachments

        Issue Links

          Activity

            People

              chino71 Beibei Zhao
              chino71 Beibei Zhao
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: