Details
Description
ClientRMService implemented getCallerUgi and verifyUserAccessForRMApp methods.
private UserGroupInformation getCallerUgi(ApplicationId applicationId, String operation) throws YarnException { UserGroupInformation callerUGI; try { callerUGI = UserGroupInformation.getCurrentUser(); } catch (IOException ie) { LOG.info("Error getting UGI ", ie); RMAuditLogger.logFailure("UNKNOWN", operation, "UNKNOWN", "ClientRMService", "Error getting UGI", applicationId); throw RPCUtil.getRemoteException(ie); } return callerUGI; }
Privileged operations like "getContainerReport" (which called checkAccess before op) will call them and record audit logs when an exception happens, but forget to use sometimes, caused audit log missing:
// getApplicationReport UserGroupInformation callerUGI; try { callerUGI = UserGroupInformation.getCurrentUser(); } catch (IOException ie) { LOG.info("Error getting UGI ", ie); // a logFailure should be called here. throw RPCUtil.getRemoteException(ie); }
So, I will replace some code blocks like this with getCallerUgi or verifyUserAccessForRMApp.
Attachments
Issue Links
- links to