You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@storm.apache.org by "rzo1 (via GitHub)" <gi...@apache.org> on 2026/08/19 07:06:16 UTC
[PR] Apply the configured log user and group lists to daemon log requests (storm)
rzo1 opened a new pull request, #8973:
URL: https://github.com/apache/storm/pull/8973
The daemon log paths combined the daemon flag with the authorizer result as `isDaemon || allowed`, so the configured `logs.users`/`logs.groups` result was discarded for daemon files.
The three daemon log paths (page, download, search) now evaluate the same lists the worker log paths already use. Extends `ResourceAuthorizerTest` and the three handler tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Apply the configured log user and group lists to daemon log requests (storm)
Posted by "reiabreu (via GitHub)" <gi...@apache.org>.
reiabreu commented on PR #8973:
URL: https://github.com/apache/storm/pull/8973#issuecomment-5379713279
_Disclaimer: this comment was drafted with the help of an LLM._
Thanks for tightening up the daemon-log authorization here — the per-endpoint deny tests are a nice addition.
One small suggestion on coverage: both `ResourceAuthorizer` tests stub `getUserGroups(...)` to return an empty set, so the group-based path (`logs.groups` / `nimbus.admins.groups`) isn't actually exercised. A case where a user is authorized purely via group membership would close that gap. Separately, the three handler tests assert the `403` deny path but not the authorized `200` path — a positive case could guard against accidentally over-blocking.
Neither is a blocker — just an additional safeguard for a security-sensitive change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Apply the configured log user and group lists to daemon log requests (storm)
Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 commented on PR #8973:
URL: https://github.com/apache/storm/pull/8973#issuecomment-5381685353
> _Disclaimer: this comment was drafted with the help of an LLM._
>
> Thanks for tightening up the daemon-log authorization here — the per-endpoint deny tests are a nice addition.
>
> One small suggestion on coverage: both `ResourceAuthorizer` tests stub `getUserGroups(...)` to return an empty set, so the group-based path (`logs.groups` / `nimbus.admins.groups`) isn't actually exercised. A case where a user is authorized purely via group membership would close that gap. Separately, the three handler tests assert the `403` deny path but not the authorized `200` path — a positive case could guard against accidentally over-blocking.
>
> Neither is a blocker — just an additional safeguard for a security-sensitive change.
Done.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Apply the configured log user and group lists to daemon log requests (storm)
Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 merged PR #8973:
URL: https://github.com/apache/storm/pull/8973
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org