[jira] [Commented] (YARN-11392) ClientRMService implemented getCallerUgi and verifyUserAccessForRMApp methods but forget to use sometimes, caused audit log missing.

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/YARN-11392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17650621#comment-17650621 ] 

ASF GitHub Bot commented on YARN-11392:
---------------------------------------

curie71 opened a new pull request, #5250:
URL: https://github.com/apache/hadoop/pull/5250

   YARN-11392 ClientRMService implemented **getCallerUgi** and **verifyUserAccessForRMApp** methods but forget to use sometimes, caused audit log missing.
   
   ClientRMService implemented getCallerUgi and verifyUserAccessForRMApp methods.
   ```java
   private UserGroupInformation getCallerUgi(ApplicationId applicationId,
         String operation) throws YarnException {
       UserGroupInformation callerUGI;
       try {
         callerUGI = UserGroupInformation.getCurrentUser();
       } catch (IOException ie) {
         LOG.info("Error getting UGI ", ie);
         RMAuditLogger.logFailure("UNKNOWN", operation, "UNKNOWN",
             "ClientRMService", "Error getting UGI", applicationId);
         throw RPCUtil.getRemoteException(ie);
       }
       return callerUGI;
     }
   ```
   *Privileged operations* like "getContainerReport" (which called checkAccess before op) will call them and *record audit logs* when an *exception* happens, but forget to use sometimes, caused audit log {*}missing{*}: 
   ```java
   // getApplicationReport
       UserGroupInformation callerUGI;
       try {
         callerUGI = UserGroupInformation.getCurrentUser();
       } catch (IOException ie) {
         LOG.info("Error getting UGI ", ie);
        // a logFailure should be called here. 
        throw RPCUtil.getRemoteException(ie);
       }
   ```
   So, I will replace some code blocks like this with getCallerUgi or verifyUserAccessForRMApp.
   
   <!--
     Thanks for sending a pull request!
       1. If this is your first time, please read our contributor guidelines: https://cwiki.apache.org/confluence/display/HADOOP/How+To+Contribute
       2. Make sure your PR title starts with JIRA issue id, e.g., 'HADOOP-17799. Your PR title ...'.
   -->
   
   ### Description of PR
   
   
   ### How was this patch tested?
   
   
   ### For code changes:
   
   - [x] Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
   - [ ] Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
   - [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
   - [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`, `NOTICE-binary` files?
   
   




> ClientRMService implemented getCallerUgi and verifyUserAccessForRMApp methods but forget to use sometimes, caused audit log missing.
> ------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: YARN-11392
>                 URL: https://issues.apache.org/jira/browse/YARN-11392
>             Project: Hadoop YARN
>          Issue Type: Bug
>          Components: yarn
>    Affects Versions: 3.3.4
>            Reporter: Beibei Zhao
>            Priority: Major
>              Labels: audit, log, yarn
>
> ClientRMService implemented getCallerUgi and verifyUserAccessForRMApp methods.
> {code:java}
> private UserGroupInformation getCallerUgi(ApplicationId applicationId,
>       String operation) throws YarnException {
>     UserGroupInformation callerUGI;
>     try {
>       callerUGI = UserGroupInformation.getCurrentUser();
>     } catch (IOException ie) {
>       LOG.info("Error getting UGI ", ie);
>       RMAuditLogger.logFailure("UNKNOWN", operation, "UNKNOWN",
>           "ClientRMService", "Error getting UGI", applicationId);
>       throw RPCUtil.getRemoteException(ie);
>     }
>     return callerUGI;
>   }
> {code}
> *Privileged operations* like "getContainerReport" (which called checkAccess before op) will call them and *record audit logs* when an *exception* happens, but forget to use sometimes, caused audit log {*}missing{*}: 
> {code:java}
> // getApplicationReport
>     UserGroupInformation callerUGI;
>     try {
>       callerUGI = UserGroupInformation.getCurrentUser();
>     } catch (IOException ie) {
>       LOG.info("Error getting UGI ", ie);
>      // a logFailure should be called here. 
>      throw RPCUtil.getRemoteException(ie);
>     }
> {code}
> So, I will replace some code blocks like this with getCallerUgi or verifyUserAccessForRMApp.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org