You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by om...@apache.org on 2011/03/04 04:55:53 UTC
svn commit: r1077247 [2/2] - in
/hadoop/common/branches/branch-0.20-security-patches/src:
mapred/org/apache/hadoop/mapred/ test/org/apache/hadoop/mapred/ webapps/job/
Modified: hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobblacklistedtrackers.jsp
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobblacklistedtrackers.jsp?rev=1077247&r1=1077246&r2=1077247&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobblacklistedtrackers.jsp (original)
+++ hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobblacklistedtrackers.jsp Fri Mar 4 03:55:52 2011
@@ -6,6 +6,7 @@
import="java.util.*"
import="org.apache.hadoop.http.HtmlQuoting"
import="org.apache.hadoop.mapred.*"
+ import="org.apache.hadoop.mapred.JSPUtil.JobWithViewAccessCheck"
import="org.apache.hadoop.util.*"
%>
@@ -38,7 +39,13 @@
return;
}
- JobInProgress job = (JobInProgress) tracker.getJob(JobID.forName(jobId));
+ JobWithViewAccessCheck myJob = JSPUtil.checkAccessAndGetJob(tracker,
+ JobID.forName(jobId), request, response);
+ if (!myJob.isViewJobAllowed()) {
+ return; // user is not authorized to view this job
+ }
+
+ JobInProgress job = myJob.getJob();
if (job == null) {
out.print("<b>Job " + jobId + " not found.</b><br>\n");
return;
Modified: hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobconf.jsp
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobconf.jsp?rev=1077247&r1=1077246&r2=1077247&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobconf.jsp (original)
+++ hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobconf.jsp Fri Mar 4 03:55:52 2011
@@ -5,16 +5,17 @@
import="java.io.*"
import="java.net.URL"
import="org.apache.hadoop.mapred.*"
+ import="org.apache.hadoop.mapred.JSPUtil.JobWithViewAccessCheck"
import="org.apache.hadoop.util.*"
%>
<%
- JobTracker tracker = (JobTracker) application.getAttribute("job.tracker");
- String jobId = request.getParameter("jobid");
+ final JobTracker tracker = (JobTracker) application.getAttribute("job.tracker");
+ final String jobId = request.getParameter("jobid");
if (jobId == null) {
out.println("<h2>Missing 'jobid' for fetching job configuration!</h2>");
- return;
+ return;
}
%>
@@ -26,6 +27,18 @@
<h2>Job Configuration: JobId - <%= jobId %></h2><br>
<%
+ JobWithViewAccessCheck myJob = JSPUtil.checkAccessAndGetJob(tracker,
+ JobID.forName(jobId), request, response);
+ if (!myJob.isViewJobAllowed()) {
+ return; // user is not authorized to view this job
+ }
+
+ JobInProgress job = myJob.getJob();
+ if (job == null) {
+ out.print("<b>Job " + jobId + " not found.</b><br>\n");
+ return;
+ }
+
String jobFilePath = JobTracker.getLocalJobFilePath(JobID.forName(jobId));
FileInputStream jobFile = null;
try {
Modified: hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobdetails.jsp
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobdetails.jsp?rev=1077247&r1=1077246&r2=1077247&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobdetails.jsp (original)
+++ hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobdetails.jsp Fri Mar 4 03:55:52 2011
@@ -8,18 +8,23 @@
import="java.text.DecimalFormat"
import="org.apache.hadoop.http.HtmlQuoting"
import="org.apache.hadoop.mapred.*"
+ import="org.apache.hadoop.mapred.JSPUtil.JobWithViewAccessCheck"
import="org.apache.hadoop.mapreduce.TaskType"
import="org.apache.hadoop.util.*"
+ import="org.apache.hadoop.mapreduce.JobACL"
+ import="org.apache.hadoop.security.UserGroupInformation"
+ import="java.security.PrivilegedExceptionAction"
+ import="org.apache.hadoop.security.AccessControlException"
+ import="org.apache.hadoop.security.authorize.AccessControlList"
%>
<%
- JobTracker tracker = (JobTracker) application.getAttribute("job.tracker");
+ final JobTracker tracker = (JobTracker) application.getAttribute(
+ "job.tracker");
String trackerName =
StringUtils.simpleHostname(tracker.getJobTrackerMachine());
%>
<%!
- private static final String PRIVATE_ACTIONS_KEY
- = "webinterface.private.actions";
private void printTaskSummary(JspWriter out,
String jobId,
@@ -157,27 +162,83 @@
catch (NumberFormatException ignored) {
}
}
- JobID jobIdObj = JobID.forName(jobId);
- JobInProgress job = (JobInProgress) tracker.getJob(jobIdObj);
-
+ final JobID jobIdObj = JobID.forName(jobId);
+ JobWithViewAccessCheck myJob = JSPUtil.checkAccessAndGetJob(tracker, jobIdObj,
+ request, response);
+ if (!myJob.isViewJobAllowed()) {
+ return; // user is not authorized to view this job
+ }
+
+ JobInProgress job = myJob.getJob();
+
+ final String newPriority = request.getParameter("prio");
+ String user = request.getRemoteUser();
+ UserGroupInformation ugi = null;
+ if (user != null) {
+ ugi = UserGroupInformation.createRemoteUser(user);
+ }
+
String action = request.getParameter("action");
- if(JSPUtil.conf.getBoolean(PRIVATE_ACTIONS_KEY, false) &&
+ if(JSPUtil.privateActionsAllowed(tracker.conf) &&
"changeprio".equalsIgnoreCase(action)
&& request.getMethod().equalsIgnoreCase("POST")) {
- tracker.setJobPriority(jobIdObj,
- JobPriority.valueOf(request.getParameter("prio")));
+ if (ugi != null) {
+ try {
+ ugi.doAs(new PrivilegedExceptionAction<Void>() {
+ public Void run() throws IOException{
+
+ // checks job modify permission
+ tracker.setJobPriority(jobIdObj,
+ JobPriority.valueOf(newPriority));
+ return null;
+ }
+ });
+ } catch(AccessControlException e) {
+ String errMsg = "User " + user + " failed to modify priority of " +
+ jobIdObj + "!<br><br>" + e.getMessage() +
+ "<hr><a href=\"jobdetails.jsp?jobid=" + jobId +
+ "\">Go back to Job</a><br>";
+ JSPUtil.setErrorAndForward(errMsg, request, response);
+ return;
+ }
+ }
+ else {// no authorization needed
+ tracker.setJobPriority(jobIdObj,
+ JobPriority.valueOf(newPriority));;
+ }
}
- if(JSPUtil.conf.getBoolean(PRIVATE_ACTIONS_KEY, false)) {
- action = request.getParameter("action");
- if(action!=null && action.equalsIgnoreCase("confirm")) {
- printConfirm(out, jobId);
- return;
- }
- else if(action != null && action.equalsIgnoreCase("kill") &&
- request.getMethod().equalsIgnoreCase("POST")) {
- tracker.killJob(jobIdObj);
- }
+ if(JSPUtil.privateActionsAllowed(tracker.conf)) {
+ action = request.getParameter("action");
+ if(action!=null && action.equalsIgnoreCase("confirm")) {
+ printConfirm(out, jobId);
+ return;
+ }
+ else if(action != null && action.equalsIgnoreCase("kill") &&
+ request.getMethod().equalsIgnoreCase("POST")) {
+ if (ugi != null) {
+ try {
+ ugi.doAs(new PrivilegedExceptionAction<Void>() {
+ public Void run() throws IOException{
+
+ // checks job modify permission
+ tracker.killJob(jobIdObj);// checks job modify permission
+ return null;
+ }
+ });
+ } catch(AccessControlException e) {
+ String errMsg = "User " + user + " failed to kill " + jobIdObj +
+ "!<br><br>" + e.getMessage() +
+ "<hr><a href=\"jobdetails.jsp?jobid=" + jobId +
+ "\">Go back to Job</a><br>";
+ JSPUtil.setErrorAndForward(errMsg, request, response);
+ return;
+ }
+ }
+ else {// no authorization needed
+ tracker.killJob(jobIdObj);
+ }
+ }
}
%>
@@ -219,6 +280,22 @@
HtmlQuoting.quoteHtmlChars(profile.getJobName()) + "<br>\n");
out.print("<b>Job File:</b> <a href=\"jobconf.jsp?jobid=" + jobId + "\">" +
profile.getJobFile() + "</a><br>\n");
+
+ if (tracker.isJobLevelAuthorizationEnabled()) {
+ // Display job-view-acls and job-modify-acls configured for this job
+ Map<JobACL, AccessControlList> jobAcls = status.getJobACLs();
+ out.print("<b>Job-ACLs:</b><br>");
+ for (JobACL aclName : JobACL.values()) {
+ String aclConfigName = aclName.getAclName();
+ AccessControlList aclConfigured = jobAcls.get(aclName);
+ String aclStr = "";
+ if (aclConfigured != null) {
+ aclStr = aclConfigured.toString();
+ }
+ out.print(" " + aclConfigName + ": "
+ + aclStr + "<br>");
+ }
+ }
out.print("<b>Job Setup:</b>");
printJobLevelTaskSummary(out, jobId, "setup",
job.getTasks(TaskType.JOB_SETUP));
@@ -365,7 +442,7 @@ if("off".equals(session.getAttribute("ma
<%} }%>
<hr>
-<% if(JSPUtil.conf.getBoolean(PRIVATE_ACTIONS_KEY, false)) { %>
+<% if(JSPUtil.privateActionsAllowed(tracker.conf)) { %>
<table border="0"> <tr> <td>
Change priority from <%=job.getPriority()%> to:
<form action="jobdetails.jsp" method="post">
@@ -385,7 +462,7 @@ if("off".equals(session.getAttribute("ma
<table border="0"> <tr>
-<% if(JSPUtil.conf.getBoolean(PRIVATE_ACTIONS_KEY, false)
+<% if(JSPUtil.privateActionsAllowed(tracker.conf)
&& runState == JobStatus.RUNNING) { %>
<br/><a href="jobdetails.jsp?action=confirm&jobid=<%=jobId%>"> Kill this job </a>
<% } %>
Modified: hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobfailures.jsp
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobfailures.jsp?rev=1077247&r1=1077246&r2=1077247&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobfailures.jsp (original)
+++ hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobfailures.jsp Fri Mar 4 03:55:52 2011
@@ -6,6 +6,7 @@
import="java.util.*"
import="org.apache.hadoop.http.HtmlQuoting"
import="org.apache.hadoop.mapred.*"
+ import="org.apache.hadoop.mapred.JSPUtil.JobWithViewAccessCheck"
import="org.apache.hadoop.mapreduce.TaskType"
import="org.apache.hadoop.util.*"
%>
@@ -18,7 +19,6 @@
<%!
private void printFailedAttempts(JspWriter out,
JobTracker tracker,
- JobID jobId,
TaskInProgress tip,
TaskStatus.State failState) throws IOException {
TaskStatus[] statuses = tip.getTaskStatuses();
@@ -30,9 +30,8 @@
String taskTrackerName = statuses[i].getTaskTracker();
TaskTrackerStatus taskTracker = tracker.getTaskTrackerStatus(taskTrackerName);
out.print("<tr><td>" + statuses[i].getTaskID() +
- "</td><td><a href=\"taskdetails.jsp?jobid="+ jobId +
- "&tipid=" + tipId + "\">" + tipId +
- "</a></td>");
+ "</td><td><a href=\"taskdetails.jsp?tipid=" + tipId + "\">" +
+ tipId + "</a></td>");
if (taskTracker == null) {
out.print("<td>" + taskTrackerName + "</td>");
} else {
@@ -82,14 +81,10 @@
private void printFailures(JspWriter out,
JobTracker tracker,
- JobID jobId,
+ JobInProgress job,
String kind,
- String cause) throws IOException {
- JobInProgress job = (JobInProgress) tracker.getJob(jobId);
- if (job == null) {
- out.print("<b>Job " + jobId + " not found.</b><br>\n");
- return;
- }
+ String cause)
+ throws IOException, InterruptedException, ServletException {
boolean includeMap = false;
boolean includeReduce = false;
@@ -130,13 +125,13 @@
if (includeMap) {
TaskInProgress[] tips = job.getTasks(TaskType.MAP);
for(int i=0; i < tips.length; ++i) {
- printFailedAttempts(out, tracker, jobId, tips[i], state);
+ printFailedAttempts(out, tracker, tips[i], state);
}
}
if (includeReduce) {
TaskInProgress[] tips = job.getTasks(TaskType.REDUCE);
for(int i=0; i < tips.length; ++i) {
- printFailedAttempts(out, tracker, jobId, tips[i], state);
+ printFailedAttempts(out, tracker, tips[i], state);
}
}
out.print("</table>\n");
@@ -150,6 +145,19 @@
return;
}
JobID jobIdObj = JobID.forName(jobId);
+
+ JobWithViewAccessCheck myJob = JSPUtil.checkAccessAndGetJob(
+ tracker, jobIdObj, request, response);
+ if (!myJob.isViewJobAllowed()) {
+ return; // user is not authorized to view this job
+ }
+
+ JobInProgress job = myJob.getJob();
+ if (job == null) {
+ out.print("<b>Job " + jobId + " not found.</b><br>\n");
+ return;
+ }
+
String kind = request.getParameter("kind");
String cause = request.getParameter("cause");
%>
@@ -160,8 +168,8 @@
<h1>Hadoop <a href="jobdetails.jsp?jobid=<%=jobId%>"><%=jobId%></a>
failures on <a href="jobtracker.jsp"><%=trackerName%></a></h1>
-<%
- printFailures(out, tracker, jobIdObj, kind, cause);
+<%
+ printFailures(out, tracker, job, kind, cause);
%>
<hr>
Modified: hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobqueue_details.jsp
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobqueue_details.jsp?rev=1077247&r1=1077246&r2=1077247&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobqueue_details.jsp (original)
+++ hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobqueue_details.jsp Fri Mar 4 03:55:52 2011
@@ -63,7 +63,7 @@ if(jobs == null || jobs.isEmpty()) {
<br/>
<hr/>
<%=
- JSPUtil.generateJobTable("Job List", jobs, 30, 0)
+ JSPUtil.generateJobTable("Job List", jobs, 30, 0, tracker.conf)
%>
<hr>
<% } %>
Modified: hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobtasks.jsp
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobtasks.jsp?rev=1077247&r1=1077246&r2=1077247&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobtasks.jsp (original)
+++ hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobtasks.jsp Fri Mar 4 03:55:52 2011
@@ -6,13 +6,14 @@
import="java.util.*"
import="org.apache.hadoop.http.HtmlQuoting"
import="org.apache.hadoop.mapred.*"
+ import="org.apache.hadoop.mapred.JSPUtil.JobWithViewAccessCheck"
import="org.apache.hadoop.util.*"
import="java.lang.Integer"
import="java.text.SimpleDateFormat"
%>
<%! static SimpleDateFormat dateFormat = new SimpleDateFormat("d-MMM-yyyy HH:mm:ss") ; %>
<%
- JobTracker tracker = (JobTracker) application.getAttribute("job.tracker");
+ final JobTracker tracker = (JobTracker) application.getAttribute("job.tracker");
String trackerName =
StringUtils.simpleHostname(tracker.getJobTrackerMachine());
String jobid = request.getParameter("jobid");
@@ -20,6 +21,16 @@
out.println("<h2>Missing 'jobid'!</h2>");
return;
}
+ final JobID jobidObj = JobID.forName(jobid);
+
+ JobWithViewAccessCheck myJob = JSPUtil.checkAccessAndGetJob(tracker, jobidObj,
+ request, response);
+ if (!myJob.isViewJobAllowed()) {
+ return; // user is not authorized to view this job
+ }
+
+ JobInProgress job = myJob.getJob();
+
String type = request.getParameter("type");
String pagenum = request.getParameter("pagenum");
String state = request.getParameter("state");
@@ -27,10 +38,6 @@
int pnum = Integer.parseInt(pagenum);
int next_page = pnum+1;
int numperpage = 2000;
- JobID jobidObj = JobID.forName(jobid);
- JobInProgress job = (JobInProgress) tracker.getJob(jobidObj);
- JobProfile profile = (job != null) ? (job.getProfile()) : null;
- JobStatus status = (job != null) ? (job.getStatus()) : null;
TaskReport[] reports = null;
int start_index = (pnum - 1) * numperpage;
int end_index = start_index + numperpage;
@@ -92,9 +99,8 @@
}
for (int i = start_index ; i < end_index; i++) {
TaskReport report = reports[i];
- out.print("<tr><td><a href=\"taskdetails.jsp?jobid=" + jobid +
- "&tipid=" + report.getTaskID() + "\">" +
- report.getTaskID() + "</a></td>");
+ out.print("<tr><td><a href=\"taskdetails.jsp?tipid=" +
+ report.getTaskID() + "\">" + report.getTaskID() + "</a></td>");
out.print("<td>" + StringUtils.formatPercent(report.getProgress(),2) +
ServletUtil.percentageGraph(report.getProgress() * 100f, 80) + "</td>");
out.print("<td>" + HtmlQuoting.quoteHtmlChars(report.getState()) + "<br/></td>");
@@ -108,8 +114,7 @@
}
out.println("</pre><br/></td>");
out.println("<td>" +
- "<a href=\"taskstats.jsp?jobid=" + jobid +
- "&tipid=" + report.getTaskID() +
+ "<a href=\"taskstats.jsp?tipid=" + report.getTaskID() +
"\">" + report.getCounters().size() +
"</a></td></tr>");
}
Modified: hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobtracker.jsp
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobtracker.jsp?rev=1077247&r1=1077246&r2=1077247&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobtracker.jsp (original)
+++ hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/jobtracker.jsp Fri Mar 4 03:55:52 2011
@@ -141,14 +141,14 @@ for(JobQueueInfo queue: queues) {
<hr>
<h2 id="running_jobs">Running Jobs</h2>
-<%=JSPUtil.generateJobTable("Running", runningJobs, 30, 0)%>
+<%=JSPUtil.generateJobTable("Running", runningJobs, 30, 0, tracker.conf)%>
<hr>
<%
if (completedJobs.size() > 0) {
out.print("<h2 id=\"completed_jobs\">Completed Jobs</h2>");
out.print(JSPUtil.generateJobTable("Completed", completedJobs, 0,
- runningJobs.size()));
+ runningJobs.size(), tracker.conf));
out.print("<hr>");
}
%>
@@ -157,7 +157,7 @@ if (completedJobs.size() > 0) {
if (failedJobs.size() > 0) {
out.print("<h2 id=\"failed_jobs\">Failed Jobs</h2>");
out.print(JSPUtil.generateJobTable("Failed", failedJobs, 0,
- (runningJobs.size()+completedJobs.size())));
+ (runningJobs.size()+completedJobs.size()), tracker.conf));
out.print("<hr>");
}
%>
Modified: hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/taskdetails.jsp
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/taskdetails.jsp?rev=1077247&r1=1077246&r2=1077247&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/taskdetails.jsp (original)
+++ hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/taskdetails.jsp Fri Mar 4 03:55:52 2011
@@ -7,21 +7,22 @@
import="java.util.*"
import="org.apache.hadoop.http.HtmlQuoting"
import="org.apache.hadoop.mapred.*"
+ import="org.apache.hadoop.mapred.JSPUtil.JobWithViewAccessCheck"
import="org.apache.hadoop.util.*"
import="java.text.SimpleDateFormat"
- import="org.apache.hadoop.util.*"
+ import="org.apache.hadoop.security.UserGroupInformation"
+ import="java.security.PrivilegedExceptionAction"
+ import="org.apache.hadoop.security.AccessControlException"
%>
<%!static SimpleDateFormat dateFormat = new SimpleDateFormat(
"d-MMM-yyyy HH:mm:ss");
-
- private static final String PRIVATE_ACTIONS_KEY = "webinterface.private.actions";%>
-<%!private void printConfirm(JspWriter out, String jobid, String tipid,
- String taskid, String action) throws IOException {
- String url = "taskdetails.jsp?jobid=" + jobid + "&tipid=" + tipid
- + "&taskid=" + taskid;
+%>
+<%!private void printConfirm(JspWriter out,
+ String attemptid, String action) throws IOException {
+ String url = "taskdetails.jsp?attemptid=" + attemptid;
out.print("<html><head><META http-equiv=\"refresh\" content=\"15;URL="
+ url + "\"></head>" + "<body><h3> Are you sure you want to kill/fail "
- + taskid + " ?<h3><br><table border=\"0\"><tr><td width=\"100\">"
+ + attemptid + " ?<h3><br><table border=\"0\"><tr><td width=\"100\">"
+ "<form action=\"" + url + "\" method=\"post\">"
+ "<input type=\"hidden\" name=\"action\" value=\"" + action + "\" />"
+ "<input type=\"submit\" name=\"Kill/Fail\" value=\"Kill/Fail\" />"
@@ -31,53 +32,109 @@
+ "/></form></td></tr></table></body></html>");
}%>
<%
- JobTracker tracker = (JobTracker) application.getAttribute("job.tracker");
- String jobid = request.getParameter("jobid");
- String tipid = request.getParameter("tipid");
- String taskid = request.getParameter("taskid");
- JobID jobidObj = JobID.forName(jobid);
- TaskID tipidObj = TaskID.forName(tipid);
- TaskAttemptID taskidObj = TaskAttemptID.forName(taskid);
-
- JobInProgress job = (JobInProgress) tracker.getJob(jobidObj);
-
- boolean privateActions = JSPUtil.conf.getBoolean(PRIVATE_ACTIONS_KEY,
- false);
+ final JobTracker tracker = (JobTracker) application.getAttribute("job.tracker");
+
+ String attemptid = request.getParameter("attemptid");
+ final TaskAttemptID attemptidObj = TaskAttemptID.forName(attemptid);
+
+ // Obtain tipid for attemptid, if attemptid is available.
+ TaskID tipidObj =
+ (attemptidObj == null) ? TaskID.forName(request.getParameter("tipid"))
+ : attemptidObj.getTaskID();
+ if (tipidObj == null) {
+ out.print("<b>tipid sent is not valid.</b><br>\n");
+ return;
+ }
+ // Obtain jobid from tipid
+ final JobID jobidObj = tipidObj.getJobID();
+ String jobid = jobidObj.toString();
+
+ JobWithViewAccessCheck myJob = JSPUtil.checkAccessAndGetJob(tracker, jobidObj,
+ request, response);
+ if (!myJob.isViewJobAllowed()) {
+ return; // user is not authorized to view this job
+ }
+
+ JobInProgress job = myJob.getJob();
+ if (job == null) {
+ out.print("<b>Job " + jobid + " not found.</b><br>\n");
+ return;
+ }
+ boolean privateActions = JSPUtil.privateActionsAllowed(tracker.conf);
if (privateActions) {
String action = request.getParameter("action");
if (action != null) {
+ String user = request.getRemoteUser();
+ UserGroupInformation ugi = null;
+ if (user != null) {
+ ugi = UserGroupInformation.createRemoteUser(user);
+ }
if (action.equalsIgnoreCase("confirm")) {
String subAction = request.getParameter("subaction");
if (subAction == null)
subAction = "fail-task";
- printConfirm(out, jobid, tipid, taskid, subAction);
+ printConfirm(out, attemptid, subAction);
return;
}
else if (action.equalsIgnoreCase("kill-task")
&& request.getMethod().equalsIgnoreCase("POST")) {
- tracker.killTask(taskidObj, false);
+ if (ugi != null) {
+ try {
+ ugi.doAs(new PrivilegedExceptionAction<Void>() {
+ public Void run() throws IOException{
+
+ tracker.killTask(attemptidObj, false);// checks job modify permission
+ return null;
+ }
+ });
+ } catch(AccessControlException e) {
+ String errMsg = "User " + user + " failed to kill task "
+ + attemptidObj + "!<br><br>" + e.getMessage() +
+ "<hr><a href=\"jobdetails.jsp?jobid=" + jobid +
+ "\">Go back to Job</a><br>";
+ JSPUtil.setErrorAndForward(errMsg, request, response);
+ return;
+ }
+ } else {// no authorization needed
+ tracker.killTask(attemptidObj, false);
+ }
//redirect again so that refreshing the page will not attempt to rekill the task
- response.sendRedirect("/taskdetails.jsp?" + "&subaction=kill-task"
- + "&jobid=" + jobid + "&tipid=" + tipid);
+ response.sendRedirect("/taskdetails.jsp?subaction=kill-task" +
+ "&tipid=" + tipidObj.toString());
}
else if (action.equalsIgnoreCase("fail-task")
&& request.getMethod().equalsIgnoreCase("POST")) {
- tracker.killTask(taskidObj, true);
- response.sendRedirect("/taskdetails.jsp?" + "&subaction=fail-task"
- + "&jobid=" + jobid + "&tipid=" + tipid);
+ if (ugi != null) {
+ try {
+ ugi.doAs(new PrivilegedExceptionAction<Void>() {
+ public Void run() throws IOException{
+
+ tracker.killTask(attemptidObj, true);// checks job modify permission
+ return null;
+ }
+ });
+ } catch(AccessControlException e) {
+ String errMsg = "User " + user + " failed to fail task "
+ + attemptidObj + "!<br><br>" + e.getMessage() +
+ "<hr><a href=\"jobdetails.jsp?jobid=" + jobid +
+ "\">Go back to Job</a><br>";
+ JSPUtil.setErrorAndForward(errMsg, request, response);
+ return;
+ }
+ } else {// no authorization needed
+ tracker.killTask(attemptidObj, true);
+ }
+
+ response.sendRedirect("/taskdetails.jsp?subaction=fail-task" +
+ "&tipid=" + tipidObj.toString());
}
}
}
- TaskInProgress tip = null;
- if (job != null && tipidObj != null) {
- tip = job.getTaskInProgress(tipidObj);
- }
+ TaskInProgress tip = job.getTaskInProgress(tipidObj);
TaskStatus[] ts = null;
+ boolean isCleanupOrSetup = false;
if (tip != null) {
ts = tip.getTaskStatuses();
- }
- boolean isCleanupOrSetup = false;
- if ( tip != null) {
isCleanupOrSetup = tip.isJobCleanupTask();
if (!isCleanupOrSetup) {
isCleanupOrSetup = tip.isJobSetupTask();
@@ -228,18 +285,19 @@
out.print("<a href=\"" + entireLogUrl + "\">All</a><br/>");
}
}
- out.print("</td><td>" + "<a href=\"/taskstats.jsp?jobid=" + jobid
- + "&tipid=" + tipid + "&taskid=" + status.getTaskID() + "\">"
- + ((status.getCounters() != null) ? status.getCounters().size() : 0) + "</a></td>");
+ out.print("</td><td>" + "<a href=\"/taskstats.jsp?attemptid=" +
+ status.getTaskID() + "\">"
+ + ((status.getCounters() != null) ? status.getCounters().size() : 0)
+ + "</a></td>");
out.print("<td>");
if (privateActions
&& status.getRunState() == TaskStatus.State.RUNNING) {
out.print("<a href=\"/taskdetails.jsp?action=confirm"
- + "&subaction=kill-task" + "&jobid=" + jobid + "&tipid="
- + tipid + "&taskid=" + status.getTaskID() + "\" > Kill </a>");
+ + "&subaction=kill-task" + "&attemptid=" + status.getTaskID()
+ + "\" > Kill </a>");
out.print("<br><a href=\"/taskdetails.jsp?action=confirm"
- + "&subaction=fail-task" + "&jobid=" + jobid + "&tipid="
- + tipid + "&taskid=" + status.getTaskID() + "\" > Fail </a>");
+ + "&subaction=fail-task" + "&attemptid=" + status.getTaskID()
+ + "\" > Fail </a>");
}
else
out.print("<pre> </pre>");
Modified: hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/taskstats.jsp
URL: http://svn.apache.org/viewvc/hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/taskstats.jsp?rev=1077247&r1=1077246&r2=1077247&view=diff
==============================================================================
--- hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/taskstats.jsp (original)
+++ hadoop/common/branches/branch-0.20-security-patches/src/webapps/job/taskstats.jsp Fri Mar 4 03:55:52 2011
@@ -8,6 +8,7 @@
import="java.util.*"
import="org.apache.hadoop.http.HtmlQuoting"
import="org.apache.hadoop.mapred.*"
+ import="org.apache.hadoop.mapred.JSPUtil.JobWithViewAccessCheck"
import="org.apache.hadoop.util.*"
import="java.text.SimpleDateFormat"
%>
@@ -15,33 +16,46 @@
JobTracker tracker = (JobTracker) application.getAttribute("job.tracker");
String trackerName =
StringUtils.simpleHostname(tracker.getJobTrackerMachine());
- String jobid = request.getParameter("jobid");
- String tipid = request.getParameter("tipid");
- String taskid = request.getParameter("taskid");
- JobID jobidObj = JobID.forName(jobid);
- TaskID tipidObj = TaskID.forName(tipid);
- TaskAttemptID taskidObj = TaskAttemptID.forName(taskid);
+ String attemptid = request.getParameter("attemptid");
+ TaskAttemptID attemptidObj = TaskAttemptID.forName(attemptid);
+ // Obtain tipid for attemptId, if attemptId is available.
+ TaskID tipidObj =
+ (attemptidObj == null) ? TaskID.forName(request.getParameter("tipid"))
+ : attemptidObj.getTaskID();
+ // Obtain jobid from tipid
+ final JobID jobidObj = tipidObj.getJobID();
+ String jobid = jobidObj.toString();
- JobInProgress job = (JobInProgress) tracker.getJob(jobidObj);
+ JobWithViewAccessCheck myJob = JSPUtil.checkAccessAndGetJob(tracker, jobidObj,
+ request, response);
+ if (!myJob.isViewJobAllowed()) {
+ return; // user is not authorized to view this job
+ }
+
+ JobInProgress job = myJob.getJob();
+ if (job == null) {
+ out.print("<b>Job " + jobid + " not found.</b><br>\n");
+ return;
+ }
Format decimal = new DecimalFormat();
Counters counters;
- if (taskid == null) {
+ if (attemptid == null) {
counters = tracker.getTipCounters(tipidObj);
- taskid = tipid; // for page title etc
+ attemptid = tipidObj.toString(); // for page title etc
}
else {
- TaskStatus taskStatus = tracker.getTaskStatus(taskidObj);
+ TaskStatus taskStatus = tracker.getTaskStatus(attemptidObj);
counters = taskStatus.getCounters();
}
%>
<html>
<head>
- <title>Counters for <%=taskid%></title>
+ <title>Counters for <%=attemptid%></title>
</head>
<body>
-<h1>Counters for <%=taskid%></h1>
+<h1>Counters for <%=attemptid%></h1>
<hr>