You are viewing a plain text version of this content. The canonical link for it is here.
Posted to mapreduce-issues@hadoop.apache.org by "Alejandro Abdelnur (JIRA)" <ji...@apache.org> on 2011/04/28 07:15:03 UTC
[jira] [Created] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
job submission should inject group.name (on the JT side)
--------------------------------------------------------
Key: MAPREDUCE-2457
URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
Project: Hadoop Map/Reduce
Issue Type: Bug
Components: jobtracker
Affects Versions: 0.21.0, 0.22.0
Reporter: Alejandro Abdelnur
Assignee: Alejandro Abdelnur
Priority: Critical
Fix For: 0.22.0
Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
Since Hadoop 0.21, due to security related changes, this is not done anymore.
This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Hadoop QA (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13026748#comment-13026748 ]
Hadoop QA commented on MAPREDUCE-2457:
--------------------------------------
-1 overall. Here are the results of testing the latest attachment
http://issues.apache.org/jira/secure/attachment/12477708/MAPREDUCE-2457.patch
against trunk revision 1097345.
+1 @author. The patch does not contain any @author tags.
+1 tests included. The patch appears to include 3 new or modified tests.
-1 patch. The patch command could not apply the patch.
Console output: https://builds.apache.org/hudson/job/PreCommit-MAPREDUCE-Build/195//console
This message is automatically generated.
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Aaron T. Myers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13026891#comment-13026891 ]
Aaron T. Myers commented on MAPREDUCE-2457:
-------------------------------------------
Since we're now adding the concept of a "primary group," I wonder if we shouldn't make this explicit, rather than just pick the first from the list. i.e. change {{GroupMappingServiceProvider}} to add a {{public String getPrimaryGroup(String user)}} method, and add a method to {{UserGroupInformation}} to get the primary group of the user.
Thoughts?
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Hudson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13028777#comment-13028777 ]
Hudson commented on MAPREDUCE-2457:
-----------------------------------
Integrated in Hadoop-Mapreduce-trunk #669 (See [https://builds.apache.org/hudson/job/Hadoop-Mapreduce-trunk/669/])
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alejandro Abdelnur updated MAPREDUCE-2457:
------------------------------------------
Attachment: MAPREDUCE-2457.patch
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13027036#comment-13027036 ]
Alejandro Abdelnur commented on MAPREDUCE-2457:
-----------------------------------------------
Yes, the idea of primary group is good. We should make a new JIRA for it.
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Hadoop QA (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13026807#comment-13026807 ]
Hadoop QA commented on MAPREDUCE-2457:
--------------------------------------
-1 overall. Here are the results of testing the latest attachment
http://issues.apache.org/jira/secure/attachment/12477709/MAPREDUCE-2457-1.patch
against trunk revision 1097656.
+1 @author. The patch does not contain any @author tags.
+1 tests included. The patch appears to include 3 new or modified tests.
+1 javadoc. The javadoc tool did not generate any warning messages.
+1 javac. The applied patch does not increase the total number of javac compiler warnings.
+1 findbugs. The patch does not introduce any new Findbugs (version 1.3.9) warnings.
+1 release audit. The applied patch does not increase the total number of release audit warnings.
-1 core tests. The patch failed these core unit tests:
org.apache.hadoop.mapred.TestDebugScript
-1 contrib tests. The patch failed contrib unit tests.
+1 system test framework. The patch passed system test framework compile.
Test results: https://builds.apache.org/hudson/job/PreCommit-MAPREDUCE-Build/196//testReport/
Findbugs warnings: https://builds.apache.org/hudson/job/PreCommit-MAPREDUCE-Build/196//artifact/trunk/build/test/findbugs/newPatchFindbugsWarnings.html
Console output: https://builds.apache.org/hudson/job/PreCommit-MAPREDUCE-Build/196//console
This message is automatically generated.
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alejandro Abdelnur updated MAPREDUCE-2457:
------------------------------------------
Status: Open (was: Patch Available)
patch works against 22, needs to work against trunk
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alejandro Abdelnur updated MAPREDUCE-2457:
------------------------------------------
Status: Patch Available (was: Open)
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alejandro Abdelnur updated MAPREDUCE-2457:
------------------------------------------
Attachment: MAPREDUCE-2457.patch
testcase verifies that the primary group of the user submitting the job is used as pool name. This is done in on of the FairScheduler testcases.
Note that the group.name will not be avail to tasks as the JT does not re-write the job.xml to HDFS
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alejandro Abdelnur updated MAPREDUCE-2457:
------------------------------------------
Attachment: (was: MAPREDUCE-2457.patch)
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Hudson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13028210#comment-13028210 ]
Hudson commented on MAPREDUCE-2457:
-----------------------------------
Integrated in Hadoop-Mapreduce-22-branch #44 (See [https://builds.apache.org/hudson/job/Hadoop-Mapreduce-22-branch/44/])
MAPREDUCE-2457. Job submission should inject group.name on the JobTracker. Contributed by Alejandro Abdelnur.
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Todd Lipcon (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Todd Lipcon updated MAPREDUCE-2457:
-----------------------------------
Resolution: Fixed
Hadoop Flags: [Reviewed]
Status: Resolved (was: Patch Available)
Committed to 22 and trunk. Thanks Alejandro!
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alejandro Abdelnur updated MAPREDUCE-2457:
------------------------------------------
Attachment: MAPREDUCE-2457-1.patch
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Alejandro Abdelnur (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Alejandro Abdelnur updated MAPREDUCE-2457:
------------------------------------------
Status: Patch Available (was: Open)
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Hudson (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13028952#comment-13028952 ]
Hudson commented on MAPREDUCE-2457:
-----------------------------------
Integrated in Hadoop-Mapreduce-trunk-Commit #656 (See [https://builds.apache.org/hudson/job/Hadoop-Mapreduce-trunk-Commit/656/])
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MAPREDUCE-2457) job submission should inject
group.name (on the JT side)
Posted by "Todd Lipcon (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/MAPREDUCE-2457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13026811#comment-13026811 ]
Todd Lipcon commented on MAPREDUCE-2457:
----------------------------------------
Patch seems good, but TestFairSchedulerSystem is already failing in trunk at the moment for another reason (not sure). Let me look into that before we commit this.
> job submission should inject group.name (on the JT side)
> --------------------------------------------------------
>
> Key: MAPREDUCE-2457
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2457
> Project: Hadoop Map/Reduce
> Issue Type: Bug
> Components: jobtracker
> Affects Versions: 0.21.0, 0.22.0
> Reporter: Alejandro Abdelnur
> Assignee: Alejandro Abdelnur
> Priority: Critical
> Fix For: 0.22.0
>
> Attachments: MAPREDUCE-2457-1.patch, MAPREDUCE-2457.patch
>
>
> Until Hadoop 0.20, the JobClient was injecting the property 'group.name' on the JobConf submitted to the JobTracker.
> Since Hadoop 0.21, due to security related changes, this is not done anymore.
> This breaks backwards compatibility for jobs/components that expect the 'group.name' to be automatically set at submission time.
> An example of a component being affected by this change is the FairScheduler where it is common to use the group.name as pool name. Different from other properties, a special characteristic of the group.name is that its value cannot be tampered by a user.
> For security reasons this should not be done (as it was done before) in the JobClient side. Instead, it should be done in the JobTracker when the JobConf is received.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira