You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@spark.apache.org by "Marcelo Vanzin (JIRA)" <ji...@apache.org> on 2015/09/02 21:56:45 UTC
[jira] [Assigned] (SPARK-10004) Shuffle service should make sure
applications are allowed to read shuffle data
[ https://issues.apache.org/jira/browse/SPARK-10004?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Marcelo Vanzin reassigned SPARK-10004:
--------------------------------------
Assignee: Marcelo Vanzin
> Shuffle service should make sure applications are allowed to read shuffle data
> ------------------------------------------------------------------------------
>
> Key: SPARK-10004
> URL: https://issues.apache.org/jira/browse/SPARK-10004
> Project: Spark
> Issue Type: Bug
> Components: Shuffle
> Affects Versions: 1.3.1, 1.4.1, 1.5.0
> Reporter: Marcelo Vanzin
> Assignee: Marcelo Vanzin
> Priority: Critical
> Fix For: 1.6.0
>
>
> The shuffle service currently performs authentication of clients; but once a client is authenticated, it blindly trusts the client to send proper requests.
> A malicious client could send a {{OpenBlocks}} message to open another application's shuffle data, and the shuffle service will just do it. This can be used to work around the fact that the app cannot go directly to the other app's files in the local filesystem (due to permissions), while the shuffle service can.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org