[OOZIE-2244] Oozie should mask passwords in the logs when logging command arguments

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 4.1.0, 4.0.1
• Fix Version/s: 4.3.0

Environment

All

• Assignee: Venkat Ranganathan
• Reporter: Venkat Ranganathan
• Created: 21/May/15 19:00
• Updated: 02/Dec/16 21:02
• Resolved: 03/Aug/16 10:08

Description

Users have complained that oozie logging the password related argument values in the launcher log is a security hole and want it to be masked in the output. Even password aliases in keystore are considered to be a security hole.

The fix is to mask any argument values if option name contains the string password (which is true for Sqoop). We do this in multiple places, in Sqoop main, in Launcher Mapper, in JavaMain as well.

Issue Links

• breaks: OOZIE-2749 Logging command arguments fails in certain scenarios when using EL functions.
• breaks: OOZIE-2748 NPE in LauncherMapper.printArgs()