Details
-
Bug
-
Status: Open
-
Major
-
Resolution: Unresolved
-
None
-
None
-
None
Description
This task is to remove the implied grant for the administer queue permission for the Yarn plugin. Previously, the administer queue permission implied the submit application permission. However, this implication can cause problems when a user is denied the administer queue permission, but explicitly allowed the submit application permission, as the administer queue negative permission then overrides the positive submit application permission (see https://issues.apache.org/jira/browse/RANGER-1339). The easiest fix is just to remove the implied grant, so a user must be explicitly granted the submit application permission in addition to administer queue.
Attachments
Issue Links
- relates to
-
RANGER-1339 DENY and ALLOW EXCLUSION do not work with YARN
- Closed