[MAPREDUCE-2178] Race condition in LinuxTaskController permissions handling

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.22.0
• Fix Version/s: 0.22.1
• Component/s: security, task-controller
• Hadoop Flags: Reviewed
• Assignee: Benoy Antony
• Reporter: Todd Lipcon
• Created: 09/Nov/10 02:18
• Updated: 02/May/13 02:29
• Resolved: 05/Jun/12 02:38

Description

The linux-task-controller executable currently traverses a directory heirarchy and calls chown/chmod on the files inside. There is a race condition here which can be exploited by an attacker, causing the task-controller to improprly chown an arbitrary target file (via a symlink) to the user running a MR job. This can be exploited to escalate to root.

[this issue was raised and discussed on the security@ list over the last couple of months]

Issue Links

• blocks: MAPREDUCE-2376 test-task-controller fails if run as a userid < 1000
• blocks: MAPREDUCE-2266 JvmManager sleeps between SIGTERM and SIGKILL while holding many TT locks
• blocks: MAPREDUCE-2371 TaskLogsTruncater does not need to check log ownership when running as Child
• incorporates: MAPREDUCE-2242 LinuxTaskController doesn't properly escape environment variables
• is blocked by: HADOOP-7338 LocalDirAllocator improvements for MR-2178
• is depended upon by: MAPREDUCE-2373 When tasks exit with a nonzero exit status, task runner should log the stderr as well as stdout
• is depended upon by: HADOOP-8357 Restore security in Hadoop 0.22 branch