[MAPREDUCE-899] When using LinuxTaskController, localized files may become accessible to unintended users if permissions are misconfigured. - ASF JIRA

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Bug
Status: Closed
Priority: Major
Resolution: Fixed
Affects Version/s: None
Fix Version/s: 0.21.0
Component/s: tasktracker
Labels:
None

Hadoop Flags:

Incompatible change, Reviewed
Release Note:

Hide
Added configuration "mapreduce.tasktracker.group", a group name to which TaskTracker belongs. When LinuxTaskController is used, task-controller binary's group owner should be this group. The same should be specified in task-controller.cfg also.

Show
Added configuration "mapreduce.tasktracker.group", a group name to which TaskTracker belongs. When LinuxTaskController is used, task-controller binary's group owner should be this group. The same should be specified in task-controller.cfg also.

Description

To enforce the accessibility of job files to only the job-owner and the TaskTracker, as per ~~MAPREDUCE-842~~, it is trusted that the setuid/setgid linux TaskController binary is group owned by a special group to which only TaskTracker belongs and not just any group to which TT belongs. If the trust is broken, possibly due to misconfiguration by admins, the local files become accessible to unintended users, yet giving false sense of security to the admins.