[YARN-10555] Missing access check before getAppAttempts

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 3.4.0, 3.3.1, 2.10.2, 3.2.3
• Component/s: webapp
• Labels: pull-request-available security
• Assignee: lujie
• Reporter: lujie
• Created: 30/Dec/20 10:01
• Updated: 13/Dec/21 13:09
• Resolved: 17/May/21 09:13

Description

It seems that we miss a security check before getAppAttempts, see https://github.com/apache/hadoop/blob/513f1995adc9b73f9c7f4c7beb89725b51b313ac/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/webapp/RMWebServices.java#L1127

thus we can get the some sensitive information, like logs link.  

application_1609318368700_0002 belong to user2

user1@hadoop11$ curl --negotiate -u  : http://hadoop11:8088/ws/v1/cluster/apps/application_1609318368700_0002/appattempts/|jq
{
  "appAttempts": {
    "appAttempt": [
      {
        "id": 1,
        "startTime": 1609318411566,
        "containerId": "container_1609318368700_0002_01_000001",
        "nodeHttpAddress": "hadoop12:8044",
        "nodeId": "hadoop12:36831",
        "logsLink": "http://hadoop12:8044/node/containerlogs/container_1609318368700_0002_01_000001/user2",
        "blacklistedNodes": "",
        "nodesBlacklistedBySystem": ""
      }
    ]
  }
}

Other apis, like getApps and getApp, has access check  like "hasAccess(app, hsr)", they would hide the logs link if the appid do not belong to query user, see 

https://github.com/apache/hadoop/blob/513f1995adc9b73f9c7f4c7beb89725b51b313ac/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/webapp/RMWebServices.java#L1098

 We need add hasAccess(app, hsr) for getAppAttempts.

 

Besides, at https://github.com/apache/hadoop/blob/580a6a75a3e3d3b7918edeffd6e93fc211166884/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/webapp/RMAppBlock.java#L145

it seems that we have  a access check in its caller,  so now i pass "true" to AppAttemptInfo in the patch.  

 

Issue Links

• links to: GitHub Pull Request #2608