[YARN-11066] Flexible AQC doesn't check the Queue ACLs when submitting apps

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Component/s: capacityscheduler, yarn
• Assignee: Tamas Domok
• Reporter: Tamas Domok
• Created: 20/Jan/22 13:09
• Updated: 30/Mar/22 07:35
• Resolved: 30/Mar/22 07:35

Description

Reproduction steps:

1. Use the attached configuration: capacity-scheduler.xml
2. Enable yarn.acl.enable in yarn-site.xml.
3. Try to submit an application with any user other than user1, user2, user3.

yarn jar hadoop-mapreduce-examples-3.4.0-SNAPSHOT.jar pi 1 10

The first app submission will succeed with someuser:somegroup the root.parent.somegroup.someuser queue will be created. When the root.parent.somegroup dynamic parent queue already exists then the ACLs in root.parent will be checked and the someuser won't be able to submit an another app. But queues are deleted automatically, so this is a serious security issue.

This issue doesn't happen when dynamic parent queue is not created just a dynamic leaf queue.

Another inconsistency is that the ACLs configured with templates works on dynamic leaf queues, but not when there is a dynamic parent queue too.

Issue Links

• is fixed by: YARN-11069 Dynamic Queue ACL handling in Legacy and Flexible Auto Created Queues