[YARN-6721] container-executor should have stack checking

• Type: Improvement
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 3.0.0-beta1
• Component/s: nodemanager, security
• Labels: security
• Target Version/s: 3.0.0-beta1
• Assignee: Allen Wittenauer
• Reporter: Allen Wittenauer
• Created: 19/Jun/17 17:06
• Updated: 30/Jan/18 20:45
• Resolved: 01/Sep/17 02:40

Description

As per https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt and given that container-executor is setuid, it should be compiled with stack checking if the compiler supports such features. (-fstack-check on gcc, -fsanitize=safe-stack on clang, -xcheck=stkovf on "Oracle Solaris Studio", others as we find them, ...)

Issue Links

• causes: YARN-7857 -fstack-check compilation flag causes binary incompatibility for container-executor between RHEL 6 and RHEL 7
• is blocked by: HADOOP-14670 Increase minimum cmake version for all platforms