[YARN-7590] Improve container-executor validation check

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.1-alpha, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.8.1, 3.0.0-beta1
• Fix Version/s: 2.6.6, 3.1.0, 2.10.0, 2.9.1, 3.0.1, 2.8.4, 2.7.6
• Component/s: security, yarn
• Target Version/s: 3.1.0, 2.10.0, 3.0.1
• Hadoop Flags: Reviewed
• Assignee: Eric Yang
• Reporter: Eric Yang
• Created: 01/Dec/17 00:12
• Updated: 18/Jul/18 08:57
• Resolved: 12/Jan/18 00:59

Description

There is minimum check for prefix path for container-executor. If YARN is compromised, attacker can use container-executor to change system files ownership:

/usr/local/hadoop/bin/container-executor spark yarn 0 etc /home/yarn/tokens /home/spark / ls

This will change /etc to be owned by spark user:

# ls -ld /etc
drwxr-s---. 110 spark hadoop 8192 Nov 21 20:00 /etc

Spark user can rewrite /etc files to gain more access. We can improve this with additional check in container-executor:

1. Make sure the prefix path is owned by the same user as the caller to container-executor.
2. Make sure the log directory prefix is owned by the same user as the caller.

Issue Links

• blocks: YARN-7705 Create the container log directory with correct sticky bit in C code