Uploaded image for project: 'Hadoop YARN'
  1. Hadoop YARN
  2. YARN-8762 [Umbrella] Support Interactive Docker Shell to running Containers
  3. YARN-8838

Add security check for container user is same as websocket user

    XMLWordPrintableJSON

Details

    • Sub-task
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • None
    • 3.3.0
    • nodemanager

    Description

      When user is authenticate via SPNEGO entry point, node manager must verify the remote user is the same as the container user to start the web socket session. One possible solution is to verify the web request user matches yarn container local directory owne during onWebSocketConnect..

      Attachments

        1. YARN-8838.007.patch
          9 kB
          Billie Rinaldi
        2. YARN-8838.006.patch
          9 kB
          Eric Yang
        3. YARN-8838.005.patch
          8 kB
          Eric Yang
        4. YARN-8838.004.patch
          7 kB
          Eric Yang
        5. YARN-8838.003.patch
          6 kB
          Eric Yang
        6. YARN-8838.002.patch
          3 kB
          Eric Yang
        7. YARN-8838.001.patch
          2 kB
          Eric Yang

        Issue Links

          is related to

          Improvement - An improvement or enhancement to an existing feature or task. YARN-9068 Enhance ACL to set a list of users to access container shell

          • Major - Major loss of function.
          • Open

          Activity

            People

              eyang Eric Yang
              eyang Eric Yang
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: