[YARN-9731] In ATS v1.5, all jobs are visible to all users without view-acl

• Type: Bug
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.1.2
• Component/s: timelineserver
• Assignee: KWON BYUNGCHANG
• Reporter: KWON BYUNGCHANG
• Created: 09/Aug/19 01:34
• Updated: 09/Mar/21 16:38

Description

In ATS v1.5 of secure mode,

all jobs are visible to all users without view-acl.

if user does not have view-acl,  user should not be able to see jobs.

I attatched ATS UI screenshot.

 

ATS v1.5 log

2019-08-09 10:21:13,679 WARN applicationhistoryservice.ApplicationHistoryManagerOnTimelineStore (ApplicationHistoryManagerOnTimelineStore.java:generateApplicationReport(687)) - Failed to authorize when generating application report for application_1565247558150_1954. Use a placeholder for its latest attempt id.
org.apache.hadoop.security.authorize.AuthorizationException: User magnum does not have privilege to see this application application_1565247558150_1954
2019-08-09 10:21:13,680 WARN applicationhistoryservice.ApplicationHistoryManagerOnTimelineStore (ApplicationHistoryManagerOnTimelineStore.java:generateApplicationReport(687)) - Failed to authorize when generating application report for application_1565247558150_1951. Use a placeholder for its latest attempt id.
org.apache.hadoop.security.authorize.AuthorizationException: User magnum does not have privilege to see this application application_1565247558150_1951