Index: hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/scheduler/capacity/ParentQueue.java =================================================================== --- hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/scheduler/capacity/ParentQueue.java (revision 1588850) +++ hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/scheduler/capacity/ParentQueue.java (working copy) @@ -429,6 +429,9 @@ @Override public boolean hasAccess(QueueACL acl, UserGroupInformation user) { synchronized (this) { + if (rootQueue) { + return false; + } if (acls.get(acl).isUserAllowed(user)) { return true; } Index: hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/scheduler/capacity/TestParentQueue.java =================================================================== --- hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/scheduler/capacity/TestParentQueue.java (revision 1588850) +++ hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/server/resourcemanager/scheduler/capacity/TestParentQueue.java (working copy) @@ -765,7 +765,31 @@ reset(c); } + + @Test + public void testQueueAclAccessForNonUser() throws Exception { + setupMultiLevelQueues(csConf); + + final String Q_C = CapacitySchedulerConfiguration.ROOT + "." + C; + csConf.setAcl(Q_C, QueueACL.SUBMIT_APPLICATIONS, "S72073"); + + Map queues = new HashMap(); + CSQueue root = CapacityScheduler.parseQueue(csContext, csConf, null, + CapacitySchedulerConfiguration.ROOT, queues, queues, TestUtils.spyHook); + + UserGroupInformation user = UserGroupInformation.getCurrentUser(); + // Setup queue configs + ParentQueue c = (ParentQueue) queues.get(C); + + assertFalse(root.hasAccess(QueueACL.SUBMIT_APPLICATIONS, user)); + assertTrue(c.hasAccess(QueueACL.SUBMIT_APPLICATIONS, user)); + + UserGroupInformation newUser = UserGroupInformation.createUserForTesting( + "test", new String[] { "group" }); + assertFalse(c.hasAccess(QueueACL.SUBMIT_APPLICATIONS, newUser)); + } + @After public void tearDown() throws Exception { }