Skip to content

YARN-11382 ClientRMService forget to record some audit logs after checkAccess. #5263

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

YARN-11382 ClientRMService forget to record some audit logs after checkAccess. #5263

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion ...emanager/src/main/java/org/apache/hadoop/yarn/server/resourcemanager/ClientRMService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -420,6 +420,8 @@ public GetApplicationReportResponse getApplicationReport(
GetApplicationReportResponse response = recordFactory
.newRecordInstance(GetApplicationReportResponse.class);
response.setApplicationReport(report);
RMAuditLogger.logSuccess(callerUGI.getUserName(),
AuditConstants.GET_APP_REPORT, "ClientRMService", applicationId);
return response;
}

Expand Down Expand Up @@ -449,7 +451,14 @@ public GetApplicationAttemptReportResponse getApplicationAttemptReport(
ApplicationAttemptReport attemptReport = appAttempt
.createApplicationAttemptReport();
response = GetApplicationAttemptReportResponse.newInstance(attemptReport);
RMAuditLogger.logSuccess(callerUGI.getUserName(),
AuditConstants.GET_APP_ATTEMPT_REPORT, "ClientRMService",
applicationId, appAttemptId);
}else{
RMAuditLogger.logFailure(callerUGI.getShortUserName(),
AuditConstants.GET_APP_ATTEMPT_REPORT, "User does not have privilege to "
+ ApplicationAccessType.VIEW_APP.toString(), "ClientRMService",
AuditConstants.UNAUTHORIZED_USER, applicationId, appAttemptId);
throw new YarnException("User " + callerUGI.getShortUserName()
+ " does not have privilege to see this attempt " + appAttemptId);
}
Expand Down Expand Up @@ -480,7 +489,13 @@ public GetApplicationAttemptsResponse getApplicationAttempts(
.createApplicationAttemptReport());
}
response = GetApplicationAttemptsResponse.newInstance(listAttempts);
RMAuditLogger.logSuccess(callerUGI.getUserName(),
AuditConstants.GET_APP_ATTEMPTS, "ClientRMService", appId);
} else {
RMAuditLogger.logFailure(callerUGI.getShortUserName(),
AuditConstants.GET_APP_ATTEMPTS, "User does not have privilege to "
+ ApplicationAccessType.VIEW_APP.toString(), "ClientRMService",
AuditConstants.UNAUTHORIZED_USER, appId);
throw new YarnException("User " + callerUGI.getShortUserName()
+ " does not have privilege to see this application " + appId);
}
Expand Down Expand Up @@ -525,7 +540,13 @@ public GetContainerReportResponse getContainerReport(
}
response = GetContainerReportResponse.newInstance(rmContainer
.createContainerReport());
RMAuditLogger.logSuccess(callerUGI.getUserName(),
AuditConstants.GET_CONTAINER_REPORT, "ClientRMService", appId);
} else {
RMAuditLogger.logFailure(callerUGI.getShortUserName(),
AuditConstants.GET_CONTAINER_REPORT, "User does not have privilege to "
+ ApplicationAccessType.VIEW_APP.toString(), "ClientRMService",
AuditConstants.UNAUTHORIZED_USER, appId);
throw new YarnException("User " + callerUGI.getShortUserName()
+ " does not have privilege to see this application " + appId);
}
Expand Down Expand Up @@ -568,7 +589,13 @@ public GetContainersResponse getContainers(GetContainersRequest request)
listContainers.add(rmContainer.createContainerReport());
}
response = GetContainersResponse.newInstance(listContainers);
RMAuditLogger.logSuccess(callerUGI.getUserName(),
AuditConstants.GET_CONTAINERS, "ClientRMService", appId);
} else {
RMAuditLogger.logFailure(callerUGI.getShortUserName(),
AuditConstants.GET_CONTAINERS, "User doesn't have permissions to "
+ ApplicationAccessType.VIEW_APP.toString(), "ClientRMService",
AuditConstants.UNAUTHORIZED_USER, appId);
throw new YarnException("User " + callerUGI.getShortUserName()
+ " does not have privilege to see this application " + appId);
}
Expand Down Expand Up @@ -1475,7 +1502,7 @@ public ReservationListResponse listReservations(
requestInfo.getReservationId());
}

checkReservationACLs(requestInfo.getQueue(),
String user = checkReservationACLs(requestInfo.getQueue(),
AuditConstants.LIST_RESERVATION_REQUEST, reservationId);

long startTime = Math.max(requestInfo.getStartTime(), 0);
Expand All @@ -1492,6 +1519,8 @@ public ReservationListResponse listReservations(
reservations, includeResourceAllocations);

response.setReservationAllocationState(info);
RMAuditLogger.logSuccess(user, AuditConstants.LIST_RESERVATION_REQUEST,
"ClientRMService: " + reservationId);
return response;
}

Expand Down