hadoop-yarn-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jason Lowe (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (YARN-1771) many getFileStatus calls made from node manager for localizing a public distributed cache resource
Date Mon, 03 Mar 2014 20:57:22 GMT

    [ https://issues.apache.org/jira/browse/YARN-1771?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13918565#comment-13918565
] 

Jason Lowe commented on YARN-1771:
----------------------------------

Today the public cache localizes as the NM user, so the public checking is important to avoid
a security problem where the user could convince the NM to localize a file for which the user
does not have privileges but the NM user does (e.g.: please localize that other job's .jhist
file, aggregated logs, etc.).  So I think we need some kind of access check, either as the
requesting user or explicit access checks like it does today, to avoid a malicious client
obtaining access to private files via the NM.

> many getFileStatus calls made from node manager for localizing a public distributed cache
resource
> --------------------------------------------------------------------------------------------------
>
>                 Key: YARN-1771
>                 URL: https://issues.apache.org/jira/browse/YARN-1771
>             Project: Hadoop YARN
>          Issue Type: Bug
>          Components: nodemanager
>            Reporter: Sangjin Lee
>            Assignee: Sangjin Lee
>            Priority: Critical
>
> We're observing that the getFileStatus calls are putting a fair amount of load on the
name node as part of checking the public-ness for localizing a resource that belong in the
public cache.
> We see 7 getFileStatus calls made for each of these resource. We should look into reducing
the number of calls to the name node. One example:
> {noformat}
> 2014-02-27 18:07:27,351 INFO audit: ... cmd=getfileinfo	src=/tmp/temp-887708724/tmp883330348/foo-0.0.44.jar
...
> 2014-02-27 18:07:27,352 INFO audit: ... cmd=getfileinfo	src=/tmp/temp-887708724/tmp883330348/foo-0.0.44.jar
...
> 2014-02-27 18:07:27,352 INFO audit: ... cmd=getfileinfo	src=/tmp/temp-887708724/tmp883330348
...
> 2014-02-27 18:07:27,353 INFO audit: ... cmd=getfileinfo	src=/tmp/temp-887708724 ...
> 2014-02-27 18:07:27,353 INFO audit: ... cmd=getfileinfo	src=/tmp ...
> 2014-02-27 18:07:27,354 INFO audit: ... cmd=getfileinfo	src=/	 ...
> 2014-02-27 18:07:27,354 INFO audit: ... cmd=getfileinfo	src=/tmp/temp-887708724/tmp883330348/foo-0.0.44.jar
...
> 2014-02-27 18:07:27,355 INFO audit: ... cmd=open	src=/tmp/temp-887708724/tmp883330348/foo-0.0.44.jar
...
> {noformat}



--
This message was sent by Atlassian JIRA
(v6.2#6252)

Mime
View raw message