Mailing-List: contact yarn-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Date: Thu, 6 Apr 2017 14:57:41 +0000 (UTC)
From: "Greg Phillips (JIRA)" <jira@apache.org>
To: yarn-issues@hadoop.apache.org
Message-ID: <JIRA.13061739.1491399466000.224888.1491490661868@Atlassian.JIRA>
In-Reply-To: <JIRA.13061739.1491399466000@Atlassian.JIRA>
References: <JIRA.13061739.1491399466000@Atlassian.JIRA> <JIRA.13061739.1491399466212@jira-lw-us.apache.org>
Subject: [jira] [Updated] (YARN-6447) Provide container sandbox policies for
 groups
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 06 Apr 2017 14:57:50 -0000


     [ https://issues.apache.org/jira/browse/YARN-6447?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Greg Phillips updated YARN-6447:
--------------------------------
    Attachment: YARN-6447.001.patch

Small patch to allow groups to be mapped to custom Java Security Manager policy files using the following yarn-site configuration:
yarn.nodemanager.runtime.linux.sandbox-mode.policy.group.$groupName

If a given user is a member of multiple groups with custom policy files, the user will receive the superset of all permissions from the groups to which they belong.


> Provide container sandbox policies for groups 
> ----------------------------------------------
>
>                 Key: YARN-6447
>                 URL: https://issues.apache.org/jira/browse/YARN-6447
>             Project: Hadoop YARN
>          Issue Type: Improvement
>          Components: nodemanager, yarn
>    Affects Versions: 3.0.0-alpha3
>            Reporter: Greg Phillips
>            Assignee: Greg Phillips
>            Priority: Minor
>         Attachments: YARN-6447.001.patch
>
>
> Currently the container sandbox feature ([YARN-5280|https://issues.apache.org/jira/browse/YARN-5280]) allows YARN administrators to use one Java Security Manager policy file to limit the permissions granted to YARN containers.  It would be useful to allow for different policy files to be used based on groups.
> For example, an administrator may want to ensure standard users who write applications for the MapReduce or Tez frameworks are not allowed to open arbitrary network connections within their data processing code.  Users who are designing the ETL pipelines however may need to open sockets to extract data from external sources.  By assigning these sets of users to different groups and setting specific policies for each group you can assert fine grained control over the permissions granted to each Java based container across a YARN cluster.


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org