Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

YARN-1796. container-executor shouldn't require o-r permissions. Contributed by Aaron T. Myers. 

git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/branches/branch-2@1613549 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Aaron Myers 2014-07-26 01:52:25 +00:00
parent 775897ee02
commit 5d0172fdf5
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hadoop-yarn-project/CHANGES.txt
View File

@ -88,6 +88,8 @@ Release 2.6.0 - UNRELEASED
YARN-2147. client lacks delegation token exception details when YARN-2147. client lacks delegation token exception details when
application submit fails (Chen He via jlowe) application submit fails (Chen He via jlowe)
YARN-1796. container-executor shouldn't require o-r permissions (atm)
Release 2.5.0 - UNRELEASED Release 2.5.0 - UNRELEASED
INCOMPATIBLE CHANGES INCOMPATIBLE CHANGES

12
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/native/container-executor/impl/container-executor.c
View File

@ -111,16 +111,16 @@ int check_executor_permissions(char *executable_file) {
return -1; return -1;
} }
// check others do not have read/write/execute permissions // check others do not have write/execute permissions
if ((filestat.st_mode & S_IROTH) == S_IROTH || (filestat.st_mode & S_IWOTH) if ((filestat.st_mode & S_IWOTH) == S_IWOTH ||
== S_IWOTH || (filestat.st_mode & S_IXOTH) == S_IXOTH) { (filestat.st_mode & S_IXOTH) == S_IXOTH) {
fprintf(LOGFILE, fprintf(LOGFILE,
"The container-executor binary should not have read or write or" "The container-executor binary should not have write or execute "
" execute for others.\n"); "for others.\n");
return -1; return -1;
} }
// Binary should be setuid/setgid executable // Binary should be setuid executable
if ((filestat.st_mode & S_ISUID) == 0) { if ((filestat.st_mode & S_ISUID) == 0) {
fprintf(LOGFILE, "The container-executor binary should be set setuid.\n"); fprintf(LOGFILE, "The container-executor binary should be set setuid.\n");
return -1; return -1;