HIVE-29293: Restrict config 'mapreduce.job.queuename' at tez session #6155
Conversation
ayushtkn
left a comment
ayushtkn
left a comment
There was a problem hiding this comment.
Isn't this an intentional behaviour?
hive/ql/src/java/org/apache/hadoop/hive/ql/exec/tez/TezSessionState.java
Lines 559 to 560 in 4669cd5
The Javadoc of this method even states:
/**
* This takes settings from MR and applies them to the appropriate Tez configuration. This is
* similar to what Pig on Tez does (refer MRToTezHelper.java).
*
* @param conf configuration with MR settings
asf-ci-hive
added
tests pending
tests unstable
and removed
tests passed
tests pending
tests unstable
labels
|
|
@ayushtkn - can you review this patch again? |
|
@ayushtkn @abstractdog - Can you please review this patch? Thanks |
| "exception will be thrown."), | ||
| "The configuration settings that cannot be set when submitting jobs to HiveServer2. If\n" + | ||
| "any of these are set to values different from those in the server configuration, an\n" + | ||
| "exception will be thrown."), |
There was a problem hiding this comment.
These changes seem unrelated to the issue, and may lead to merge conflict later. Please consider reverting these.
There was a problem hiding this comment.
It looks like the indentation has changed for these in the new commits. Although minor, it would be nice to revert these changes completely as it's unrelated to the issue. Otherwise, everything LGTM.
ql/src/java/org/apache/hadoop/hive/ql/exec/tez/TezSessionPoolManager.java
Outdated
Show resolved
Hide resolved
saihemanth-cloudera
force-pushed
the
hive-29293
branch
from
63ef9ce to
35dbbd1
Compare
|
4 participants
What changes were proposed in this pull request?
Verify config 'mapreduce.job.queuename' value, if tez.queue.name is null.
Why are the changes needed?
When tez.queue.name is null, setting 'mapreduce.job.queuename' creates security issue because any user can submit job to this queue. TezSessionPoolManager is currently not verifying the queue since null is being passed. This patch addresses this concern by verifying that if tez.queue.name is null, then we verify 'mapreduce.job.queuename'.
Does this PR introduce any user-facing change?
No
How was this patch tested?
Remote cluster.