restrict deserialized classes in LeveldbConfigurationStore log decode#8557
Open
naruto-lgtm wants to merge 1 commit into
Open
restrict deserialized classes in LeveldbConfigurationStore log decode#8557naruto-lgtm wants to merge 1 commit into
naruto-lgtm wants to merge 1 commit into
Conversation
naruto-lgtm
force-pushed
the
leveldb-conf-store-deser-allowlist
branch
from
e139021 to
f39469c
Compare
Author
|
Rebased onto current trunk to retrigger CI. The previous Jenkins run hung in an unrelated RM test after TestLeveldbConfigurationStore passed 10/10, and the Actions build check needed the branch off a newer base. |
naruto-lgtm
force-pushed
the
leveldb-conf-store-deser-allowlist
branch
from
f39469c to
b790705
Compare
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
Author
|
The -1 in the latest Yetus run is TestLeafQueue#testMaxApplicationsWithNodeLabels erroring inside Mockito spy stubbing (WrongTypeOfReturnValue on getNumAsyncSchedulerThreads), which is a stubbing race on the CapacityScheduler spy, not this patch; the change only touches deserialization in LeveldbConfigurationStore and TestLeafQueue has no reference to the configuration store. The previous Yetus run on the same branch passed the full resourcemanager suite with TestLeafQueue green. On test4tests, the manual verification steps are in the description under 'How was this patch tested'. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of PR
LeveldbConfigurationStore.deserLogMutationsreads the scheduler configuration mutation log back from the LevelDB store with a rawObjectInputStream.readObject(). Anyone who can write the store directory (yarn.scheduler.configuration.leveldb-store.path) can replace the serializedLinkedList<LogMutation>with a gadget payload, and the RM will instantiate arbitrary Serializable classes off the classpath on the next load/recovery.The sibling
ZKConfigurationStorealready decodes the sameLinkedList<LogMutation>through commons-ioValidatingObjectInputStreamwith an explicit class allowlist; the LevelDB store was left on the unrestricted path. This change applies the same allowlist (LinkedList,LogMutation,HashMap,String) inside the decode helper so the restriction lives next to the read rather than relying on the store being trusted.How was this patch tested?
Round-tripped a real
LinkedList<LogMutation>(aHashMapof updates plus a user string) through the patched helper - it deserializes unchanged. A serialized object of a class outside the allowlist is now rejected withInvalidClassException ("Class name not accepted")instead of being constructed. Builthadoop-yarn-server-resourcemanagerwith the change.For code changes:
LICENSE,LICENSE-binary,NOTICE-binaryfiles?AI Tooling
If an AI tool was used:
where is the name of the AI tool used.
https://www.apache.org/legal/generative-tooling.html