Skip to content

Commit 3866c6e

Browse files
K0K0V0KK0K0V0K
committed
MAPREDUCE-7523. MapReduce Task-Level Security Enforcement
The goal of this feature tp provide a configurable mechanism to control which users are allowed to execute specific MapReduce jobs. This feature aims to prevent unauthorized or potentially harmful mapper/reducer implementations from running within the Hadoop cluster. In the standard Hadoop MapReduce execution flow: 1) A MapReduce job is submitted by a user. 2) The job is registered with the Resource Manager (RM). 3) The RM assigns the job to a Node Manager (NM), where the Application Master (AM) for the job is launched. 4) The AM requests additional containers from the cluster, to be able to start tasks. 5) The NM launches those containers, and the containers execute the mapper/reducer tasks defined by the job. The proposed feature introduces a security filtering mechanism inside the Application Master. Before mapper or reducer tasks are launched, the AM will verify that the user-submitted MapReduce code complies with a cluster-defined security policy. This ensures that only approved classes or packages can be executed inside the containers. The goal is to protect the cluster from unwanted or unsafe task implementations, such as custom code that may introduce performance, stability, or security risks. Upon receiving job metadata, the Application Master will: 1) Check the feature is enabled. 2) Check the user who submitted the job is allowed to bypass the security check. 3) Compare classes in job config against the denied task list. 4) If job is not authorised an exception will be thrown and AM will fail. New Configs Enables MapReduce Task-Level Security Enforcement When enabled, the Application Master performs validation of user-submitted mapper, reducer, and other task-related classes before launching containers. This mechanism protects the cluster from running disallowed or unsafe task implementations as defined by administrator-controlled policies. - Property name: mapreduce.security.enabled - Property type: boolean - Default: false (security disabled) MapReduce Task-Level Security Enforcement: Property Domain Defines the set of MapReduce configuration keys that represent user-supplied class names involved in task execution (e.g., mapper, reducer, partitioner). The Application Master examines the values of these properties and checks whether any referenced class is listed in denied tasks. Administrators may override this list to expand or restrict the validation domain. - Property name: mapreduce.security.property-domain - Property type: list of configuration keys - Default: map.sort.class mapreduce.job.classloader.system.classes mapreduce.job.combine.class mapreduce.job.combiner.group.comparator.class mapreduce.job.end-notification.custom-notifier-class mapreduce.job.inputformat.class mapreduce.job.map.class mapreduce.job.map.output.collector.class mapreduce.job.output.group.comparator.class mapreduce.job.output.key.class mapreduce.job.output.key.comparator.class mapreduce.job.output.value.class mapreduce.job.outputformat.class mapreduce.job.partitioner.class mapreduce.job.reduce.class mapreduce.map.output.key.class mapreduce.map.output.value.class MapReduce Task-Level Security Enforcement: Denied Tasks Specifies the list of disallowed task implementation classes or packages. If a user submits a job whose mapper, reducer, or other task-related classes match any entry in this blacklist. - Property name: mapreduce.security.denied-tasks - Property type: list of class name or package patterns - Default: empty - Example: org.apache.hadoop.streaming,org.apache.hadoop.examples.QuasiMonteCarlo MapReduce Task-Level Security Enforcement: Allowed Users Specifies users who may bypass the blacklist defined in denied tasks. This whitelist is intended for trusted or system-level workflows that may legitimately require the use of restricted task implementations. If the submitting user is listed here, blacklist enforcement is skipped, although standard Hadoop authentication and ACL checks still apply. - Property name: mapreduce.security.allowed-users - Property type: list of usernames - Default: empty - Example: alice,bob
1 parent 9c44fa2 commit 3866c6e

File tree

8 files changed

+476
-0
lines changed

8 files changed

+476
-0
lines changed

‎hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/MRAppMaster.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,7 @@
114114
import org.apache.hadoop.mapreduce.v2.app.rm.RMHeartbeatHandler;
115115
import org.apache.hadoop.mapreduce.v2.app.rm.preemption.AMPreemptionPolicy;
116116
import org.apache.hadoop.mapreduce.v2.app.rm.preemption.NoopAMPreemptionPolicy;
117+
import org.apache.hadoop.mapreduce.v2.app.security.authorize.TaskLevelSecurityEnforcer;
117118
import org.apache.hadoop.mapreduce.v2.app.speculate.DefaultSpeculator;
118119
import org.apache.hadoop.mapreduce.v2.app.speculate.Speculator;
119120
import org.apache.hadoop.mapreduce.v2.app.speculate.SpeculatorEvent;
@@ -1683,6 +1684,7 @@ public static void main(String[] args) {
16831684
String jobUserName = System
16841685
.getenv(ApplicationConstants.Environment.USER.name());
16851686
conf.set(MRJobConfig.USER_NAME, jobUserName);
1687+
TaskLevelSecurityEnforcer.validate(conf);
16861688
initAndStartAppMaster(appMaster, conf, jobUserName);
16871689
} catch (Throwable t) {
16881690
LOG.error("Error starting MRAppMaster", t);

‎hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/security/authorize/TaskLevelSecurityEnforcer.java‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
/**
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.hadoop.mapreduce.v2.app.security.authorize;
19+
20+
import java.util.Arrays;
21+
import java.util.List;
22+
23+
import org.slf4j.Logger;
24+
import org.slf4j.LoggerFactory;
25+
26+
import org.apache.hadoop.mapred.JobConf;
27+
import org.apache.hadoop.mapreduce.MRConfig;
28+
import org.apache.hadoop.mapreduce.MRJobConfig;
29+
30+
/**
31+
* Enforces task-level security rules for MapReduce jobs.
32+
*
33+
* <p>This security enforcement mechanism validates whether the user who submitted
34+
* a job is allowed to execute the mapper/reducer/task classes defined in the job
35+
* configuration. The check is performed inside the Application Master before
36+
* task containers are launched.</p>
37+
* <p>If the user is not on the allowed list and any job property within the configured
38+
* security property domain references a denied class/prefix, a
39+
* {@link TaskLevelSecurityException} is thrown and the job is rejected.</p>
40+
* <p>This prevents unauthorized or unsafe custom code from running inside
41+
* cluster containers.</p>
42+
*/
43+
public class TaskLevelSecurityEnforcer {
44+
private static final Logger LOG = LoggerFactory.getLogger(TaskLevelSecurityEnforcer.class);
45+
46+
/**
47+
* Validates a MapReduce job's configuration against the cluster's task-level
48+
* security policy.
49+
*
50+
* <p>The method performs the following steps:</p>
51+
* <ol>
52+
* <li>Check whether task-level security is enabled.</li>
53+
* <li>Allow the job immediately if the user is on the configured allowed-users list.</li>
54+
* <li>Retrieve the security property domain (list of job configuration keys to inspect).</li>
55+
* <li>Retrieve the list of denied task class prefixes.</li>
56+
* <li>For each property in the domain, check whether its value begins with any denied prefix.</li>
57+
* <li>If a match is found, reject the job by throwing {@link TaskLevelSecurityException}.</li>
58+
* </ol>
59+
*
60+
* @param conf the job configuration to validate
61+
* @throws TaskLevelSecurityException if the user is not authorized to use one of the task classes
62+
*/
63+
public static void validate(JobConf conf) throws TaskLevelSecurityException {
64+
if (!conf.getBoolean(MRConfig.SECURITY_ENABLED, MRConfig.DEFAULT_SECURITY_ENABLED)) {
65+
LOG.debug("The {} is disabled", MRConfig.SECURITY_ENABLED);
66+
return;
67+
}
68+
69+
String currentUser = conf.get(MRJobConfig.USER_NAME);
70+
List<String> allowedUsers = Arrays.asList(conf.getTrimmedStrings(
71+
MRConfig.SECURITY_ALLOWED_USERS,
72+
MRConfig.DEFAULT_SECURITY_ALLOWED_USERS
73+
));
74+
if (allowedUsers.contains(currentUser)) {
75+
LOG.debug("The {} is allowed to execute every task", currentUser);
76+
return;
77+
}
78+
79+
String[] propertyDomain = conf.getTrimmedStrings(
80+
MRConfig.SECURITY_PROPERTY_DOMAIN,
81+
MRConfig.DEFAULT_SECURITY_PROPERTY_DOMAIN
82+
);
83+
String[] deniedTasks = conf.getTrimmedStrings(
84+
MRConfig.SECURITY_DENIED_TASKS,
85+
MRConfig.DEFAULT_SECURITY_DENIED_TASKS
86+
);
87+
for (String property : propertyDomain) {
88+
String propertyValue = conf.get(property, "");
89+
for (String deniedTask : deniedTasks) {
90+
if (propertyValue.startsWith(deniedTask)) {
91+
throw new TaskLevelSecurityException(currentUser, property, propertyValue, deniedTask);
92+
}
93+
}
94+
}
95+
LOG.debug("The {} is allowed to execute the submitted job", currentUser);
96+
}
97+
}

‎hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/security/authorize/TaskLevelSecurityException.java‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
/**
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.hadoop.mapreduce.v2.app.security.authorize;
19+
20+
import org.apache.hadoop.security.AccessControlException;
21+
22+
/**
23+
* Exception thrown when a MapReduce job violates the Task-Level Security policy.
24+
*/
25+
public class TaskLevelSecurityException extends AccessControlException {
26+
27+
/**
28+
* Constructs a new TaskLevelSecurityException describing the specific policy violation.
29+
*
30+
* @param user the submitting user
31+
* @param property the MapReduce configuration key that was checked
32+
* @param propertyValue the value provided for that configuration property
33+
* @param deniedTask the blacklist entry that the value matched
34+
*/
35+
public TaskLevelSecurityException(
36+
String user, String property, String propertyValue, String deniedTask
37+
) {
38+
super(String.format(
39+
"The %s is not allowed to use %s = %s config, cause it match with %s denied task",
40+
user, property, propertyValue, deniedTask
41+
));
42+
}
43+
}

‎hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/test/java/org/apache/hadoop/mapreduce/v2/app/security/authorize/TestTaskLevelSecurityEnforcer.java‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
/**
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.hadoop.mapreduce.v2.app.security.authorize;
19+
20+
import org.junit.jupiter.api.Test;
21+
22+
import org.apache.hadoop.mapred.JobConf;
23+
import org.apache.hadoop.mapreduce.MRConfig;
24+
import org.apache.hadoop.mapreduce.MRJobConfig;
25+
26+
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
27+
import static org.junit.jupiter.api.Assertions.assertThrows;
28+
29+
public class TestTaskLevelSecurityEnforcer {
30+
31+
@Test
32+
public void testServiceDisabled() {
33+
JobConf conf = new JobConf();
34+
assertPass(conf);
35+
}
36+
37+
@Test
38+
public void testServiceEnabled() {
39+
JobConf conf = new JobConf();
40+
conf.setBoolean(MRConfig.SECURITY_ENABLED, true);
41+
assertPass(conf);
42+
}
43+
44+
@Test
45+
public void testDeniedPackage() {
46+
JobConf conf = new JobConf();
47+
conf.setBoolean(MRConfig.SECURITY_ENABLED, true);
48+
conf.setStrings(MRConfig.SECURITY_DENIED_TASKS, "org.apache.hadoop.streaming");
49+
conf.set(MRJobConfig.MAP_CLASS_ATTR, "org.apache.hadoop.streaming.PipeMapper");
50+
assertDenied(conf);
51+
}
52+
53+
@Test
54+
public void testDeniedClass() {
55+
JobConf conf = new JobConf();
56+
conf.setBoolean(MRConfig.SECURITY_ENABLED, true);
57+
conf.setStrings(MRConfig.SECURITY_DENIED_TASKS,
58+
"org.apache.hadoop.streaming",
59+
"org.apache.hadoop.examples.QuasiMonteCarlo$QmcReducer");
60+
conf.set(MRJobConfig.REDUCE_CLASS_ATTR,
61+
"org.apache.hadoop.examples.QuasiMonteCarlo$QmcReducer");
62+
assertDenied(conf);
63+
}
64+
65+
@Test
66+
public void testIgnoreReducer() {
67+
JobConf conf = new JobConf();
68+
conf.setBoolean(MRConfig.SECURITY_ENABLED, true);
69+
conf.setStrings(MRConfig.SECURITY_PROPERTY_DOMAIN,
70+
MRJobConfig.MAP_CLASS_ATTR,
71+
MRJobConfig.COMBINE_CLASS_ATTR);
72+
conf.setStrings(MRConfig.SECURITY_DENIED_TASKS,
73+
"org.apache.hadoop.streaming",
74+
"org.apache.hadoop.examples.QuasiMonteCarlo$QmcReducer");
75+
conf.set(MRJobConfig.REDUCE_CLASS_ATTR,
76+
"org.apache.hadoop.examples.QuasiMonteCarlo$QmcReducer");
77+
assertPass(conf);
78+
}
79+
80+
@Test
81+
public void testDeniedUser() {
82+
JobConf conf = new JobConf();
83+
conf.setBoolean(MRConfig.SECURITY_ENABLED, true);
84+
conf.setStrings(MRConfig.SECURITY_DENIED_TASKS, "org.apache.hadoop.streaming");
85+
conf.setStrings(MRConfig.SECURITY_ALLOWED_USERS, "alice");
86+
conf.set(MRJobConfig.MAP_CLASS_ATTR, "org.apache.hadoop.streaming.PipeMapper");
87+
conf.set(MRJobConfig.USER_NAME, "bob");
88+
assertDenied(conf);
89+
}
90+
91+
@Test
92+
public void testAllowedUser() {
93+
JobConf conf = new JobConf();
94+
conf.setBoolean(MRConfig.SECURITY_ENABLED, true);
95+
conf.setStrings(MRConfig.SECURITY_DENIED_TASKS, "org.apache.hadoop.streaming");
96+
conf.setStrings(MRConfig.SECURITY_ALLOWED_USERS, "alice", "bob");
97+
conf.set(MRJobConfig.MAP_CLASS_ATTR, "org.apache.hadoop.streaming.PipeMapper");
98+
conf.set(MRJobConfig.USER_NAME, "bob");
99+
assertPass(conf);
100+
}
101+
102+
@Test
103+
public void testTurnOff() {
104+
JobConf conf = new JobConf();
105+
conf.setBoolean(MRConfig.SECURITY_ENABLED, false);
106+
conf.setStrings(MRConfig.SECURITY_DENIED_TASKS, "org.apache.hadoop.streaming");
107+
conf.setStrings(MRConfig.SECURITY_ALLOWED_USERS, "alice");
108+
conf.set(MRJobConfig.MAP_CLASS_ATTR, "org.apache.hadoop.streaming.PipeMapper");
109+
conf.set(MRJobConfig.USER_NAME, "bob");
110+
assertPass(conf);
111+
}
112+
113+
private void assertPass(JobConf conf) {
114+
assertDoesNotThrow(
115+
() -> TaskLevelSecurityEnforcer.validate(conf),
116+
"Config denied but validation pass was expected");
117+
}
118+
119+
private void assertDenied(JobConf conf) {
120+
assertThrows(TaskLevelSecurityException.class,
121+
() -> TaskLevelSecurityEnforcer.validate(conf),
122+
"Config validation pass but denied was expected");
123+
}
124+
}

‎hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-core/src/main/java/org/apache/hadoop/mapreduce/MRConfig.java‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,5 +133,82 @@ public interface MRConfig {
133133
boolean DEFAULT_MASTER_WEBAPP_UI_ACTIONS_ENABLED = true;
134134
String MULTIPLE_OUTPUTS_CLOSE_THREAD_COUNT = "mapreduce.multiple-outputs-close-threads";
135135
int DEFAULT_MULTIPLE_OUTPUTS_CLOSE_THREAD_COUNT = 10;
136+
137+
/**
138+
* Enables MapReduce Task-Level Security Enforcement.
139+
*
140+
* When enabled, the Application Master performs validation of user-submitted
141+
* mapper, reducer, and other task-related classes before launching containers.
142+
* This mechanism protects the cluster from running disallowed or unsafe task
143+
* implementations as defined by administrator-controlled policies.
144+
*
145+
* Property type: boolean
146+
* Default: false (security disabled)
147+
*/
148+
String SECURITY_ENABLED = "mapreduce.security.enabled";
149+
boolean DEFAULT_SECURITY_ENABLED = false;
150+
151+
/**
152+
* MapReduce Task-Level Security Enforcement: Property Domain
153+
*
154+
* Defines the set of MapReduce configuration keys that represent user-supplied
155+
* class names involved in task execution (e.g., mapper, reducer, partitioner).
156+
* The Application Master examines the values of these properties and checks
157+
* whether any referenced class is listed in {@link #SECURITY_DENIED_TASKS}.
158+
* Administrators may override this list to expand or restrict the validation
159+
* domain.
160+
*
161+
* Property type: list of configuration keys
162+
* Default: all known task-level class properties (see list below)
163+
*/
164+
String SECURITY_PROPERTY_DOMAIN = "mapreduce.security.property-domain";
165+
String[] DEFAULT_SECURITY_PROPERTY_DOMAIN = {
166+
"mapreduce.job.combine.class",
167+
"mapreduce.job.combiner.group.comparator.class",
168+
"mapreduce.job.end-notification.custom-notifier-class",
169+
"mapreduce.job.inputformat.class",
170+
"mapreduce.job.map.class",
171+
"mapreduce.job.map.output.collector.class",
172+
"mapreduce.job.output.group.comparator.class",
173+
"mapreduce.job.output.key.class",
174+
"mapreduce.job.output.key.comparator.class",
175+
"mapreduce.job.output.value.class",
176+
"mapreduce.job.outputformat.class",
177+
"mapreduce.job.partitioner.class",
178+
"mapreduce.job.reduce.class",
179+
"mapreduce.map.output.key.class",
180+
"mapreduce.map.output.value.class"
181+
};
182+
183+
/**
184+
* MapReduce Task-Level Security Enforcement: Denied Tasks
185+
*
186+
* Specifies the list of disallowed task implementation classes or packages.
187+
* If a user submits a job whose mapper, reducer, or other task-related classes
188+
* match any entry in this blacklist.
189+
*
190+
* Property type: list of class name or package patterns
191+
* Default: empty (no restrictions)
192+
* Example: org.apache.hadoop.streaming,org.apache.hadoop.examples.QuasiMonteCarlo
193+
*/
194+
String SECURITY_DENIED_TASKS = "mapreduce.security.denied-tasks";
195+
String[] DEFAULT_SECURITY_DENIED_TASKS = {};
196+
197+
/**
198+
* MapReduce Task-Level Security Enforcement: Allowed Users
199+
*
200+
* Specifies users who may bypass the blacklist defined in
201+
* {@link #SECURITY_DENIED_TASKS}.
202+
* This whitelist is intended for trusted or system-level workflows that may
203+
* legitimately require the use of restricted task implementations.
204+
* If the submitting user is listed here, blacklist enforcement is skipped,
205+
* although standard Hadoop authentication and ACL checks still apply.
206+
*
207+
* Property type: list of usernames
208+
* Default: empty (no bypass users)
209+
* Example: hue,hive
210+
*/
211+
String SECURITY_ALLOWED_USERS = "mapreduce.security.allowed-users";
212+
String[] DEFAULT_SECURITY_ALLOWED_USERS = {};
136213
}
137214

0 commit comments

Comments
 (0)