TEZ-4741: ProfileOutputServlet: require instrumentation ACL to read profiler output by Aggarwal-Raghav · Pull Request #526 · apache/tez

Aggarwal-Raghav · 2026-07-19T11:18:49Z

No description provided.

tez-yetus · 2026-07-20T18:02:42Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 8s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ master Compile Tests _
+1 💚	mvninstall	3m 10s		master passed
+1 💚	compile	2m 33s		master passed
+1 💚	checkstyle	0m 22s		master passed
+1 💚	javadoc	0m 17s		master passed
+0 🆗	spotbugs	0m 33s		tez-common in master has 13 extant spotbugs warnings.
			_ Patch Compile Tests _
+1 💚	mvninstall	2m 9s		the patch passed
+1 💚	codespell	0m 49s		No new issues.
+1 💚	compile	2m 31s		the patch passed
+1 💚	javac	2m 31s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	checkstyle	0m 15s		the patch passed
+1 💚	javadoc	0m 18s		the patch passed
+1 💚	spotbugs	0m 41s		the patch passed
			_ Other Tests _
+1 💚	unit	60m 16s		root in the patch passed.
+1 💚	asflicense	0m 21s		The patch does not generate ASF License warnings.
		75m 27s

Subsystem	Report/Notes
Docker	ClientAPI=1.55 ServerAPI=1.55 base: https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-526/3/artifact/out/Dockerfile
Optional Tests	dupname compile unit asflicense javac javadoc spotbugs checkstyle codespell detsecrets
uname	Linux a74df8733a9d 5.15.0-179-generic #189-Ubuntu SMP Tue May 5 18:20:56 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	tez-personality.sh
git revision	master / `0f389d2`
Default Java	Eclipse Adoptium-21.0.11+10-LTS
Test Results	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-526/3/testReport/
Max. process+thread count	1422 (vs. ulimit of 5500)
modules	C: tez-common U: tez-common
Console output	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-526/3/console
versions	git=2.43.0 maven=3.9.15 spotbugs=4.9.3 codespell=2.4.1
Powered by	Apache Yetus 0.15.1 https://yetus.apache.org

This message was automatically generated.

Aggarwal-Raghav · 2026-07-20T19:25:32Z

CC @abstractdog , ready for review

abstractdog

LGTM

https://github.com/apache/hadoop/blob/767c9da6f34f9ed57311ba9f43497563c05b9f46/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java#L1730

apparently, unless the "requires admin" config is set explicitly to true, it's going to keep on working, but this way, cluster administrators have the chance to protect this endpoint

abstractdog · 2026-07-21T09:02:13Z

oh, 1 more thing, sorry @Aggarwal-Raghav , I can see the introduced code is sligtly different from the one in ProfileServlet, can you please unify those? (e.g. exact same message, maybe even a public constant)

tez/tez-common/src/main/java/org/apache/tez/common/web/ProfileServlet.java

Lines 166 to 168 in 0f389d2

    
           response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); 
        
           setResponseHeader(response); 
        
           out.println("Unauthorized: Instrumentation access is not allowed!");

abstractdog

made comment

Aggarwal-Raghav · 2026-07-21T11:01:55Z

oh, 1 more thing, sorry @Aggarwal-Raghav , I can see the introduced code is sligtly different from the one in ProfileServlet, can you please unify those? (e.g. exact same message, maybe even a public constant)

tez/tez-common/src/main/java/org/apache/tez/common/web/ProfileServlet.java

Lines 166 to 168 in 0f389d2

response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);

setResponseHeader(response);

out.println("Unauthorized: Instrumentation access is not allowed!");

@abstractdog , I was planning to do major refactor as part of #527 but the comments are valid for this PR. Will address

Aggarwal-Raghav · 2026-07-21T15:32:54Z

For some reason in this PR, CI is failing, re-triggered it

Aggarwal-Raghav · 2026-07-21T16:18:41Z

Looks some jenkins agent / node issue

Aggarwal-Raghav · 2026-07-22T07:00:46Z

hadoop16 node/agent seems to be problematic. Run 1,4, 5 all failed on that.

…rofiler output

tez-yetus · 2026-07-22T11:13:14Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 8s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ master Compile Tests _
+1 💚	mvninstall	2m 58s		master passed
+1 💚	compile	2m 34s		master passed
+1 💚	checkstyle	0m 23s		master passed
+1 💚	javadoc	0m 19s		master passed
+0 🆗	spotbugs	0m 33s		tez-common in master has 13 extant spotbugs warnings.
			_ Patch Compile Tests _
+1 💚	mvninstall	2m 12s		the patch passed
+1 💚	codespell	0m 51s		No new issues.
+1 💚	compile	2m 30s		the patch passed
+1 💚	javac	2m 30s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	checkstyle	0m 14s		the patch passed
+1 💚	javadoc	0m 17s		the patch passed
+1 💚	spotbugs	0m 39s		the patch passed
			_ Other Tests _
+1 💚	unit	61m 25s		root in the patch passed.
+1 💚	asflicense	0m 22s		The patch does not generate ASF License warnings.
		76m 28s

Subsystem	Report/Notes
Docker	ClientAPI=1.55 ServerAPI=1.55 base: https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-526/6/artifact/out/Dockerfile
Optional Tests	dupname compile unit asflicense javac javadoc spotbugs checkstyle codespell detsecrets
uname	Linux 231e9657ba09 5.15.0-179-generic #189-Ubuntu SMP Tue May 5 18:20:56 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	tez-personality.sh
git revision	master / `74bb821`
Default Java	Eclipse Adoptium-21.0.11+10-LTS
Test Results	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-526/6/testReport/
Max. process+thread count	1380 (vs. ulimit of 5500)
modules	C: tez-common U: tez-common
Console output	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-526/6/console
versions	git=2.43.0 maven=3.9.15 spotbugs=4.9.3 codespell=2.4.1
Powered by	Apache Yetus 0.15.1 https://yetus.apache.org

This message was automatically generated.

abstractdog

LGTM
sorry for the infra problems

Aggarwal-Raghav · 2026-07-22T11:56:59Z

LGTM sorry for the infra problems

No worries, its not in our control

Aggarwal-Raghav force-pushed the TEZ-4741 branch 2 times, most recently from 3f71350 to f2ccf17 Compare July 20, 2026 16:46

abstractdog self-requested a review July 21, 2026 08:53

abstractdog approved these changes Jul 21, 2026

View reviewed changes

abstractdog self-requested a review July 21, 2026 09:02

abstractdog requested changes Jul 21, 2026

View reviewed changes

Aggarwal-Raghav force-pushed the TEZ-4741 branch from f2ccf17 to aa81061 Compare July 21, 2026 11:03

abstractdog self-requested a review July 21, 2026 13:14

Aggarwal-Raghav force-pushed the TEZ-4741 branch from aa81061 to 379d4a3 Compare July 21, 2026 15:32

TEZ-4741: ProfileOutputServlet: require instrumentation ACL to read p…

529b122

…rofiler output

Aggarwal-Raghav force-pushed the TEZ-4741 branch from 379d4a3 to 529b122 Compare July 22, 2026 09:56

abstractdog approved these changes Jul 22, 2026

View reviewed changes

abstractdog merged commit 41145de into apache:master Jul 22, 2026
6 checks passed

Uh oh!

Conversation

Aggarwal-Raghav commented Jul 19, 2026

Uh oh!

tez-yetus commented Jul 20, 2026

Uh oh!

Aggarwal-Raghav commented Jul 20, 2026

Uh oh!

abstractdog left a comment

Choose a reason for hiding this comment

Uh oh!

abstractdog commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

abstractdog left a comment

Choose a reason for hiding this comment

Uh oh!

Aggarwal-Raghav commented Jul 21, 2026

Uh oh!

Aggarwal-Raghav commented Jul 21, 2026

Uh oh!

Aggarwal-Raghav commented Jul 21, 2026

Uh oh!

Aggarwal-Raghav commented Jul 22, 2026

Uh oh!

tez-yetus commented Jul 22, 2026

Uh oh!

abstractdog left a comment

Choose a reason for hiding this comment

Uh oh!

Aggarwal-Raghav commented Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

abstractdog commented Jul 21, 2026 •

edited

Loading