Skip to content

Remove ban tasks with the current thread context#55404

Merged
dnhatn merged 2 commits intoelastic:masterfrom
dnhatn:task-cancel-security
Apr 17, 2020
Merged

Remove ban tasks with the current thread context#55404
dnhatn merged 2 commits intoelastic:masterfrom
dnhatn:task-cancel-security

Conversation

@dnhatn
Copy link
Copy Markdown
Member

@dnhatn dnhatn commented Apr 17, 2020

[2020-04-07T05:23:07,037][WARN ][o.e.x.s.a.AuthorizationService] [v8.0.0-1] denying access as action [internal:admin/tasks/ban] is not an index or cluster action

This warning is for an unban request, not a ban request as we do not have a corresponding log in TransportCancelTasksAction.

If we start unbanning when the last child task completed and that child task executed with a specific user, then unban requests are denied because internal requests can't run with a user. We need to remove bans with the current thread context.

Labelled this non-issue for an unreleased bug.

@dnhatn dnhatn marked this pull request as ready for review April 17, 2020 14:48
@dnhatn dnhatn added the :Distributed/Task Management Issues for anything around the Tasks API - both persistent and node level. label Apr 17, 2020
@elasticmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-distributed (:Distributed/Task Management)

Copy link
Copy Markdown
Contributor

@ywelsch ywelsch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder how this relates to #54887

It does not sound that this would be the cause for that test failure, but just a warning that is logged during the unbanning?

@dnhatn
Copy link
Copy Markdown
Member Author

dnhatn commented Apr 17, 2020

Thanks Yannick!

@dnhatn dnhatn merged commit 9a8aa92 into elastic:master Apr 17, 2020
@dnhatn dnhatn deleted the task-cancel-security branch April 17, 2020 16:40
dnhatn added a commit that referenced this pull request Apr 17, 2020
If we start unbanning when the last child task completed and that child 
task executed with a specific user, then unban requests are denied
because internal requests can't run with a user. We need to remove bans
with the current thread context.
dnhatn added a commit to dnhatn/elasticsearch that referenced this pull request Jun 11, 2020
If the task runs with a user, and it's canceled after we have sent ban
requests, then the unban request will be denied as it must not execute
with a user. We need to wrap it with the current thread context.
dnhatn added a commit to dnhatn/elasticsearch that referenced this pull request Jun 11, 2020
If the task runs with a user, and it's canceled after we have sent ban
requests, then the unban request will be denied as it must not execute
with a user. We need to wrap it with the current thread context.
dnhatn added a commit that referenced this pull request Jun 11, 2020
If a task runs with a user, and it's canceled after we have sent the ban
requests, then the unban request will be denied as it must not execute
with a user. We need to wrap it with the current thread context.

Backport of #55404
dnhatn added a commit that referenced this pull request Jun 11, 2020
If a task runs with a user, and it's canceled after we have sent the ban
requests, then the unban request will be denied as it must not execute
with a user. We need to wrap it with the current thread context.

Backport of #55404
@jakelandis jakelandis removed the v8.0.0 label Jul 26, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

>bug :Distributed/Task Management Issues for anything around the Tasks API - both persistent and node level. v6.8.11 v7.7.2 v7.8.0 v8.0.0-alpha1

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants