TEZ-4741: ProfileOutputServlet: require instrumentation ACL to read profiler output

[Aggarwal-Raghav]

No description provided.

[tez-yetus]

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 8s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ master Compile Tests _
+1 💚	mvninstall	3m 10s		master passed
+1 💚	compile	2m 33s		master passed
+1 💚	checkstyle	0m 22s		master passed
+1 💚	javadoc	0m 17s		master passed
+0 🆗	spotbugs	0m 33s		tez-common in master has 13 extant spotbugs warnings.
			_ Patch Compile Tests _
+1 💚	mvninstall	2m 9s		the patch passed
+1 💚	codespell	0m 49s		No new issues.
+1 💚	compile	2m 31s		the patch passed
+1 💚	javac	2m 31s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	checkstyle	0m 15s		the patch passed
+1 💚	javadoc	0m 18s		the patch passed
+1 💚	spotbugs	0m 41s		the patch passed
			_ Other Tests _
+1 💚	unit	60m 16s		root in the patch passed.
+1 💚	asflicense	0m 21s		The patch does not generate ASF License warnings.
		75m 27s

Subsystem	Report/Notes
Docker	ClientAPI=1.55 ServerAPI=1.55 base: https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-526/3/artifact/out/Dockerfile
Optional Tests	dupname compile unit asflicense javac javadoc spotbugs checkstyle codespell detsecrets
uname	Linux a74df8733a9d 5.15.0-179-generic #189-Ubuntu SMP Tue May 5 18:20:56 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	tez-personality.sh
git revision	master / 0f389d2
Default Java	Eclipse Adoptium-21.0.11+10-LTS
Test Results	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-526/3/testReport/
Max. process+thread count	1422 (vs. ulimit of 5500)
modules	C: tez-common U: tez-common
Console output	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-526/3/console
versions	git=2.43.0 maven=3.9.15 spotbugs=4.9.3 codespell=2.4.1
Powered by	Apache Yetus 0.15.1 https://yetus.apache.org

This message was automatically generated.

[Aggarwal-Raghav]

CC @abstractdog , ready for review

[abstractdog]

LGTM

https://github.com/apache/hadoop/blob/767c9da6f34f9ed57311ba9f43497563c05b9f46/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java#L1730

apparently, unless the "requires admin" config is set explicitly to true, it's going to keep on working, but this way, cluster administrators have the chance to protect this endpoint

[abstractdog]

oh, 1 more thing, sorry @Aggarwal-Raghav , I can see the introduced code is sligtly different from the one in ProfileServlet, can you please unify those? (e.g. exact same message, maybe even a public constant)

tez/tez-common/src/main/java/org/apache/tez/common/web/ProfileServlet.java

Lines 166 to 168 in 0f389d2

	response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
	setResponseHeader(response);
	out.println("Unauthorized: Instrumentation access is not allowed!");

[abstractdog]

made comment

[Aggarwal-Raghav]

oh, 1 more thing, sorry @Aggarwal-Raghav , I can see the introduced code is sligtly different from the one in ProfileServlet, can you please unify those? (e.g. exact same message, maybe even a public constant)

tez/tez-common/src/main/java/org/apache/tez/common/web/ProfileServlet.java

Lines 166 to 168 in 0f389d2

	response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
	setResponseHeader(response);
	out.println("Unauthorized: Instrumentation access is not allowed!");

@abstractdog , I was planning to do major refactor as part of #527 but the comments are valid for this PR. Will address

[Aggarwal-Raghav]

For some reason in this PR, CI is failing, re-triggered it

[Aggarwal-Raghav]

Looks some jenkins agent / node issue

[Aggarwal-Raghav]

hadoop16 node/agent seems to be problematic. Run 1,4, 5 all failed on that.