apache/hadoop · error · TaskLevelSecurityException

The %s is not allowed to use %s = %s config, cause it match

Error message

The %s is not allowed to use %s = %s config, cause it match with %s denied task

What it means

TaskLevelSecurityEnforcer checks every property in mapreduce.security.property-domain (by default the task-pluggable class keys like mapreduce.job.map.class, mapreduce.job.reduce.class, partitioner, input/output format, etc.) and throws TaskLevelSecurityException (an AccessControlException) when a configured value startsWith an entry of mapreduce.security.denied-tasks. It is an administrator policy: jobs that reference blacklisted task classes/packages are rejected before execution.

Source

Thrown at hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/security/authorize/TaskLevelSecurityEnforcer.java:107

    if (allowedUsers.contains(currentUserName)) {
      LOG.debug("The {} is allowed to execute every task", currentUserName);
      return;
    }

    String[] propertyDomain = conf.getTrimmedStrings(
        MRConfig.SECURITY_PROPERTY_DOMAIN,
        MRConfig.DEFAULT_SECURITY_PROPERTY_DOMAIN
    );
    String[] deniedTasks = conf.getTrimmedStrings(
        MRConfig.SECURITY_DENIED_TASKS,
        MRConfig.DEFAULT_SECURITY_DENIED_TASKS
    );
    for (String property : propertyDomain) {
      String propertyValue = conf.getTrimmed(property, "");
      for (String deniedTask : deniedTasks) {
        if (propertyValue.startsWith(deniedTask)) {
          throw new TaskLevelSecurityException(
              currentUserName, property, propertyValue, deniedTask);
        }
      }
    }
    LOG.debug("The {} is allowed to execute the submitted job", currentUser);
  }
}

View on GitHub (pinned to 2add963021)

Solutions

Read the exception text: it names the user, the exact property, its value, and the denied pattern that matched
Change the job to use an allowed class, or drop the offending property so the default applies
If the class is legitimately safe, ask the cluster admin to remove/adjust the mapreduce.security.denied-tasks entry (prefix matching may be over-broad) or to use the allowed-users escape hatch

Defensive patterns

Strategy: try-catch

Try / catch

try {
  job.submit();
} catch (AccessControlException ace) {
  if (ace instanceof TaskLevelSecurityException
      || ace.getMessage().contains("denied task")) {
    // message names user, property, value, and matched denied pattern:
    // switch the job to an allowed class or ask the admin to adjust the policy
    reportPolicyConflict(ace.getMessage());
  } else { throw ace; }
}

Prevention

Publish the cluster's mapreduce.security.denied-tasks list to job authors so they avoid denied classes
Remember matching is prefix-based: a denied package blocks every class under it
Validate task-class configs against the published deny list in job assembly CI

When it happens

Trigger: Job submits with mapreduce.job.map.class set to a class or package prefix listed in mapreduce.security.denied-tasks (matching is prefix-based, so denying 'org.apache.hadoop.streamline.' blocks any class under it); admins add a deny pattern and pre-existing job configs now match.

Common situations: Cluster policy blocking known-bad or unapproved mapper/reducer implementations (e.g., denial after a CVE in a specific class); shared clusters with restricted scripting runners (Hadoop Streaming jars) matched by package prefix; job templates referencing a class an admin later denied.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/98628b5fa8312ce7. Report an issue: GitHub.