{"record":{"id":"98628b5fa8312ce7","repo":"apache/hadoop","slug":"the-s-is-not-allowed-to-use-s-s-config-cause","errorCode":null,"errorMessage":"The %s is not allowed to use %s = %s config, cause it match with %s denied task","messagePattern":"The (.+?) is not allowed to use (.+?) = (.+?) config, cause it match with (.+?) denied task","errorType":"exception","errorClass":"TaskLevelSecurityException","httpStatus":null,"severity":"error","filePath":"hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/security/authorize/TaskLevelSecurityEnforcer.java","lineNumber":107,"sourceCode":"\n    if (allowedUsers.contains(currentUserName)) {\n      LOG.debug(\"The {} is allowed to execute every task\", currentUserName);\n      return;\n    }\n\n    String[] propertyDomain = conf.getTrimmedStrings(\n        MRConfig.SECURITY_PROPERTY_DOMAIN,\n        MRConfig.DEFAULT_SECURITY_PROPERTY_DOMAIN\n    );\n    String[] deniedTasks = conf.getTrimmedStrings(\n        MRConfig.SECURITY_DENIED_TASKS,\n        MRConfig.DEFAULT_SECURITY_DENIED_TASKS\n    );\n    for (String property : propertyDomain) {\n      String propertyValue = conf.getTrimmed(property, \"\");\n      for (String deniedTask : deniedTasks) {\n        if (propertyValue.startsWith(deniedTask)) {\n          throw new TaskLevelSecurityException(\n              currentUserName, property, propertyValue, deniedTask);\n        }\n      }\n    }\n    LOG.debug(\"The {} is allowed to execute the submitted job\", currentUser);\n  }\n}\n","sourceCodeStart":89,"sourceCodeEnd":115,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-app/src/main/java/org/apache/hadoop/mapreduce/v2/app/security/authorize/TaskLevelSecurityEnforcer.java#L89-L115","documentation":"TaskLevelSecurityEnforcer checks every property in mapreduce.security.property-domain (by default the task-pluggable class keys like mapreduce.job.map.class, mapreduce.job.reduce.class, partitioner, input/output format, etc.) and throws TaskLevelSecurityException (an AccessControlException) when a configured value startsWith an entry of mapreduce.security.denied-tasks. It is an administrator policy: jobs that reference blacklisted task classes/packages are rejected before execution.","triggerScenarios":"Job submits with mapreduce.job.map.class set to a class or package prefix listed in mapreduce.security.denied-tasks (matching is prefix-based, so denying 'org.apache.hadoop.streamline.' blocks any class under it); admins add a deny pattern and pre-existing job configs now match.","commonSituations":"Cluster policy blocking known-bad or unapproved mapper/reducer implementations (e.g., denial after a CVE in a specific class); shared clusters with restricted scripting runners (Hadoop Streaming jars) matched by package prefix; job templates referencing a class an admin later denied.","solutions":["Read the exception text: it names the user, the exact property, its value, and the denied pattern that matched","Change the job to use an allowed class, or drop the offending property so the default applies","If the class is legitimately safe, ask the cluster admin to remove/adjust the mapreduce.security.denied-tasks entry (prefix matching may be over-broad) or to use the allowed-users escape hatch"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  job.submit();\n} catch (AccessControlException ace) {\n  if (ace instanceof TaskLevelSecurityException\n      || ace.getMessage().contains(\"denied task\")) {\n    // message names user, property, value, and matched denied pattern:\n    // switch the job to an allowed class or ask the admin to adjust the policy\n    reportPolicyConflict(ace.getMessage());\n  } else { throw ace; }\n}","preventionTips":["Publish the cluster's mapreduce.security.denied-tasks list to job authors so they avoid denied classes","Remember matching is prefix-based: a denied package blocks every class under it","Validate task-class configs against the published deny list in job assembly CI"],"tags":["mapreduce","security","access-control","blacklist","configuration"],"backgroundTag":"policy-blacklisted-class","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}