HADOOP-11228. Winutils task: unsecure path should not call AddNodeManagerAndUserACEsToObject. Contributed by Remus Rusanu

(cherry picked from commit f7e89bb349d4512b47f94b545e3f489a85e851f0)

Conflicts:
	hadoop-common-project/hadoop-common/CHANGES.txt
(cherry picked from commit 299c9b456de1944181c8a54d9bd6033901718cc1)

hadoop-common-project/hadoop-common/CHANGES.txt

@@ -633,6 +633,9 @@ Release 2.6.0 - UNRELEASED
     HADOOP-11122. Fix findbugs in ZK DelegationTokenSecretManagers.
     (Arun Suresh via kasha)
 
+    HADOOP-11228. Winutils task: unsecure path should not call
+    AddNodeManagerAndUserACEsToObject. (Remus Rusanu via jianhe)
+
 Release 2.5.1 - 2014-09-05
 
   INCOMPATIBLE CHANGES

hadoop-common-project/hadoop-common/src/main/winutils/task.c

@@ -627,11 +627,13 @@ DWORD CreateTaskImpl(__in_opt HANDLE logonHandle, __in PCWSTR jobObjName,__in PC
     return dwErrorCode;
   }
 
-  dwErrorCode = AddNodeManagerAndUserACEsToObject(jobObject, userName, JOB_OBJECT_ALL_ACCESS);
-  if (dwErrorCode) {
-    ReportErrorCode(L"AddNodeManagerAndUserACEsToObject", dwErrorCode);
-    CloseHandle(jobObject);
-    return dwErrorCode;
+  if (logonHandle != NULL) {
+    dwErrorCode = AddNodeManagerAndUserACEsToObject(jobObject, userName, JOB_OBJECT_ALL_ACCESS);
+    if (dwErrorCode) {
+      ReportErrorCode(L"AddNodeManagerAndUserACEsToObject", dwErrorCode);
+      CloseHandle(jobObject);
+      return dwErrorCode;
+    }
   }
 
   if(AssignProcessToJobObject(jobObject, GetCurrentProcess()) == 0)
@@ -706,6 +708,8 @@ DWORD CreateTaskImpl(__in_opt HANDLE logonHandle, __in PCWSTR jobObjName,__in PC
          dwErrorCode = GetLastError();
          ReportErrorCode(L"CreateProcess", dwErrorCode);
       }
+
+    // task create (w/o createAsUser) does not need the ACEs change on the process
     goto create_process_done;
   }