drivers/exec: Restore 0.8 capabilities #5728
Conversation
Nomad 0.9 incidentally set effective capabilities that is higher than what's expected of a `nobody` process, and what's set in 0.8. This change restores the capabilities to ones used in Nomad 0.9.
| ) | ||
|
|
||
| // initialize the allCaps var with all capabilities available on the system | ||
| func init() { |
There was a problem hiding this comment.
I chose to avoid using an initializer here. It's only used once at launching executor container (and a executor process only launches a single container now), and we don't need to initialize it in main nomad/logmon/etc process.
|
Oops, don't forget changelog entry |
|
So noticed that tests are failing and I'm failing to create some containers unexpectedly; so will dig in and request another review. |
|
@schmichael Oops - I updated tests and they are passing now. |
Nomad 0.9.2 addresses CVE-2019-12618 (hashicorp/nomad#5728). Removes yarn build error -- no longer required as the assets are vendored, so it's possible to build this on i686. Removes nonvidia patch. The changes are upstream in 0.9.2.
Nomad 0.9.2 addresses CVE-2019-12618 (hashicorp/nomad#5728). Removes yarn build error -- no longer required as the assets are vendored, so it's possible to build this on i686. Removes nonvidia patch. The changes are upstream in 0.9.2. Closes: #12169 [via git-merge-pr]
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
Nomad 0.9 incidentally set effective capabilities that is higher than
what's expected of a
nobodyprocess, and what's set in 0.8.This change restores the capabilities to ones used in Nomad 0.8.
The capabilities impact is non-trivial. Some operations (e.g. mount/shutdown) seems to check for effective uid so by default
nobodyuser wouldn't be doing much damage. On the other hand, other operations seem to succeed, e.g. binding to privileged ports as nobody.Some capabilities are dangerous: CAP_DAC_OVERRIDE allowed processes to read and manipulate any accessible paths bypassing file permission checks. Restoring proper permisisons, unmasked two tests that didn't have permissions set correctly.