-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
drivers/exec+java: reduce default set of linux capabilities #10600
Commits on May 17, 2021
-
drivers/exec: enable setting allow_caps on exec driver
This PR enables setting allow_caps on the exec driver plugin configuration, as well as cap_add and cap_drop in exec task configuration. These options replicate the functionality already present in the docker task driver. Important: this change also reduces the default set of capabilities enabled by the exec driver to match the default set enabled by the docker driver. Until v1.0.5 the exec task driver would enable all capabilities supported by the operating system. v1.0.5 removed NET_RAW from that list of default capabilities, but left may others which could potentially also be leveraged by compromised tasks. Important: the "root" user is still special cased when used with the exec driver. Older versions of Nomad enabled enabled all capabilities supported by the operating system for tasks set with the root user. To maintain compatibility with existing clusters we continue supporting this "feature", however we maintain support for the legacy set of capabilities rather than enabling all capabilities now supported on modern operating systems.
Configuration menu - View commit details
-
Copy full SHA for 191144c - Browse repository at this point
Copy the full SHA 191144cView commit details -
drivers/java: enable setting allow_caps on java driver
Enable setting allow_caps on the java task driver plugin, along with the associated cap_add and cap_drop options in java task configuration.
Configuration menu - View commit details
-
Copy full SHA for 9bb4b8f - Browse repository at this point
Copy the full SHA 9bb4b8fView commit details -
drivers/docker: reuse capabilities plumbing in docker driver
This changeset does not introduce any functional change for the docker driver, but rather cleans up the implementation around computing configured capabilities by re-using code written for the exec/java task drivers.
Configuration menu - View commit details
-
Copy full SHA for c34beb4 - Browse repository at this point
Copy the full SHA c34beb4View commit details -
docs: update docs for linux capabilities in exec/java/docker drivers
Update docs for allow_caps, cap_add, cap_drop in exec/java/docker driver pages. Also update upgrade guide with guidance on new default linux capabilities for exec and java drivers.
Configuration menu - View commit details
-
Copy full SHA for 7245ac3 - Browse repository at this point
Copy the full SHA 7245ac3View commit details -
drivers: fixup linux version dependent test cases
The error output being checked depends on the linux caps supported by the particular operating system. Fix these test cases to just check that an error did occur.
Configuration menu - View commit details
-
Copy full SHA for 17ec5a5 - Browse repository at this point
Copy the full SHA 17ec5a5View commit details -
Configuration menu - View commit details
-
Copy full SHA for 683751d - Browse repository at this point
Copy the full SHA 683751dView commit details -
drivers/exec: pass capabilities through executor RPC
Add capabilities to the LaunchRequest proto so that the capabilities set actually gets plumbed all the way through to task launch.
Configuration menu - View commit details
-
Copy full SHA for 595cef8 - Browse repository at this point
Copy the full SHA 595cef8View commit details -
Configuration menu - View commit details
-
Copy full SHA for 845a3d3 - Browse repository at this point
Copy the full SHA 845a3d3View commit details