Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

drivers/exec+java: reduce default set of linux capabilities #10600

Merged
merged 8 commits into from
May 17, 2021
Merged

drivers/exec+java: reduce default set of linux capabilities #10600

merged 8 commits into from
May 17, 2021

Commits on May 17, 2021

  1. drivers/exec: enable setting allow_caps on exec driver 

    This PR enables setting allow_caps on the exec driver
plugin configuration, as well as cap_add and cap_drop in
exec task configuration. These options replicate the
functionality already present in the docker task driver.

Important: this change also reduces the default set of
capabilities enabled by the exec driver to match the
default set enabled by the docker driver. Until v1.0.5
the exec task driver would enable all capabilities supported
by the operating system. v1.0.5 removed NET_RAW from that
list of default capabilities, but left may others which
could potentially also be leveraged by compromised tasks.

Important: the "root" user is still special cased when
used with the exec driver. Older versions of Nomad enabled
enabled all capabilities supported by the operating system
for tasks set with the root user. To maintain compatibility
with existing clusters we continue supporting this "feature",
however we maintain support for the legacy set of capabilities
rather than enabling all capabilities now supported on modern
operating systems.
    @shoenig
    shoenig committed May 17, 2021
    Configuration menu
    Copy the full SHA
    191144c View commit details
    Browse the repository at this point in the history

  2. drivers/java: enable setting allow_caps on java driver 

    Enable setting allow_caps on the java task driver plugin, along
with the associated cap_add and cap_drop options in java task
configuration.
    @shoenig
    shoenig committed May 17, 2021
    Configuration menu
    Copy the full SHA
    9bb4b8f View commit details
    Browse the repository at this point in the history

  3. drivers/docker: reuse capabilities plumbing in docker driver 

    This changeset does not introduce any functional change for the
docker driver, but rather cleans up the implementation around
computing configured capabilities by re-using code written for
the exec/java task drivers.
    @shoenig
    shoenig committed May 17, 2021
    Configuration menu
    Copy the full SHA
    c34beb4 View commit details
    Browse the repository at this point in the history

  4. docs: update docs for linux capabilities in exec/java/docker drivers 

    Update docs for allow_caps, cap_add, cap_drop in exec/java/docker driver
pages. Also update upgrade guide with guidance on new default linux
capabilities for exec and java drivers.
    @shoenig
    shoenig committed May 17, 2021
    Configuration menu
    Copy the full SHA
    7245ac3 View commit details
    Browse the repository at this point in the history

  5. drivers: fixup linux version dependent test cases 

    The error output being checked depends on the linux caps supported
by the particular operating system. Fix these test cases to just
check that an error did occur.
    @shoenig
    shoenig committed May 17, 2021
    Configuration menu
    Copy the full SHA
    17ec5a5 View commit details
    Browse the repository at this point in the history

  6. deps: update go mod tidy 

    Looks like we no longer need a package.
    @shoenig
    shoenig committed May 17, 2021
    Configuration menu
    Copy the full SHA
    683751d View commit details
    Browse the repository at this point in the history

  7. drivers/exec: pass capabilities through executor RPC 

    Add capabilities to the LaunchRequest proto so that the
capabilities set actually gets plumbed all the way through
to task launch.
    @shoenig
    shoenig committed May 17, 2021
    Configuration menu
    Copy the full SHA
    595cef8 View commit details
    Browse the repository at this point in the history

  8. docs: minor wording tweaks + cl

    @shoenig
    shoenig committed May 17, 2021
    Configuration menu
    Copy the full SHA
    845a3d3 View commit details
    Browse the repository at this point in the history