[
https://issues.apache.org/jira/browse/HDDS-1712?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16886005#comment-16886005
]
Elek, Marton commented on HDDS-1712:
------------------------------------
For the records: I am totally open the remove sudo, if it's required. But there
were multiple problems with the uploaded patch:
1. The attached patch was NOT tested with the existing cluster definitions
(smoketests + kubernetes clusters). It breaks existing functionality without
fixing the newly introduced problems
2. Smaller problem but it's not clearly defined how the problem can be
reproduced (assuming CVE is fixed in the environment)
> Remove sudo access from Ozone docker image
> ------------------------------------------
>
> Key: HDDS-1712
> URL: https://issues.apache.org/jira/browse/HDDS-1712
> Project: Hadoop Distributed Data Store
> Issue Type: Bug
> Reporter: Eric Yang
> Assignee: Eric Yang
> Priority: Major
> Labels: pull-request-available
> Attachments: HDDS-1712.001.patch
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Ozone docker image is given unlimited sudo access to hadoop user. This poses
> a security risk where host level user uid 1000 can attach a debugger to the
> container process to obtain root access.
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
