[
https://issues.apache.org/jira/browse/MESOS-5388?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15394547#comment-15394547
]
Jie Yu commented on MESOS-5388:
-------------------------------
commit 5299df79c85dcc4205b014a8bd360bc8a4cdf8e7
Author: Gilbert Song <[email protected]>
Date: Tue Jul 26 14:11:20 2016 -0700
Updated pre exec commands as non-shell in docker volume isolator.
By adding apostrophes to mount 'source' and 'target', arbitraty commands
defined by users postfixed to 'container_path' will take no effect.
'mount' command will return an error for invalid mount 'target'.
Review: https://reviews.apache.org/r/50215/
> MesosContainerizerLaunch flags execute arbitrary commands via shell
> -------------------------------------------------------------------
>
> Key: MESOS-5388
> URL: https://issues.apache.org/jira/browse/MESOS-5388
> Project: Mesos
> Issue Type: Bug
> Components: containerization
> Reporter: James DeFelice
> Assignee: Gilbert Song
> Labels: mesosphere, security
> Fix For: 1.0.0, 1.1.0
>
>
> For example, the docker volume isolator's containerPath is appended (without
> sanitation) to a command that's executed in this manner. As such, it's
> possible to inject arbitrary shell commands to be executed by mesos.
> https://github.com/apache/mesos/blob/17260204c833c643adf3d8f36ad8a1a606ece809/src/slave/containerizer/mesos/launch.cpp#L206
> Perhaps instead of strings these commands could/should be sent as string
> arrays that could be passed as argv arguments w/o shell interpretation?
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
