[
https://issues.apache.org/jira/browse/MESOS-6953?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15855046#comment-15855046
]
Anindya Sinha commented on MESOS-6953:
--------------------------------------
For the immediate issue at hand, the proposal is to configure {{acls}} to add a
new acl type for the agent (currently, this acl type is only supported on the
master), viz. {{run_tasks}} to denote users allowed to run tasks on the agent.
Note that as far as deployment goes, the {{run_tasks}} acl should be present in
every agent in the cluster and should match with the {{run_tasks}} acl
configured on the master.
In {{acls}}, a global flag {{permissive}} defines the following:
It defines the behavior when no ACL applies to the request made. If set to true
(which is the default) it will allow by default all non-matching requests, if
set to false it will reject all non-matching requests.
If no {{run_tasks}} acl is specified when {{permissive}} is {{true}} (default),
all users shall be allowed to launch tasks. However, if {{permissive}} is
{{false}} and no {{run_tasks}} acl is configured, it would imply no user would
be able to launch tasks which is due to the very definition of the global
{{permissive}} flag, and operators would need to configure the {{run_tasks}}
acl before upgrading (if {{permissive}} is {{false}}).
One way to enhance this condition to have the notion of {{permissive}} for each
acl type (instead of a global {{permissive}}). Opened
https://issues.apache.org/jira/browse/MESOS-7066 for that issue.
> A compromised mesos-master node can execute code as root on agents.
> -------------------------------------------------------------------
>
> Key: MESOS-6953
> URL: https://issues.apache.org/jira/browse/MESOS-6953
> Project: Mesos
> Issue Type: Bug
> Components: security
> Reporter: Anindya Sinha
> Assignee: Anindya Sinha
> Labels: security, slave
>
> mesos-master has a `--[no-]root_submissions` flag that controls whether
> frameworks with `root` user are admitted to the cluster.
> However, if a mesos-master node is compromised, it can attempt to schedule
> tasks on agent as the `root` user. Since mesos-agent has no check against
> tasks running on the agent for specific users, tasks can get run with `root`
> privileges can get run within the container on the agent.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
