[
https://issues.apache.org/jira/browse/MESOS-7476?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16023909#comment-16023909
]
James Peach commented on MESOS-7476:
------------------------------------
| [https://reviews.apache.org/r/59547/|https://reviews.apache.org/r/59547/] |
Rename ContainerLaunchInfo `capabilities` field.|
| [https://reviews.apache.org/r/59548/|https://reviews.apache.org/r/59548/] |
Add a `bounding_capabilities` field to ContainerLaunchInfo.|
| [https://reviews.apache.org/r/59549/|https://reviews.apache.org/r/59549/] |
Add the agent --bounding_capabilities flag.|
| [https://reviews.apache.org/r/59550/|https://reviews.apache.org/r/59550/]
|Check bounding capabilities at isolator creation time |
| [https://reviews.apache.org/r/59551/|https://reviews.apache.org/r/59551/]
|Change launcher working directory before dropping privilege. |
| [https://reviews.apache.org/r/59552/|https://reviews.apache.org/r/59552/] |
Add support for explicitly setting bounding capabilities. |
> Restrict capabilities to only the bounding set.
> -----------------------------------------------
>
> Key: MESOS-7476
> URL: https://issues.apache.org/jira/browse/MESOS-7476
> Project: Mesos
> Issue Type: Bug
> Components: containerization
> Reporter: James Peach
> Assignee: James Peach
>
> As a security improvement, it would be useful to be able to set the bounding
> capability set without also granting those capabilities. This is what the
> {{--allowed_capabilities}} flag sounds like it does.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
