> On Feb. 2, 2016, 4:16 p.m., Jie Yu wrote: > > src/slave/containerizer/mesos/containerizer.cpp, lines 1029-1034 > > <https://reviews.apache.org/r/43083/diff/1/?file=1228986#file1228986line1029> > > > > We shouldn't allow executor to cd into an arbitrary directory if > > filesystem isolation is not used (because that'll create security issue). > > > > I would do the following: > > ``` > > if (rootfs.isSome()) { > > launchFlags.directory = workingDir.isSome() > > ? workingDir.get() > > : flags.sandbox_directory; > > } else { > > // NOTE: If the executor shares the host filesystem, we > > // should not allow them to 'cd' into an arbitrary directory > > // because that'll create security issues. > > if (workingDir.isSome()) { > > LOG(WARNING) << "Ignore working directory '" << workingDir.get() > > << "' specified in container launch info for container > > " > > << containerId << " since the executor is using the " > > << "host filesystem"; > > } > > launchFlags.directory = directory; > > } > > ```
Note that this issue is fixed in /mesos/launch.cpp - Gilbert ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/43083/#review117522 ----------------------------------------------------------- On Feb. 3, 2016, 4:49 p.m., Gilbert Song wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/43083/ > ----------------------------------------------------------- > > (Updated Feb. 3, 2016, 4:49 p.m.) > > > Review request for mesos, Artem Harutyunyan, Jie Yu, and Timothy Chen. > > > Bugs: MESOS-4005 > https://issues.apache.org/jira/browse/MESOS-4005 > > > Repository: mesos > > > Description > ------- > > Supported working dir in docker runtime isolator. > > > Diffs > ----- > > src/slave/containerizer/mesos/containerizer.cpp > 4b504dbb58823ce7675f1d2048dcc7a27c05663d > src/slave/containerizer/mesos/isolators/docker/runtime.hpp PRE-CREATION > src/slave/containerizer/mesos/isolators/docker/runtime.cpp PRE-CREATION > > Diff: https://reviews.apache.org/r/43083/diff/ > > > Testing > ------- > > make check (ubuntu14.04 + clang-3.6) > > > Thanks, > > Gilbert Song > >
