> On July 19, 2016, 8:58 p.m., Gilbert Song wrote: > > src/launcher/fetcher.cpp, lines 519-525 > > <https://reviews.apache.org/r/50200/diff/1/?file=1447504#file1447504line519> > > > > An open discussion: > > > > After looking at os::chown(), we should not only change the file owner, > > but also the groups. So only get and set the uid looks insufficient to me. > > We should consider to do the same to the gid and the supplimentary groups > > (please look at /mesos/launch.cpp for examples).
Good call - I've changed the patch to use `os::su()` instead. - Greg ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/50200/#review142833 ----------------------------------------------------------- On July 19, 2016, 11:10 p.m., Greg Mann wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/50200/ > ----------------------------------------------------------- > > (Updated July 19, 2016, 11:10 p.m.) > > > Review request for mesos, Gilbert Song, Jie Yu, and Joerg Schad. > > > Bugs: mesos-5845 > https://issues.apache.org/jira/browse/mesos-5845 > > > Repository: mesos > > > Description > ------- > > To ensure that a task cannot fetch root-protected > files from the local filesystem when running as a > non-root user, this patch changes the fetcher to > fetch files as the task user. > > > Diffs > ----- > > src/launcher/fetcher.cpp 0539b0182bd4a7178f103dddd1ab4fee8fc79eda > src/tests/fetcher_tests.cpp d38ce6e750dc828ef5af4a27fac76327cc4cb56c > > Diff: https://reviews.apache.org/r/50200/diff/ > > > Testing > ------- > > A new test was added to the fetcher tests: > `FetcherTest.ROOT_RootProtectedFileURI`. > > `sudo make check` was used to test on both OSX and CentOS 7. > > Note that two of the fetcher tests fail for me when run as root on OSX. I saw > the following on my OSX 10.10.5 system: > ``` > [ FAILED ] FetcherCacheTest.LocalUncachedExtract > [ FAILED ] FetcherCacheHttpTest.HttpMixed > ``` > > These failures are already tracked here: > https://issues.apache.org/jira/browse/MESOS-4890 > > > Thanks, > > Greg Mann > >
