-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50271/#review148162
-----------------------------------------------------------
Could list test steps to verify functionalities? I tried following steps:
// start master
$ mesos-master --ip=<master-ip> --work_dir=<work_dir>
// start agent
$ sudo mesos-agent --master=<master-ip>:<master-port>
--work_dir=<agent-work-dir> --isolation=linux/capabilities
--allowed_capabilities='{"capabilities":["CHOWN"]}'
// mesos-execute
$ mesos-execute --master=<master-ip>:<master-port> --name="test"
--command="touch foo && chown nobody foo"
I'm expecting that I could `chown` with `CAP_CHOWN` however I got `operation
not permitted`. I could be misunderstanding this completely, please advise
src/slave/containerizer/mesos/isolators/linux/capabilities.cpp (line 62)
<https://reviews.apache.org/r/50271/#comment215607>
We need a check here in case that `flags.allowed_capabilities` is not set,
otherwise it would fail assertion in `get()` and exit.
src/tests/containerizer/isolator_tests.cpp (line 1802)
<https://reviews.apache.org/r/50271/#comment215608>
I think we need more comprehensive tests for all the cases listed in the
matrix in design doc. For instance, a test case for forbidden operations.
- Jay Guo
On Sept. 7, 2016, 4:46 p.m., Benjamin Bannier wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50271/
> -----------------------------------------------------------
>
> (Updated Sept. 7, 2016, 4:46 p.m.)
>
>
> Review request for mesos, Jay Guo and Jie Yu.
>
>
> Bugs: MESOS-5275
> https://issues.apache.org/jira/browse/MESOS-5275
>
>
> Repository: mesos
>
>
> Description
> -------
>
> This isolator evaluates agent allowed capabilities and passes net
> capabilities on to `mesos-containerizer` which enforces the
> capabilities.
>
> Capability information is passed via a new field in
> `ContainerLaunchInfo`.
>
>
> Diffs
> -----
>
> include/mesos/slave/containerizer.proto
> 16dd3a19145b9764273cdb9a8899e353c98730e5
> src/CMakeLists.txt 01ef494f7120156de3b826d7def76fb30bcc61b5
> src/Makefile.am 15b9a63822eca8d0b428191940026756fba7821e
> src/slave/containerizer/mesos/containerizer.cpp
> 89b7e8db38916d69d9b2d4fe305d4397b0859a10
> src/slave/containerizer/mesos/isolators/linux/capabilities.hpp PRE-CREATION
> src/slave/containerizer/mesos/isolators/linux/capabilities.cpp PRE-CREATION
> src/tests/containerizer/isolator_tests.cpp
> f8056ca08029feed5f164d4f94e24d521183bdfc
>
> Diff: https://reviews.apache.org/r/50271/diff/
>
>
> Testing
> -------
>
> `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o
> optimizations)
>
>
> Thanks,
>
> Benjamin Bannier
>
>
