Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Benjamin Bannier]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/
---

(Updated Sept. 10, 2016, 12:47 a.m.)


Review request for mesos, Jay Guo and Jie Yu.


Bugs: MESOS-5275
https://issues.apache.org/jira/browse/MESOS-5275


Repository: mesos


Description
---

This change introduces linux capability based security for unified
containerizer. A new agent flag \`allowed_capabilities\` has been
introduced to override the default capabilities of the user or the
capabilities requested by the user.

This feature is only available on linux.


Diffs
-

  src/slave/containerizer/mesos/launch.hpp 
0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
  src/slave/containerizer/mesos/launch.cpp 
13b65d82e029650e150eb2bc3647d95af167bd72 
  src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
  src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 

Diff: https://reviews.apache.org/r/50270/diff/


Testing
---

`make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o optimizations)


Thanks,

Benjamin Bannier

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Jie Yu]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/#review148390
---



Please follow up with a patch to update configuration.md

- Jie Yu


On Sept. 7, 2016, 4:43 p.m., Benjamin Bannier wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50270/
> ---
> 
> (Updated Sept. 7, 2016, 4:43 p.m.)
> 
> 
> Review request for mesos, Jay Guo and Jie Yu.
> 
> 
> Bugs: MESOS-5303
> https://issues.apache.org/jira/browse/MESOS-5303
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This change introduces linux capability based security for unified
> containerizer. A new agent flag \`allowed_capabilities\` has been
> introduced to override the default capabilities of the user or the
> capabilities requested by the user.
> 
> This feature is only available on linux.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/launch.hpp 
> 0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
>   src/slave/containerizer/mesos/launch.cpp 
> 13b65d82e029650e150eb2bc3647d95af167bd72 
>   src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
>   src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 
> 
> Diff: https://reviews.apache.org/r/50270/diff/
> 
> 
> Testing
> ---
> 
> `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o 
> optimizations)
> 
> 
> Thanks,
> 
> Benjamin Bannier
> 
>

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Jie Yu]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/#review148388
---


Ship it!




Ship It!

- Jie Yu


On Sept. 7, 2016, 4:43 p.m., Benjamin Bannier wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50270/
> ---
> 
> (Updated Sept. 7, 2016, 4:43 p.m.)
> 
> 
> Review request for mesos, Jay Guo and Jie Yu.
> 
> 
> Bugs: MESOS-5303
> https://issues.apache.org/jira/browse/MESOS-5303
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This change introduces linux capability based security for unified
> containerizer. A new agent flag \`allowed_capabilities\` has been
> introduced to override the default capabilities of the user or the
> capabilities requested by the user.
> 
> This feature is only available on linux.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/launch.hpp 
> 0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
>   src/slave/containerizer/mesos/launch.cpp 
> 13b65d82e029650e150eb2bc3647d95af167bd72 
>   src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
>   src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 
> 
> Diff: https://reviews.apache.org/r/50270/diff/
> 
> 
> Testing
> ---
> 
> `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o 
> optimizations)
> 
> 
> Thanks,
> 
> Benjamin Bannier
> 
>

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Jie Yu]

> On Sept. 6, 2016, 6:35 p.m., Jie Yu wrote:
> > src/slave/containerizer/mesos/launch.cpp, line 417
> > 
> >
> > Why this is not guarded by ifdef linux?
> 
> Benjamin Bannier wrote:
> I was trying to minimize code behind `ifdef` guards. While it should not 
> be possible to set the capabilities flag on non-Linux systems the `Flag` 
> member is defined for all platforms as it has no dependencies on 
> Linux-specific features.

this won't compile on non linux machines, right? Since `flags.capabilities` is 
only defined on Linux build.


- Jie


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/#review147872
---


On Sept. 7, 2016, 4:43 p.m., Benjamin Bannier wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50270/
> ---
> 
> (Updated Sept. 7, 2016, 4:43 p.m.)
> 
> 
> Review request for mesos, Jay Guo and Jie Yu.
> 
> 
> Bugs: MESOS-5303
> https://issues.apache.org/jira/browse/MESOS-5303
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This change introduces linux capability based security for unified
> containerizer. A new agent flag \`allowed_capabilities\` has been
> introduced to override the default capabilities of the user or the
> capabilities requested by the user.
> 
> This feature is only available on linux.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/launch.hpp 
> 0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
>   src/slave/containerizer/mesos/launch.cpp 
> 13b65d82e029650e150eb2bc3647d95af167bd72 
>   src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
>   src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 
> 
> Diff: https://reviews.apache.org/r/50270/diff/
> 
> 
> Testing
> ---
> 
> `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o 
> optimizations)
> 
> 
> Thanks,
> 
> Benjamin Bannier
> 
>

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Benjamin Bannier]

> On Sept. 8, 2016, 5:01 a.m., Jie Yu wrote:
> > Any comment on unresolved issues?

Sorry, published comments now.


- Benjamin


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/#review148133
---


On Sept. 7, 2016, 6:43 p.m., Benjamin Bannier wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50270/
> ---
> 
> (Updated Sept. 7, 2016, 6:43 p.m.)
> 
> 
> Review request for mesos, Jay Guo and Jie Yu.
> 
> 
> Bugs: MESOS-5303
> https://issues.apache.org/jira/browse/MESOS-5303
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This change introduces linux capability based security for unified
> containerizer. A new agent flag \`allowed_capabilities\` has been
> introduced to override the default capabilities of the user or the
> capabilities requested by the user.
> 
> This feature is only available on linux.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/launch.hpp 
> 0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
>   src/slave/containerizer/mesos/launch.cpp 
> 13b65d82e029650e150eb2bc3647d95af167bd72 
>   src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
>   src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 
> 
> Diff: https://reviews.apache.org/r/50270/diff/
> 
> 
> Testing
> ---
> 
> `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o 
> optimizations)
> 
> 
> Thanks,
> 
> Benjamin Bannier
> 
>

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Benjamin Bannier]

> On Sept. 6, 2016, 8:35 nachm., Jie Yu wrote:
> > src/slave/containerizer/mesos/launch.cpp, line 378
> > 
> >
> > I am wondering if we should rename this to:
> > ```
> > capabilities->setKeepCaps()
> > capabilities->clearKeepCaps()
> > ```

Done, also submitted https://reviews.apache.org/r/51697/. Could you commit that 
as part of this chain? I did not add a `Capabilities::clearKeepCaps` as we 
currently have no use for it. I am also not sure how useful clearing keep caps 
again might be midterm as we'd likely never execute `setKeepCaps` in anything 
not already executing in a separate process we could just let die (like we do 
here).


> On Sept. 6, 2016, 8:35 nachm., Jie Yu wrote:
> > src/slave/containerizer/mesos/launch.cpp, lines 382-383
> > 
> >
> > `uid` might be None, right?

I reworded the log output slightly to not require some `uid` anymore.


> On Sept. 6, 2016, 8:35 nachm., Jie Yu wrote:
> > src/slave/containerizer/mesos/launch.cpp, line 417
> > 
> >
> > Why this is not guarded by ifdef linux?

I was trying to minimize code behind `ifdef` guards. While it should not be 
possible to set the capabilities flag on non-Linux systems the `Flag` member is 
defined for all platforms as it has no dependencies on Linux-specific features.


> On Sept. 6, 2016, 8:35 nachm., Jie Yu wrote:
> > src/slave/flags.cpp, line 466
> > 
> >
> > What's this? I thought we use PR_SET_KEEPCAPS and agent is running 
> > under root.

I think there's actually no need to make a hard requirement on the agent to be 
run as root (at least to make use of capabilities) -- we do only require 
`SETPCAP` and that the capabilities requested for a container are contained in 
the agent's capabilities. I believe it makes sense to anticipate that users of 
this capabilities feature are aware of fine-grained permissions.

I added an additional note to the help text to make clear that `SETPCAP` is 
required for the agent.


> On Sept. 6, 2016, 8:35 nachm., Jie Yu wrote:
> > src/slave/flags.cpp, line 94
> > 
> >
> > This list is not complete. I'd suggest we don't make this change in 
> > this patch. It should point to  a document online with a complete list. 
> > Let's create a ticket to track.

I filed https://issues.apache.org/jira/browse/MESOS-6133.


- Benjamin


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/#review147872
---


On Sept. 7, 2016, 6:43 nachm., Benjamin Bannier wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50270/
> ---
> 
> (Updated Sept. 7, 2016, 6:43 nachm.)
> 
> 
> Review request for mesos, Jay Guo and Jie Yu.
> 
> 
> Bugs: MESOS-5303
> https://issues.apache.org/jira/browse/MESOS-5303
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This change introduces linux capability based security for unified
> containerizer. A new agent flag \`allowed_capabilities\` has been
> introduced to override the default capabilities of the user or the
> capabilities requested by the user.
> 
> This feature is only available on linux.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/launch.hpp 
> 0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
>   src/slave/containerizer/mesos/launch.cpp 
> 13b65d82e029650e150eb2bc3647d95af167bd72 
>   src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
>   src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 
> 
> Diff: https://reviews.apache.org/r/50270/diff/
> 
> 
> Testing
> ---
> 
> `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o 
> optimizations)
> 
> 
> Thanks,
> 
> Benjamin Bannier
> 
>

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Jie Yu]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/#review148133
---



Any comment on unresolved issues?

- Jie Yu


On Sept. 7, 2016, 4:43 p.m., Benjamin Bannier wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50270/
> ---
> 
> (Updated Sept. 7, 2016, 4:43 p.m.)
> 
> 
> Review request for mesos, Jay Guo and Jie Yu.
> 
> 
> Bugs: MESOS-5303
> https://issues.apache.org/jira/browse/MESOS-5303
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This change introduces linux capability based security for unified
> containerizer. A new agent flag \`allowed_capabilities\` has been
> introduced to override the default capabilities of the user or the
> capabilities requested by the user.
> 
> This feature is only available on linux.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/launch.hpp 
> 0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
>   src/slave/containerizer/mesos/launch.cpp 
> 13b65d82e029650e150eb2bc3647d95af167bd72 
>   src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
>   src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 
> 
> Diff: https://reviews.apache.org/r/50270/diff/
> 
> 
> Testing
> ---
> 
> `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o 
> optimizations)
> 
> 
> Thanks,
> 
> Benjamin Bannier
> 
>

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Benjamin Bannier]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/
---

(Updated Sept. 7, 2016, 6:43 p.m.)


Review request for mesos, Jay Guo and Jie Yu.


Changes
---

Address jieyu's review comments.


Bugs: MESOS-5303
https://issues.apache.org/jira/browse/MESOS-5303


Repository: mesos


Description (updated)
---

This change introduces linux capability based security for unified
containerizer. A new agent flag \`allowed_capabilities\` has been
introduced to override the default capabilities of the user or the
capabilities requested by the user.

This feature is only available on linux.


Diffs (updated)
-

  src/slave/containerizer/mesos/launch.hpp 
0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
  src/slave/containerizer/mesos/launch.cpp 
13b65d82e029650e150eb2bc3647d95af167bd72 
  src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
  src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 

Diff: https://reviews.apache.org/r/50270/diff/


Testing
---

`make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o optimizations)


Thanks,

Benjamin Bannier

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Jie Yu]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/#review147872
---




src/slave/containerizer/mesos/launch.cpp (line 366)


to avoid confusion, I'd s/capabilities/capabilitiesManager/

Also, Error("Not initialized")



src/slave/containerizer/mesos/launch.cpp (line 370)


kill this line



src/slave/containerizer/mesos/launch.cpp (line 372)


s/instantiate/initialize/

TO avoid jaggedness, i'd:
```
cerr << "Failed to initialize capabilities: "
 << capabilitiesManager.error() << endl;
```



src/slave/containerizer/mesos/launch.cpp (line 373)


return EXIT_FAILURE?



src/slave/containerizer/mesos/launch.cpp (line 378)


I am wondering if we should rename this to:
```
capabilities->setKeepCaps()
capabilities->clearKeepCaps()
```



src/slave/containerizer/mesos/launch.cpp (line 379)


kill this line



src/slave/containerizer/mesos/launch.cpp (lines 382 - 383)


`uid` might be None, right?



src/slave/containerizer/mesos/launch.cpp (line 383)


return EXIT_FAILURE?



src/slave/containerizer/mesos/launch.cpp (line 417)


Why this is not guarded by ifdef linux?



src/slave/containerizer/mesos/launch.cpp (lines 422 - 423)


Ditto on formatting.



src/slave/containerizer/mesos/launch.cpp (line 428)


s/processCapabilities/capabilities/



src/slave/flags.cpp (line 94)


This list is not complete. I'd suggest we don't make this change in this 
patch. It should point to  a document online with a complete list. Let's create 
a ticket to track.



src/slave/flags.cpp (line 458)


s/agent/operator/



src/slave/flags.cpp (line 460)


s/unifed//

We might want to support that for Docker containerizer in the future. You 
can add `(Currently only supported in MesosContainerizer)`



src/slave/flags.cpp (line 466)


What's this? I thought we use PR_SET_KEEPCAPS and agent is running under 
root.


- Jie Yu


On Sept. 6, 2016, 3:04 p.m., Benjamin Bannier wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50270/
> ---
> 
> (Updated Sept. 6, 2016, 3:04 p.m.)
> 
> 
> Review request for mesos, Jay Guo and Jie Yu.
> 
> 
> Bugs: MESOS-5303
> https://issues.apache.org/jira/browse/MESOS-5303
> 
> 
> Repository: mesos
> 
> 
> Description
> ---
> 
> This change introduces linux capability based security for unified
> containerizer. A new agent flag `allowed_capabilities` has been
> introduced to override the default capabilities of the user or the
> capabilities requested by the user.
> 
> This feature is only available on Linux.
> 
> 
> Diffs
> -
> 
>   src/slave/containerizer/mesos/launch.hpp 
> 0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
>   src/slave/containerizer/mesos/launch.cpp 
> 13b65d82e029650e150eb2bc3647d95af167bd72 
>   src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
>   src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 
> 
> Diff: https://reviews.apache.org/r/50270/diff/
> 
> 
> Testing
> ---
> 
> `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o 
> optimizations)
> 
> 
> Thanks,
> 
> Benjamin Bannier
> 
>

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Benjamin Bannier]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/
---

(Updated Sept. 6, 2016, 5:04 p.m.)


Review request for mesos, Jay Guo and Jie Yu.


Changes
---

Moved setting of caps from executor into launch.


Bugs: MESOS-5303
https://issues.apache.org/jira/browse/MESOS-5303


Repository: mesos


Description (updated)
---

This change introduces linux capability based security for unified
containerizer. A new agent flag `allowed_capabilities` has been
introduced to override the default capabilities of the user or the
capabilities requested by the user.

This feature is only available on Linux.


Diffs (updated)
-

  src/slave/containerizer/mesos/launch.hpp 
0e86da9c7bd9c7fbedd7102d66b902d1c10e5e0b 
  src/slave/containerizer/mesos/launch.cpp 
13b65d82e029650e150eb2bc3647d95af167bd72 
  src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
  src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 

Diff: https://reviews.apache.org/r/50270/diff/


Testing
---

`make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o optimizations)


Thanks,

Benjamin Bannier

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Benjamin Bannier]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/
---

(Updated Aug. 25, 2016, 5:18 p.m.)


Review request for mesos and Jie Yu.


Changes
---

Rebased.


Bugs: MESOS-5303
https://issues.apache.org/jira/browse/MESOS-5303


Repository: mesos


Description
---

This change introduces linux capability based security for unified
containerizer. A new agent flag \`allowed_capabilities\` has been
introduced to override the default capabilities of the user or the
capabilities requested by the user.

This feature is only available on linux.

This patch is based on https://reviews.apache.org/r/46798/.


Diffs (updated)
-

  src/launcher/executor.cpp 71ede1ea4f4e97fe94bd2bd136f17f231cedbce6 
  src/slave/flags.hpp 1a006663e7cc58ee548b3dda686cfbac0c240baa 
  src/slave/flags.cpp 0f2be1700f41b74da4ea1ce699a81ec33cf92a9a 

Diff: https://reviews.apache.org/r/50270/diff/


Testing
---

`make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o optimizations)


Thanks,

Benjamin Bannier

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Benjamin Bannier]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/
---

(Updated Aug. 15, 2016, 5:57 p.m.)


Review request for mesos and Jie Yu.


Changes
---

Cleanup.


Bugs: MESOS-5303
https://issues.apache.org/jira/browse/MESOS-5303


Repository: mesos


Description
---

This change introduces linux capability based security for unified
containerizer. A new agent flag \`allowed_capabilities\` has been
introduced to override the default capabilities of the user or the
capabilities requested by the user.

This feature is only available on linux.

This patch is based on https://reviews.apache.org/r/46798/.


Diffs (updated)
-

  src/launcher/executor.cpp 2d04edbd58f881f59fca00b95803474724a49154 
  src/slave/flags.hpp ef2394cae5cb72ae627aaef443ac06a50bcfb16f 
  src/slave/flags.cpp c07d6e5e062b75c9dd867e3dced9e2cc8b69872d 

Diff: https://reviews.apache.org/r/50270/diff/


Testing
---

`make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o optimizations)


Thanks,

Benjamin Bannier

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Benjamin Bannier]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/
---

(Updated Aug. 11, 2016, 2:48 p.m.)


Review request for mesos and Jie Yu.


Changes
---

Rebased onto recent master.


Bugs: MESOS-5303
https://issues.apache.org/jira/browse/MESOS-5303


Repository: mesos


Description
---

This change introduces linux capability based security for unified
containerizer. A new agent flag \`allowed_capabilities\` has been
introduced to override the default capabilities of the user or the
capabilities requested by the user.

This feature is only available on linux.

This patch is based on https://reviews.apache.org/r/46798/.


Diffs (updated)
-

  src/common/parse.hpp 5dc795d7f54209abe64ad48360f538faac7616f0 
  src/launcher/executor.cpp 7967684e42c97326770bd83a41c2d4b1338a511f 
  src/slave/flags.hpp ef2394cae5cb72ae627aaef443ac06a50bcfb16f 
  src/slave/flags.cpp c07d6e5e062b75c9dd867e3dced9e2cc8b69872d 

Diff: https://reviews.apache.org/r/50270/diff/


Testing
---

`make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o optimizations)


Thanks,

Benjamin Bannier

Re: Review Request 50270: Introduced linux capabilities support for mesos containerizer.

[Benjamin Bannier]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50270/
---

(Updated Aug. 10, 2016, 7:03 p.m.)


Review request for mesos and Jie Yu.


Changes
---

Rebased.


Bugs: MESOS-5303
https://issues.apache.org/jira/browse/MESOS-5303


Repository: mesos


Description
---

This change introduces linux capability based security for unified
containerizer. A new agent flag \`allowed_capabilities\` has been
introduced to override the default capabilities of the user or the
capabilities requested by the user.

This feature is only available on linux.

This patch is based on https://reviews.apache.org/r/46798/.


Diffs (updated)
-

  src/common/parse.hpp 5dc795d7f54209abe64ad48360f538faac7616f0 
  src/internal/devolve.hpp 3812fd654d6cdceccf31b3f7c1a067cf2922e06f 
  src/internal/devolve.cpp a2ad4641fcadef4003e487683fc0a73aeece7647 
  src/internal/evolve.hpp 1e2d49b6a465c13dd055e54f0d4c49d22afc15c6 
  src/internal/evolve.cpp 64818ccbbc4d0fcf6744e3f9a30c17c5332a 
  src/launcher/executor.cpp 9333dc0832cd04305e307ce750195c0fbc860ab2 
  src/slave/flags.hpp 58fba4a22d988ac6612fc3af8a9346f0b8f8bb51 
  src/slave/flags.cpp b8ecc98721c52dcd59a0cc1333421d4f024fbe96 

Diff: https://reviews.apache.org/r/50270/diff/


Testing
---

`make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o optimizations)


Thanks,

Benjamin Bannier