Re: narrowing task sandbox permissions

2018-06-15 Thread James Peach
> On Jun 15, 2018, at 11:06 AM, Zhitao Li wrote: > > Sorry for getting back to this really late, but we got bit by this behavior > change in our environment. > > The broken scenario we had: > > 1. We are using Aurora to launch docker containerizer based tasks on > Mesos; > 2. Most of

Re: narrowing task sandbox permissions

2018-06-15 Thread Zhitao Li
Adding James directly. On Fri, Jun 15, 2018 at 11:06 AM Zhitao Li wrote: > Sorry for getting back to this really late, but we got bit by this > behavior change in our environment. > > The broken scenario we had: > >1. We are using Aurora to launch docker containerizer based tasks on >

Re: narrowing task sandbox permissions

2018-06-15 Thread Zhitao Li
Sorry for getting back to this really late, but we got bit by this behavior change in our environment. The broken scenario we had: 1. We are using Aurora to launch docker containerizer based tasks on Mesos; 2. Most of our docker containers had some legacy behavior: *the execution

narrowing task sandbox permissions

2017-12-14 Thread James Peach
Hi all, In https://issues.apache.org/jira/browse/MESOS-8332, I'm proposing a change to narrow the permissions used for the task sandbox directory from 0755 to 0750. Note that this change also makes failure to chown this directory into a hard failure. I expect this is a safe change for