Mailing-List: contact issues-help@mesos.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@mesos.apache.org
Date: Fri, 24 Jun 2016 12:06:16 +0000 (UTC)
From: "Adam B (JIRA)" <jira@apache.org>
To: issues@mesos.apache.org
Message-ID: <JIRA.12982661.1466769942000.21448.1466769976097@Atlassian.JIRA>
In-Reply-To: <JIRA.12982661.1466769942000@Atlassian.JIRA>
References: <JIRA.12982661.1466769942000@Atlassian.JIRA> <JIRA.12982661.1466769942147@arcas>
Subject: [jira] [Created] (MESOS-5705) ZK credential is exposed in /flags
 and /state
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 24 Jun 2016 12:06:18 -0000

Adam B created MESOS-5705:
-----------------------------

             Summary: ZK credential is exposed in /flags and /state
                 Key: MESOS-5705
                 URL: https://issues.apache.org/jira/browse/MESOS-5705
             Project: Mesos
          Issue Type: Task
          Components: master, security
            Reporter: Adam B
             Fix For: 1.0.0


Mesos allows zk credentials to be embedded in the zk url, but exposes these credentials in the /flags and /state endpoint. Even though /state is authorized, it only filters out frameworks/tasks, so the top-level flags are shown to any authenticated user.

"zk": "zk://dcos_mesos_master:my_secret_password@127.0.0.1:2181/mesos",

We need to find some way to hide this data, or even add a first-class VIEW_FLAGS acl that applies to any endpoint that exposes flags.


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)