mesos-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Benjamin Bannier <benjamin.bann...@mesosphere.io>
Subject Re: Review Request 50271: Created an isolator for Linux capabilities.
Date Thu, 08 Sep 2016 16:04:47 GMT


> On Sept. 8, 2016, 11:12 a.m., Jay Guo wrote:
> > Could list test steps to verify functionalities? I tried following steps:
> > // start master
> > $ mesos-master --ip=<master-ip> --work_dir=<work_dir>
> > // start agent
> > $ sudo mesos-agent --master=<master-ip>:<master-port> --work_dir=<agent-work-dir>
--isolation=linux/capabilities --allowed_capabilities='{"capabilities":["CHOWN"]}'
> > // mesos-execute
> > $ mesos-execute --master=<master-ip>:<master-port> --name="test" --command="touch
foo && chown nobody foo"
> > 
> > I'm expecting that I could `chown` with `CAP_CHOWN` however I got `operation not
permitted`. I could be misunderstanding this completely, please advise

Your confusion comes from the fact that you assume this patch would allow to assign any capabilities
to a container. The command you gave would also not work under plain Linux had you given an
unpreviledged user `CAP_CHOWN` since `chown` neither makes direct use of capabilities by itself
(it does not link against `libcap*`), nor has file capabilities. There is nothing in the current
patch which would allow it to suddenly gain capability features. To achieve the effect you
expected you ccould e.g., add `cap_chown` to `chown`'s file-based capabilities,

    $ sudo /sbin/setcap cap_chown+ep `which chown`
    
With this addition and above agent invocation the task would succeed, while if you had specified
an emtpy capability set (`--allowed_capabilities='{}'`) it would have failed, just like one
would expect.


> On Sept. 8, 2016, 11:12 a.m., Jay Guo wrote:
> > src/tests/containerizer/isolator_tests.cpp, line 1802
> > <https://reviews.apache.org/r/50271/diff/7/?file=1493023#file1493023line1802>
> >
> >     I think we need more comprehensive tests for all the cases listed in the matrix
in design doc. For instance, a test case for forbidden operations.

Agreed, I'll add a parameterized test capturing that matrix.


- Benjamin


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/50271/#review148162
-----------------------------------------------------------


On Sept. 8, 2016, 6:04 p.m., Benjamin Bannier wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/50271/
> -----------------------------------------------------------
> 
> (Updated Sept. 8, 2016, 6:04 p.m.)
> 
> 
> Review request for mesos, Jay Guo and Jie Yu.
> 
> 
> Bugs: MESOS-5275
>     https://issues.apache.org/jira/browse/MESOS-5275
> 
> 
> Repository: mesos
> 
> 
> Description
> -------
> 
> This isolator evaluates agent allowed capabilities and passes net
> capabilities on to `mesos-containerizer` which enforces the
> capabilities.
> 
> Capability information is passed via a new field in
> `ContainerLaunchInfo`.
> 
> 
> Diffs
> -----
> 
>   include/mesos/slave/containerizer.proto 16dd3a19145b9764273cdb9a8899e353c98730e5 
>   src/CMakeLists.txt 01ef494f7120156de3b826d7def76fb30bcc61b5 
>   src/Makefile.am 15b9a63822eca8d0b428191940026756fba7821e 
>   src/slave/containerizer/mesos/containerizer.cpp 89b7e8db38916d69d9b2d4fe305d4397b0859a10

>   src/slave/containerizer/mesos/isolators/linux/capabilities.hpp PRE-CREATION 
>   src/slave/containerizer/mesos/isolators/linux/capabilities.cpp PRE-CREATION 
>   src/tests/containerizer/isolator_tests.cpp f8056ca08029feed5f164d4f94e24d521183bdfc

> 
> Diff: https://reviews.apache.org/r/50271/diff/
> 
> 
> Testing
> -------
> 
> `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o optimizations)
> 
> 
> Thanks,
> 
> Benjamin Bannier
> 
>


Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message