mesos-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From James Peach <>
Subject Re: Review Request 59552: Add support for explicitly setting bounding capabilities.
Date Fri, 16 Jun 2017 04:39:13 GMT

This is an automatically generated e-mail. To reply, visit:

(Updated June 16, 2017, 4:39 a.m.)

Review request for mesos, Jie Yu and Jiang Yan Xu.


Rebased and addressed review feedback.

Bugs: MESOS-7476

Repository: mesos

Description (updated)

The linux/capabilities isolator implements the `--allowed_capabilities`
option by granting all the allowed capabilities. This change explicitly
populates the only the bounding capabilities in the case where
`--bounding_capabilities` has been set but the task itself has not been
granted any effective capabilities. This improves the security of tasks
since it is now possible to configure the bounding set without actually
granting privilege to the task.

Removed 2 capabilities isolator test cases. These test cases depended on
the framework-specified effective capabilities also setting the bounding
set. Now that the operator flag always determines the bounding set,
these test cases are no longer valid.

Diffs (updated)

  src/slave/containerizer/mesos/isolators/linux/capabilities.cpp 60d22aa877c1ab62a08222e5efe8800e337684da

  src/slave/containerizer/mesos/launch.cpp f48d294a0a832dfe248c4a83849ee5a63cb76bce 
  src/tests/containerizer/linux_capabilities_isolator_tests.cpp 40376a03fdb8f931f8d3f83b1c3fa6207e02c1d1




make check (Fedora 25)


James Peach

  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message