You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@mesos.apache.org by "Alexander Rojas (JIRA)" <ji...@apache.org> on 2018/06/18 20:12:00 UTC
[jira] [Commented] (MESOS-9006) The agent's GET_AGENT leaks
resource information when using authorization
[ https://issues.apache.org/jira/browse/MESOS-9006?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16516296#comment-16516296 ]
Alexander Rojas commented on MESOS-9006:
----------------------------------------
Similar to MESOS-7887
> The agent's GET_AGENT leaks resource information when using authorization
> -------------------------------------------------------------------------
>
> Key: MESOS-9006
> URL: https://issues.apache.org/jira/browse/MESOS-9006
> Project: Mesos
> Issue Type: Bug
> Reporter: Benjamin Bannier
> Priority: Critical
> Labels: agent, security
>
> While the master's {{GET_AGENTS}} call e.g., filters resources (by using an approver with {{VIEW_ROLE}}) so that it does not leak resources the querying principal should not be able to see, no such filtering is done in the corresponding agent's {{GET_AGENT}} call.
> This call should be authorized as well to not expose information we expect to be not visible.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)