You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by me...@apache.org on 2016/05/27 09:28:56 UTC
[2/2] mesos git commit: Enabled authorization for sandboxes.
Enabled authorization for sandboxes.
Enables authorization of the sandboxes using the callback function
parameter of `Files::attach()`.
It also adds relevant ACLs and support on the authorizer interface.
Review: https://reviews.apache.org/r/47795/
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/bcdc1d15
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/bcdc1d15
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/bcdc1d15
Branch: refs/heads/master
Commit: bcdc1d151a0423593ea39411519165a1b6e900ff
Parents: 62150e4
Author: Alexander Rojas <al...@mesosphere.io>
Authored: Fri May 27 01:00:09 2016 -0700
Committer: Adam B <ad...@mesosphere.io>
Committed: Fri May 27 01:03:32 2016 -0700
----------------------------------------------------------------------
include/mesos/authorizer/acls.proto | 12 +++++
include/mesos/authorizer/authorizer.proto | 4 ++
src/authorizer/local/authorizer.cpp | 31 +++++++++++++
src/slave/slave.cpp | 63 ++++++++++++++++++++++++--
src/slave/slave.hpp | 5 ++
5 files changed, 112 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/bcdc1d15/include/mesos/authorizer/acls.proto
----------------------------------------------------------------------
diff --git a/include/mesos/authorizer/acls.proto b/include/mesos/authorizer/acls.proto
index 85e01b8..b05586a 100644
--- a/include/mesos/authorizer/acls.proto
+++ b/include/mesos/authorizer/acls.proto
@@ -212,6 +212,17 @@ message ACL {
// executors can be viewed.
optional Entity users = 2;
}
+
+ // Which principals are authorized to access the sandboxes of executors
+ // running as the given users.
+ message AccessSandbox {
+ // Subjects: HTTP Username.
+ required Entity principals = 1;
+
+ // Objects: The list of operating system users (e.g., linux users) whose
+ // executors/tasks sandboxes can be accessed.
+ optional Entity users = 2;
+ }
}
@@ -259,4 +270,5 @@ message ACLs {
repeated ACL.ViewFramework view_frameworks = 16;
repeated ACL.ViewTask view_tasks = 17;
repeated ACL.ViewExecutor view_executors = 18;
+ repeated ACL.AccessSandbox access_sandboxes = 19;
}
http://git-wip-us.apache.org/repos/asf/mesos/blob/bcdc1d15/include/mesos/authorizer/authorizer.proto
----------------------------------------------------------------------
diff --git a/include/mesos/authorizer/authorizer.proto b/include/mesos/authorizer/authorizer.proto
index 02d1a01..3ff6785 100644
--- a/include/mesos/authorizer/authorizer.proto
+++ b/include/mesos/authorizer/authorizer.proto
@@ -81,6 +81,10 @@ enum Action {
// `VIEW_EXECUTOR` will have an object with `ExecutorInfo` and
// `FrameworkInfo` set.
VIEW_EXECUTOR = 16;
+
+ // This action will have a `FrameworkInfo` and `ExecutorInfo` set,
+ // allowing both as objects in order to perform authorization.
+ ACCESS_SANDBOX = 17;
}
http://git-wip-us.apache.org/repos/asf/mesos/blob/bcdc1d15/src/authorizer/local/authorizer.cpp
----------------------------------------------------------------------
diff --git a/src/authorizer/local/authorizer.cpp b/src/authorizer/local/authorizer.cpp
index df08ac0..7ddb323 100644
--- a/src/authorizer/local/authorizer.cpp
+++ b/src/authorizer/local/authorizer.cpp
@@ -273,6 +273,37 @@ public:
return authorized(request, acls_);
break;
+ case authorization::ACCESS_SANDBOX: {
+ authorization::Request realRequest;
+ realRequest.set_action(authorization::ACCESS_SANDBOX);
+
+ if (request.subject().has_value()) {
+ realRequest.mutable_subject()->set_value(request.subject().value());
+ }
+
+ authorization::Object* object = realRequest.mutable_object();
+
+ if (request.object().has_executor_info() &&
+ request.object().executor_info().has_command() &&
+ request.object().executor_info().command().has_user()) {
+ object->set_value(request.object().executor_info().command().user());
+ } else if (request.object().has_framework_info() &&
+ request.object().framework_info().has_user()) {
+ object->set_value(request.object().framework_info().user());
+ }
+
+ foreach (const ACL::AccessSandbox& acl, acls.access_sandboxes()) {
+ GenericACL acl_;
+ acl_.subjects = acl.principals();
+ acl_.objects = acl.users();
+
+ acls_.push_back(acl_);
+ }
+
+ return authorized(realRequest, acls_);
+ break;
+ }
+
// TODO(joerg84): Add logic for the `VIEW_*` actions.
case authorization::VIEW_FRAMEWORK:
case authorization::VIEW_TASK:
http://git-wip-us.apache.org/repos/asf/mesos/blob/bcdc1d15/src/slave/slave.cpp
----------------------------------------------------------------------
diff --git a/src/slave/slave.cpp b/src/slave/slave.cpp
index 470b5c8..9fcf334 100644
--- a/src/slave/slave.cpp
+++ b/src/slave/slave.cpp
@@ -24,7 +24,6 @@
#include <map>
#include <memory>
#include <set>
-#include <sstream>
#include <string>
#include <vector>
@@ -5376,6 +5375,38 @@ double Slave::_executor_directory_max_allowed_age_secs()
}
+Future<bool> Slave::authorizeSandboxAccess(
+ const Option<std::string>& principal,
+ const FrameworkID& frameworkId,
+ const ExecutorID& executorId)
+{
+ if (authorizer.isNone()) {
+ return true;
+ }
+
+ authorization::Request request;
+ request.set_action(authorization::ACCESS_SANDBOX);
+
+ if (principal.isSome()) {
+ request.mutable_subject()->set_value(principal.get());
+ }
+
+ if (frameworks.contains(frameworkId)) {
+ Framework* framework = frameworks.get(frameworkId).get();
+
+ request.mutable_object()->mutable_framework_info()->CopyFrom(
+ framework->info);
+
+ if (framework->executors.contains(executorId)) {
+ request.mutable_object()->mutable_executor_info()->CopyFrom(
+ framework->executors.get(executorId).get()->info);
+ }
+ }
+
+ return authorizer.get()->authorized(request);
+}
+
+
void Slave::sendExecutorTerminatedStatusUpdate(
const TaskID& taskId,
const Future<containerizer::Termination>& termination,
@@ -5635,7 +5666,20 @@ Executor* Framework::launchExecutor(
<< " with resources " << executorInfo.resources()
<< " in work directory '" << directory << "'";
- slave->files->attach(executor->directory, executor->directory)
+ ExecutorID executorId = executorInfo.executor_id();
+ FrameworkID frameworkId = id();
+
+ auto authorize =
+ [this, executorId, frameworkId](const Option<string>& principal) {
+ return dispatch(
+ slave,
+ &Slave::authorizeSandboxAccess,
+ principal,
+ frameworkId,
+ executorId);
+ };
+
+ slave->files->attach(executor->directory, executor->directory, authorize)
.onAny(defer(slave, &Slave::fileAttached, lambda::_1, executor->directory));
// Tell the containerizer to launch the executor.
@@ -5824,8 +5868,21 @@ void Framework::recoverExecutor(const ExecutorState& state)
executor->recoverTask(taskState);
}
+ ExecutorID executorId = state.id;
+ FrameworkID frameworkId = id();
+
+ auto authorize =
+ [this, executorId, frameworkId](const Option<string>& principal) {
+ return dispatch(
+ slave,
+ &Slave::authorizeSandboxAccess,
+ principal,
+ frameworkId,
+ executorId);
+ };
+
// Expose the executor's files.
- slave->files->attach(executor->directory, executor->directory)
+ slave->files->attach(executor->directory, executor->directory, authorize)
.onAny(defer(slave, &Slave::fileAttached, lambda::_1, executor->directory));
// Add the executor to the framework.
http://git-wip-us.apache.org/repos/asf/mesos/blob/bcdc1d15/src/slave/slave.hpp
----------------------------------------------------------------------
diff --git a/src/slave/slave.hpp b/src/slave/slave.hpp
index 0de6a57..f48e4b6 100644
--- a/src/slave/slave.hpp
+++ b/src/slave/slave.hpp
@@ -419,6 +419,11 @@ private:
// exited.
void _shutdownExecutor(Framework* framework, Executor* executor);
+ Future<bool> authorizeSandboxAccess(
+ const Option<std::string>& principal,
+ const FrameworkID& frameworkId,
+ const ExecutorID& executorId);
+
// Inner class used to namespace HTTP route handlers (see
// slave/http.cpp for implementations).
class Http