[jira] [Commented] (MESOS-5388) MesosContainerizerLaunch flags execute arbitrary commands via shell.

["Gilbert Song (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MESOS-5388?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15405039#comment-15405039 ] 

Gilbert Song commented on MESOS-5388:
-------------------------------------

commit 9c77899431f8e414f5965a424888a889f6327135
Author: Gilbert Song <so...@gmail.com>
Date:   Tue Aug 2 15:21:38 2016 -0700

    Removed unused user variable in filesystem linux isolator prepare.
    
    Review: https://reviews.apache.org/r/50580/

commit 9579a298d1b3e38d9e70261ebe2c893893282d72
Author: Gilbert Song <so...@gmail.com>
Date:   Tue Aug 2 15:46:31 2016 -0700

    Added logs for pre-exec commands to sandbox in MesosContainerizerLaunch.
    
    Review: https://reviews.apache.org/r/50581/

> MesosContainerizerLaunch flags execute arbitrary commands via shell.
> --------------------------------------------------------------------
>
>                 Key: MESOS-5388
>                 URL: https://issues.apache.org/jira/browse/MESOS-5388
>             Project: Mesos
>          Issue Type: Bug
>          Components: containerization
>            Reporter: James DeFelice
>            Assignee: Gilbert Song
>              Labels: mesosphere, security
>
> For example, the docker volume isolator's containerPath is appended (without sanitation) to a command that's executed in this manner. As such, it's possible to inject arbitrary shell commands to be executed by mesos.
> https://github.com/apache/mesos/blob/17260204c833c643adf3d8f36ad8a1a606ece809/src/slave/containerizer/mesos/launch.cpp#L206
> Perhaps instead of strings these commands could/should be sent as string arrays that could be passed as argv arguments w/o shell interpretation?



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)