[jira] [Commented] (MESOS-5388) MesosContainerizerLaunch flags execute arbitrary commands via shell

["Jie Yu (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MESOS-5388?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15402575#comment-15402575 ] 

Jie Yu commented on MESOS-5388:
-------------------------------

commit 25626fcf8f63875ed0ccfe2ddb67a9998e5ba934
Author: Gilbert Song <so...@gmail.com>
Date:   Mon Aug 1 09:50:13 2016 -0700

    Supported non-shell command in MesosLaunch to avoid arbitrary commands.
    
    Currently all pre_exec_commands are executed as shell commands in Mesos
    Launch. It is not safe because arbitrary shell command may be included
    in some user facing api (e.g., container_path).  We should execute those
    command as a subprocess to prevent arbitrary shell command injection.
    
    Review: https://reviews.apache.org/r/50214/

> MesosContainerizerLaunch flags execute arbitrary commands via shell
> -------------------------------------------------------------------
>
>                 Key: MESOS-5388
>                 URL: https://issues.apache.org/jira/browse/MESOS-5388
>             Project: Mesos
>          Issue Type: Bug
>          Components: containerization
>            Reporter: James DeFelice
>            Assignee: Gilbert Song
>              Labels: mesosphere, security
>
> For example, the docker volume isolator's containerPath is appended (without sanitation) to a command that's executed in this manner. As such, it's possible to inject arbitrary shell commands to be executed by mesos.
> https://github.com/apache/mesos/blob/17260204c833c643adf3d8f36ad8a1a606ece809/src/slave/containerizer/mesos/launch.cpp#L206
> Perhaps instead of strings these commands could/should be sent as string arrays that could be passed as argv arguments w/o shell interpretation?



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)