You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by jp...@apache.org on 2018/01/23 22:42:39 UTC
[1/2] mesos git commit: Added os::eraseenv to clear the old
environment value.
Repository: mesos
Updated Branches:
refs/heads/master ce0905fcb -> 9e18db59f
Added os::eraseenv to clear the old environment value.
On Linux, updating the environment with unsetenv(3) does
not change the value that other processes can inspect
(e.g. through `/proc/$pid/environ`). We have to overwrite
the existing value (if any) prior to calling unsetenv(3)
if we want to ensure that the value is really gone.
Review: https://reviews.apache.org/r/63422/
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/f3484206
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/f3484206
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/f3484206
Branch: refs/heads/master
Commit: f3484206a914f3b9c49c9bad4bd453d86b36b332
Parents: ce0905f
Author: James Peach <jp...@apache.org>
Authored: Tue Jan 23 14:12:57 2018 -0800
Committer: James Peach <jp...@apache.org>
Committed: Tue Jan 23 14:12:57 2018 -0800
----------------------------------------------------------------------
3rdparty/stout/include/stout/posix/os.hpp | 16 ++++++++++++++++
3rdparty/stout/tests/os/env_tests.cpp | 26 ++++++++++++++++++++++++++
2 files changed, 42 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/f3484206/3rdparty/stout/include/stout/posix/os.hpp
----------------------------------------------------------------------
diff --git a/3rdparty/stout/include/stout/posix/os.hpp b/3rdparty/stout/include/stout/posix/os.hpp
index 3c52a49..dfee0fa 100644
--- a/3rdparty/stout/include/stout/posix/os.hpp
+++ b/3rdparty/stout/include/stout/posix/os.hpp
@@ -170,6 +170,22 @@ inline void unsetenv(const std::string& key)
}
+// Erases the value associated with the specified key from the set of
+// environment variables.
+inline void eraseenv(const std::string& key)
+{
+ char * value = ::getenv(key.c_str());
+
+ // Erase the old value so that on Linux it can't be inspected through
+ // /proc/$pid/environ.
+ if (value) {
+ ::memset(value, '\0', ::strlen(value));
+ }
+
+ ::unsetenv(key.c_str());
+}
+
+
// This function is a portable version of execvpe ('p' means searching
// executable from PATH and 'e' means setting environments). We add
// this function because it is not available on all systems.
http://git-wip-us.apache.org/repos/asf/mesos/blob/f3484206/3rdparty/stout/tests/os/env_tests.cpp
----------------------------------------------------------------------
diff --git a/3rdparty/stout/tests/os/env_tests.cpp b/3rdparty/stout/tests/os/env_tests.cpp
index 0e94b38..b5b124d 100644
--- a/3rdparty/stout/tests/os/env_tests.cpp
+++ b/3rdparty/stout/tests/os/env_tests.cpp
@@ -62,3 +62,29 @@ TEST(EnvTest, SimpleEnvTest)
result = os::getenv(key);
EXPECT_NONE(result);
}
+
+
+#ifndef __WINDOWS__
+TEST(EnvTest, EraseEnv)
+{
+ os::setenv("key", "value");
+
+ std::map<string, string> pre = os::environment();
+
+ // We use ::getenv rather than `os::getenv` so that we can
+ // keep the pointer across the `os::eraseenv` and verify that
+ // `os::eraseenv` clears existing values rather than just
+ // making them unavailable.
+ char * value = ::getenv("key");
+ EXPECT_STREQ("value", value);
+
+ os::eraseenv("key");
+ EXPECT_STREQ("", value);
+ EXPECT_NONE(os::getenv("key"));
+
+ // Verify that erasing "key" removed the environment variable without
+ // damaging any other ernvironment variables.
+ pre.erase("key");
+ EXPECT_EQ(pre, os::environment());
+}
+#endif // __WINDOWS__
[2/2] mesos git commit: Cleared the executor auth token after using
it.
Posted by jp...@apache.org.
Cleared the executor auth token after using it.
Since the executor may run in the same container and under
the same credential as the user task, we should clear the
`MESOS_EXECUTOR_AUTHENTICATION_TOKEN` environment variable
once we sample it.
Review: https://reviews.apache.org/r/63423/
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/9e18db59
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/9e18db59
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/9e18db59
Branch: refs/heads/master
Commit: 9e18db59f75b85fc6467272203366eef1c17233e
Parents: f348420
Author: James Peach <jp...@apache.org>
Authored: Tue Jan 23 14:13:01 2018 -0800
Committer: James Peach <jp...@apache.org>
Committed: Tue Jan 23 14:13:01 2018 -0800
----------------------------------------------------------------------
src/executor/executor.cpp | 4 ++++
1 file changed, 4 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/9e18db59/src/executor/executor.cpp
----------------------------------------------------------------------
diff --git a/src/executor/executor.cpp b/src/executor/executor.cpp
index 1c972d9..9459368 100644
--- a/src/executor/executor.cpp
+++ b/src/executor/executor.cpp
@@ -228,6 +228,10 @@ public:
authenticationToken = value.get();
}
+ // Erase the auth token from the environment so that it is not visible to
+ // other processes in the same PID namespace.
+ os::eraseenv("MESOS_EXECUTOR_AUTHENTICATION_TOKEN");
+
// Get checkpointing status from environment.
value = os::getenv("MESOS_CHECKPOINT");
checkpoint = value.isSome() && value.get() == "1";