You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@mesos.apache.org by "Gilbert Song (JIRA)" <ji...@apache.org> on 2016/08/02 23:04:20 UTC

[jira] [Updated] (MESOS-5388) MesosContainerizerLaunch flags execute arbitrary commands via shell.

     [ https://issues.apache.org/jira/browse/MESOS-5388?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Gilbert Song updated MESOS-5388:
--------------------------------
    Summary: MesosContainerizerLaunch flags execute arbitrary commands via shell.  (was: MesosContainerizerLaunch flags execute arbitrary commands via shell)

> MesosContainerizerLaunch flags execute arbitrary commands via shell.
> --------------------------------------------------------------------
>
>                 Key: MESOS-5388
>                 URL: https://issues.apache.org/jira/browse/MESOS-5388
>             Project: Mesos
>          Issue Type: Bug
>          Components: containerization
>            Reporter: James DeFelice
>            Assignee: Gilbert Song
>              Labels: mesosphere, security
>
> For example, the docker volume isolator's containerPath is appended (without sanitation) to a command that's executed in this manner. As such, it's possible to inject arbitrary shell commands to be executed by mesos.
> https://github.com/apache/mesos/blob/17260204c833c643adf3d8f36ad8a1a606ece809/src/slave/containerizer/mesos/launch.cpp#L206
> Perhaps instead of strings these commands could/should be sent as string arrays that could be passed as argv arguments w/o shell interpretation?



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)