You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by ji...@apache.org on 2017/01/22 19:22:21 UTC
mesos git commit: Fixed unsufficient root privileges check by
geteuid().
Repository: mesos
Updated Branches:
refs/heads/master 18ed9d94f -> 9228ebc23
Fixed unsufficient root privileges check by geteuid().
We should check the root privileges by using the effective user id,
instead of comparing os::user() to 'root'.
Review: https://reviews.apache.org/r/54216/
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/9228ebc2
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/9228ebc2
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/9228ebc2
Branch: refs/heads/master
Commit: 9228ebc239dac42825390bebc72053dbf3ae7b09
Parents: 18ed9d9
Author: Gilbert Song <so...@gmail.com>
Authored: Sun Jan 22 09:00:00 2017 -0800
Committer: Jie Yu <yu...@gmail.com>
Committed: Sun Jan 22 11:07:03 2017 -0800
----------------------------------------------------------------------
.../containerizer/mesos/isolators/filesystem/linux.cpp | 8 +-------
src/slave/containerizer/mesos/isolators/gpu/volume.cpp | 9 +--------
.../containerizer/mesos/provisioner/backends/aufs.cpp | 13 ++-----------
.../containerizer/mesos/provisioner/backends/bind.cpp | 8 +-------
.../mesos/provisioner/backends/overlay.cpp | 13 ++-----------
5 files changed, 7 insertions(+), 44 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/9228ebc2/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
index 74ab1fd..ae0031d 100644
--- a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+++ b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
@@ -66,13 +66,7 @@ namespace slave {
Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
{
- Result<string> user = os::user();
- if (!user.isSome()) {
- return Error("Failed to determine user: " +
- (user.isError() ? user.error() : "username not found"));
- }
-
- if (user.get() != "root") {
+ if (geteuid() != 0) {
return Error("LinuxFilesystemIsolator requires root privileges");
}
http://git-wip-us.apache.org/repos/asf/mesos/blob/9228ebc2/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/gpu/volume.cpp b/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
index 478752f..536a3c7 100644
--- a/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
+++ b/src/slave/containerizer/mesos/isolators/gpu/volume.cpp
@@ -193,14 +193,7 @@ const string& NvidiaVolume::CONTAINER_PATH() const
Try<NvidiaVolume> NvidiaVolume::create()
{
- // We need root permissions in order to create the volume.
- Result<string> user = os::user();
- if (!user.isSome()) {
- return Error("Failed to determine user: " +
- (user.isError() ? user.error() : "username not found"));
- }
-
- if (user.get() != "root") {
+ if (geteuid() != 0) {
return Error("NvidiaVolume::create() requires root privileges");
}
http://git-wip-us.apache.org/repos/asf/mesos/blob/9228ebc2/src/slave/containerizer/mesos/provisioner/backends/aufs.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/provisioner/backends/aufs.cpp b/src/slave/containerizer/mesos/provisioner/backends/aufs.cpp
index c92c6c7..bd14fc3 100644
--- a/src/slave/containerizer/mesos/provisioner/backends/aufs.cpp
+++ b/src/slave/containerizer/mesos/provisioner/backends/aufs.cpp
@@ -60,17 +60,8 @@ public:
Try<Owned<Backend>> AufsBackend::create(const Flags&)
{
- Result<string> user = os::user();
- if (!user.isSome()) {
- return Error(
- "Failed to determine user: " +
- (user.isError() ? user.error() : "username not found"));
- }
-
- if (user.get() != "root") {
- return Error(
- "AufsBackend requires root privileges, "
- "but is running as user " + user.get());
+ if (geteuid() != 0) {
+ return Error("AufsBackend requires root privileges");
}
return Owned<Backend>(new AufsBackend(
http://git-wip-us.apache.org/repos/asf/mesos/blob/9228ebc2/src/slave/containerizer/mesos/provisioner/backends/bind.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/provisioner/backends/bind.cpp b/src/slave/containerizer/mesos/provisioner/backends/bind.cpp
index 94dac40..d6cdc93 100644
--- a/src/slave/containerizer/mesos/provisioner/backends/bind.cpp
+++ b/src/slave/containerizer/mesos/provisioner/backends/bind.cpp
@@ -63,13 +63,7 @@ public:
Try<Owned<Backend>> BindBackend::create(const Flags&)
{
- Result<string> user = os::user();
- if (!user.isSome()) {
- return Error("Failed to determine user: " +
- (user.isError() ? user.error() : "username not found"));
- }
-
- if (user.get() != "root") {
+ if (geteuid() != 0) {
return Error("BindBackend requires root privileges");
}
http://git-wip-us.apache.org/repos/asf/mesos/blob/9228ebc2/src/slave/containerizer/mesos/provisioner/backends/overlay.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/provisioner/backends/overlay.cpp b/src/slave/containerizer/mesos/provisioner/backends/overlay.cpp
index a6e6c8b..86b24dd 100644
--- a/src/slave/containerizer/mesos/provisioner/backends/overlay.cpp
+++ b/src/slave/containerizer/mesos/provisioner/backends/overlay.cpp
@@ -63,17 +63,8 @@ public:
Try<Owned<Backend>> OverlayBackend::create(const Flags&)
{
- Result<string> user = os::user();
- if (!user.isSome()) {
- return Error(
- "Failed to determine user: " +
- (user.isError() ? user.error() : "username not found"));
- }
-
- if (user.get() != "root") {
- return Error(
- "OverlayBackend requires root privileges, "
- "but is running as user " + user.get());
+ if (geteuid() != 0) {
+ return Error("OverlayBackend requires root privileges");
}
return Owned<Backend>(new OverlayBackend(