[MESOS-5153] Sandboxes contents should be protected from unauthorized users

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.0.0
• Component/s: agent, security
• Labels: mesosphere security
• Epic Link: Agent HTTP Authz
• Sprint: Mesosphere Sprint 33, Mesosphere Sprint 34, Mesosphere Sprint 35, Mesosphere Sprint 36
• Story Points: 8
• Assignee: Alexander Rojas
• Reporter: Alexander Rojas
• Shepherd: Adam B
• Created: 08/Apr/16 10:35
• Updated: 29/Apr/19 09:26
• Resolved: 01/Jun/16 06:43

Description

MESOS-4956 introduced authentication support for the sandboxes. However, authentication can only go as far as to tell whether an user is known to mesos or not. An extra additional step is necessary to verify whether the known user is allowed to executed the requested operation on the sandbox (browse, read, download, debug).

Issue Links

• is related to: MESOS-5615 When using command executor, the ExecutorInfo is useless for sandbox authorization
• relates to: MESOS-5459 Update RUN_TASK_WITH_USER to use additional metadata