[MESOS-5459] Update RUN_TASK_WITH_USER to use additional metadata

• Type: Improvement
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 1.0.0
• Component/s: security
• Labels: mesosphere security
• Sprint: Mesosphere Sprint 36
• Story Points: 5
• Assignee: Benjamin Bannier
• Reporter: Adam B
• Shepherd: Adam B
• Created: 26/May/16 10:53
• Updated: 29/Apr/19 09:26
• Resolved: 01/Jun/16 07:14

Description

Currently, the `authorization::Action` `RUN_TASK_WITH_USER` will pass the user as its `Object.value` string, but some authorizers may want to make authorization decisions based on additional task attributes, like role, resources, labels, container type, etc.

We should create a new Action `RUN_TASK` that passes FrameworkInfo and TaskInfo in its Object, and the LocalAuthorizer's RunTaskWithUser ACL can be implemented using the user found in TaskInfo/FrameworkInfo.
We may need to leave the old _WITH_USER action around, but it's arguable whether we should call the authorizer once for RUN_TASK and once for RUN_TASK_WITH_USER, or only use the new action and deprecate the old one?

Issue Links

• is related to: MESOS-5153 Sandboxes contents should be protected from unauthorized users
• is related to: MESOS-5169 Introduce new Authorizer Actions for Authorized based filtering of endpoints.