Uploaded image for project: 'Mesos'
  1. Mesos
  2. MESOS-9771

Mask sensitive procfs paths.

    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 1.9.0
    • Component/s: containerization
    • Labels:
      None
    • Target Version/s:

      Description

      We already have a set of procfs paths that we mark read-only in the containerizer, but there are additional paths that are considered sensitive by other containerizers and are masked altogether:

                                      "/proc/asound"
                                      "/proc/acpi"
                                      "/proc/kcore"
                                      "/proc/keys"
                                      "/proc/latency_stats"
                                      "/proc/timer_list"
                                      "/proc/timer_stats"
                                      "/proc/sched_debug"
                                      "/sys/firmware"
                                      "/proc/scsi"
      

      Masking is done by mounting /dev/null on files, and an empty, readonly tmpfs on directories.

        Attachments

          Activity

            People

            • Assignee:
              jamespeach James Peach
              Reporter:
              jamespeach James Peach
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: