[
https://issues.apache.org/jira/browse/MESOS-9349?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
James Peach reassigned MESOS-9349:
----------------------------------
Assignee: James Peach
Priority: Minor (was: Major)
Fix Version/s: 1.8.0
Issue Type: Improvement (was: Bug)
| [r/69615|https://reviews.apache.org/r/69615] | Disable containerizer ptrace
attach. |
> Prevent ptracing of container management processes.
> ---------------------------------------------------
>
> Key: MESOS-9349
> URL: https://issues.apache.org/jira/browse/MESOS-9349
> Project: Mesos
> Issue Type: Improvement
> Components: containerization, security
> Reporter: James Peach
> Assignee: James Peach
> Priority: Minor
> Fix For: 1.8.0
>
>
> The container launcher and the built-in executors are (at least partially)
> accessible to containerized user tasks. Since these processes may contain
> secrets or hold privileged resources, we can increase the difficulty of
> attacking them by preventing user tasks attaching to them with ptrace(2).
> This amounts to calling `prctl(PR_SET_DUMPABLE, 0)`.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
