mirror of
https://github.com/kemko/nomad.git
synced 2026-01-04 17:35:43 +03:00
003d68fe6d
The default Linux Capabilities set enabled by the docker, exec, and java task drivers includes CAP_NET_RAW (for making ping just work), which has the side affect of opening an ARP DoS/MiTM attack between tasks using bridge networking on the same host network. https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities This PR disables CAP_NET_RAW for the docker, exec, and java task drivers. The previous behavior can be restored for docker using the allow_caps docker plugin configuration option. A future version of nomad will enable similar configurability for the exec and java task drivers.
33 lines
796 B
Go
33 lines
796 B
Go
//+build !windows
|
|
|
|
package docker
|
|
|
|
import (
|
|
"github.com/docker/docker/oci/caps"
|
|
docker "github.com/fsouza/go-dockerclient"
|
|
)
|
|
|
|
func getPortBinding(ip string, port string) docker.PortBinding {
|
|
return docker.PortBinding{HostIP: ip, HostPort: port}
|
|
}
|
|
|
|
func tweakCapabilities(basics, adds, drops []string) ([]string, error) {
|
|
// Moby mixes 2 different capabilities formats: prefixed with "CAP_"
|
|
// and not. We do the conversion here to have a consistent,
|
|
// non-prefixed format on the Nomad side.
|
|
for i, cap := range basics {
|
|
basics[i] = "CAP_" + cap
|
|
}
|
|
|
|
effectiveCaps, err := caps.TweakCapabilities(basics, adds, drops, nil, false)
|
|
if err != nil {
|
|
return effectiveCaps, err
|
|
}
|
|
|
|
for i, cap := range effectiveCaps {
|
|
effectiveCaps[i] = cap[len("CAP_"):]
|
|
}
|
|
|
|
return effectiveCaps, nil
|
|
}
|