Seth Hoenig 003d68fe6d drivers/docker+exec+java: disable net_raw capability by default ...

The default Linux Capabilities set enabled by the docker, exec, and
java task drivers includes CAP_NET_RAW (for making ping just work),
which has the side affect of opening an ARP DoS/MiTM attack between
tasks using bridge networking on the same host network.

https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities

This PR disables CAP_NET_RAW for the docker, exec, and java task
drivers. The previous behavior can be restored for docker using the
allow_caps docker plugin configuration option.

A future version of nomad will enable similar configurability for the
exec and java task drivers.

2021-05-12 13:22:09 -07:00

..

proto

executor: add support for cpuset cgroup

2021-04-15 10:24:31 -04:00

test-resources/busybox

tests: busybox only depends on arch

2019-01-07 08:36:32 -05:00

client.go

drivers/exec+java: Add task configuration to restore previous PID/IPC isolation behavior

2021-02-08 14:26:35 -06:00

exec_utils.go

Apply some suggested fixes from staticcheck (#9598)

2020-12-10 07:29:18 -08:00

executor_basic.go

honor task user when execing into raw_exec task (#9439)

2020-11-25 09:34:10 -05:00

executor_linux_test.go

drivers/docker+exec+java: disable net_raw capability by default

2021-05-12 13:22:09 -07:00

executor_linux.go

drivers/docker+exec+java: disable net_raw capability by default

2021-05-12 13:22:09 -07:00

executor_plugin.go

goimports

2019-01-22 15:44:31 -08:00

executor_test.go

tests: copy permissions when copying files

2020-10-01 10:23:14 -04:00

executor_universal_linux.go

deps: update runc to v1.0.0-rc93

2021-03-31 10:57:02 -04:00

executor_unix.go

default e.getAllPids in executor_basic

2019-07-18 10:57:27 -04:00

executor_windows.go

default e.getAllPids in executor_basic

2019-07-18 10:57:27 -04:00

executor.go

drivers/docker+exec+java: disable net_raw capability by default

2021-05-12 13:22:09 -07:00

legacy_executor_wrapper.go

Legacy executors are executors after all

2020-11-10 10:20:07 -05:00

libcontainer_nsenter_linux.go

comment on using init() for libcontainer handling

2019-04-19 09:49:04 -04:00

pid_collector_test.go

drivers: Move client/drivers/executor to drivers/shared/executor

2018-11-30 10:46:13 +01:00

pid_collector.go

deps: bump gopsutil to v3.21.2

2021-03-30 16:02:51 -04:00

plugins.go

driver: add pre09 migration logic

2019-01-18 18:31:01 -05:00

pty_unix.go

Upgrade to golang 1.15 (#8858)

2020-09-09 15:59:29 -04:00

pty_windows.go

executors: implement streaming exec

2019-05-10 19:17:14 -04:00

resource_container_default.go

drivers: Move client/drivers/executor to drivers/shared/executor

2018-11-30 10:46:13 +01:00

resource_container_linux.go

resource_container_linux new getAllPidsByCgroup

2019-07-17 17:31:36 -04:00

server.go

drivers/exec+java: Add task configuration to restore previous PID/IPC isolation behavior

2021-02-08 14:26:35 -06:00

utils_test.go

drivers/exec+java: Add task configuration to restore previous PID/IPC isolation behavior

2021-02-08 14:26:35 -06:00

utils_unix.go

executor: merge plugin shim with executor package

2018-12-06 21:13:45 -05:00

utils_windows.go

executor: merge plugin shim with executor package

2018-12-06 21:13:45 -05:00

utils.go

drivers/exec+java: Add task configuration to restore previous PID/IPC isolation behavior

2021-02-08 14:26:35 -06:00

z_executor_cmd.go

comment on use of init() for plugin handlers

2019-06-18 20:54:55 -04:00