mirror of
https://github.com/kemko/nomad.git
synced 2026-01-01 16:05:42 +03:00
The Nomad client renders templates in the same privileged process used for most other client operations. During internal testing, we discovered that a malicious task can create a symlink that can cause template rendering to read and write to arbitrary files outside the allocation sandbox. Because the Nomad agent can be restarted without restarting tasks, we can't simply check that the path is safe at the time we write without encountering a time-of-check/time-of-use race. To protect Nomad client hosts from this attack, we'll now read and write templates in a subprocess: * On Linux/Unix, this subprocess is sandboxed via chroot to the allocation directory. This requires that Nomad is running as a privileged process. A non-root Nomad agent will warn that it cannot sandbox the template renderer. * On Windows, this process is sandboxed via a Windows AppContainer which has been granted access to only to the allocation directory. This does not require special privileges on Windows. (Creating symlinks in the first place can be prevented by running workloads as non-Administrator or non-ContainerAdministrator users.) Both sandboxes cause encountered symlinks to be evaluated in the context of the sandbox, which will result in a "file not found" or "access denied" error, depending on the platform. This change will also require an update to Consul-Template to allow callers to inject a custom `ReaderFunc` and `RenderFunc`. This design is intended as a workaround to allow us to fix this bug without creating backwards compatibility issues for running tasks. A future version of Nomad may introduce a read-only mount specifically for templates and artifacts so that tasks cannot write into the same location that the Nomad agent is. Fixes: https://github.com/hashicorp/nomad/issues/19888 Fixes: CVE-2024-1329
176 lines
4.1 KiB
Go
176 lines
4.1 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"sort"
|
|
"strings"
|
|
"text/tabwriter"
|
|
|
|
// These packages have init() funcs which check os.Args and drop directly
|
|
// into their command logic. This is because they are run as separate
|
|
// processes along side of a task. By early importing them we can avoid
|
|
// additional code being imported and thus reserving memory.
|
|
_ "github.com/hashicorp/nomad/client/allocrunner/taskrunner/getter"
|
|
_ "github.com/hashicorp/nomad/client/allocrunner/taskrunner/template/renderer"
|
|
_ "github.com/hashicorp/nomad/client/logmon"
|
|
_ "github.com/hashicorp/nomad/drivers/docker/docklog"
|
|
_ "github.com/hashicorp/nomad/drivers/shared/executor"
|
|
|
|
// Don't move any other code imports above the import block above!
|
|
"github.com/hashicorp/nomad/command"
|
|
"github.com/hashicorp/nomad/version"
|
|
"github.com/mitchellh/cli"
|
|
)
|
|
|
|
var (
|
|
// Hidden hides the commands from both help and autocomplete. Commands that
|
|
// users should not be running should be placed here, versus hiding
|
|
// subcommands from the main help, which should be filtered out of the
|
|
// commands above.
|
|
hidden = []string{
|
|
"alloc-status",
|
|
"check",
|
|
"client-config",
|
|
"debug",
|
|
"eval-status",
|
|
"executor",
|
|
"logmon",
|
|
"node-drain",
|
|
"node-status",
|
|
"server-force-leave",
|
|
"server-join",
|
|
"server-members",
|
|
"syslog",
|
|
"docker_logger",
|
|
"operator raft _info",
|
|
"operator raft _logs",
|
|
"operator raft _state",
|
|
"operator snapshot _state",
|
|
"template-render",
|
|
}
|
|
|
|
// aliases is the list of aliases we want users to be aware of. We hide
|
|
// these form the help output but autocomplete them.
|
|
aliases = []string{
|
|
"fs",
|
|
"init",
|
|
"inspect",
|
|
"logs",
|
|
"plan",
|
|
"validate",
|
|
}
|
|
|
|
// Common commands are grouped separately to call them out to operators.
|
|
commonCommands = []string{
|
|
"run",
|
|
"stop",
|
|
"status",
|
|
"alloc",
|
|
"job",
|
|
"node",
|
|
"agent",
|
|
}
|
|
)
|
|
|
|
func main() {
|
|
os.Exit(Run(os.Args[1:]))
|
|
}
|
|
|
|
func Run(args []string) int {
|
|
// Create the meta object
|
|
metaPtr := new(command.Meta)
|
|
metaPtr.SetupUi(args)
|
|
|
|
// The Nomad agent never outputs color
|
|
agentUi := &cli.BasicUi{
|
|
Reader: os.Stdin,
|
|
Writer: os.Stdout,
|
|
ErrorWriter: os.Stderr,
|
|
}
|
|
|
|
commands := command.Commands(metaPtr, agentUi)
|
|
cli := &cli.CLI{
|
|
Name: "nomad",
|
|
Version: version.GetVersion().FullVersionNumber(true),
|
|
Args: args,
|
|
Commands: commands,
|
|
HiddenCommands: hidden,
|
|
Autocomplete: true,
|
|
AutocompleteNoDefaultFlags: true,
|
|
HelpFunc: groupedHelpFunc(
|
|
cli.BasicHelpFunc("nomad"),
|
|
),
|
|
HelpWriter: os.Stdout,
|
|
}
|
|
|
|
exitCode, err := cli.Run()
|
|
if err != nil {
|
|
fmt.Fprintf(os.Stderr, "Error executing CLI: %s\n", err.Error())
|
|
return 1
|
|
}
|
|
|
|
return exitCode
|
|
}
|
|
|
|
func groupedHelpFunc(f cli.HelpFunc) cli.HelpFunc {
|
|
return func(commands map[string]cli.CommandFactory) string {
|
|
var b bytes.Buffer
|
|
tw := tabwriter.NewWriter(&b, 0, 2, 6, ' ', 0)
|
|
|
|
fmt.Fprintf(tw, "Usage: nomad [-version] [-help] [-autocomplete-(un)install] <command> [args]\n\n")
|
|
fmt.Fprintf(tw, "Common commands:\n")
|
|
for _, v := range commonCommands {
|
|
printCommand(tw, v, commands[v])
|
|
}
|
|
|
|
// Filter out common commands and aliased commands from the other
|
|
// commands output
|
|
otherCommands := make([]string, 0, len(commands))
|
|
for k := range commands {
|
|
found := false
|
|
for _, v := range commonCommands {
|
|
if k == v {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
|
|
for _, v := range aliases {
|
|
if k == v {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
|
|
if !found {
|
|
otherCommands = append(otherCommands, k)
|
|
}
|
|
}
|
|
sort.Strings(otherCommands)
|
|
|
|
fmt.Fprintf(tw, "\n")
|
|
fmt.Fprintf(tw, "Other commands:\n")
|
|
for _, v := range otherCommands {
|
|
printCommand(tw, v, commands[v])
|
|
}
|
|
|
|
tw.Flush()
|
|
|
|
return strings.TrimSpace(b.String())
|
|
}
|
|
}
|
|
|
|
func printCommand(w io.Writer, name string, cmdFn cli.CommandFactory) {
|
|
cmd, err := cmdFn()
|
|
if err != nil {
|
|
panic(fmt.Sprintf("failed to load %q command: %s", name, err))
|
|
}
|
|
fmt.Fprintf(w, " %s\t%s\n", name, cmd.Synopsis())
|
|
}
|