raw_exec: be defensive when disabled

Ensure that no raw_exec task can run on a client where it's disabled,
even if a flaw lead to client being assigned a raw_exec task
unexpectedly.

drivers/rawexec/driver.go

@@ -47,6 +47,8 @@ var (
 		Config:  map[string]interface{}{},
 		Factory: func(l hclog.Logger) interface{} { return NewRawExecDriver(l) },
 	}
+
+	errDisabledDriver = fmt.Errorf("raw_exec is disabled")
 )
 
 // PluginLoader maps pre-0.9 client driver options to post-0.9 plugin options.
@@ -307,6 +309,10 @@ func (d *Driver) RecoverTask(handle *drivers.TaskHandle) error {
 }
 
 func (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *drivers.DriverNetwork, error) {
+	if !d.config.Enabled {
+		return nil, nil, errDisabledDriver
+	}
+
 	if _, ok := d.tasks.Get(cfg.ID); ok {
 		return nil, nil, fmt.Errorf("task with ID %q already started", cfg.ID)
 	}

drivers/rawexec/driver_test.go

@@ -471,3 +471,23 @@ config {
 
 	require.EqualValues(t, expected, tc)
 }
+
+func TestRawExecDriver_Disabled(t *testing.T) {
+	t.Parallel()
+	require := require.New(t)
+
+	d := NewRawExecDriver(testlog.HCLogger(t))
+	d.(*Driver).config.Enabled = false
+
+	harness := dtestutil.NewDriverHarness(t, d)
+	defer harness.Kill()
+	task := &drivers.TaskConfig{
+		ID:   uuid.Generate(),
+		Name: "test",
+	}
+
+	handle, _, err := harness.StartTask(task)
+	require.Error(err)
+	require.Contains(err.Error(), errDisabledDriver.Error())
+	require.Nil(handle)
+}