luxolus/open-nomad
2
0
Fork 0
Code Issues 1 Pull requests Packages Releases Wiki Activity
open-nomad/client/fingerprint
History
Seth Hoenig 51a2212d3d
client: sandbox go-getter subprocess with landlock (#15328) 
* client: sandbox go-getter subprocess with landlock

This PR re-implements the getter package for artifact downloads as a subprocess.

Key changes include

On all platforms, run getter as a child process of the Nomad agent.
On Linux platforms running as root, run the child process as the nobody user.
On supporting Linux kernels, uses landlock for filesystem isolation (via go-landlock).
On all platforms, restrict environment variables of the child process to a static set.
notably TMP/TEMP now points within the allocation's task directory
kernel.landlock attribute is fingerprinted (version number or unavailable)
These changes make Nomad client more resilient against a faulty go-getter implementation that may panic, and more secure against bad actors attempting to use artifact downloads as a privilege escalation vector.

Adds new e2e/artifact suite for ensuring artifact downloading works.

TODO: Windows git test (need to modify the image, etc... followup PR)

* landlock: fixup items from cr

* cr: fixup tests and go.mod file
2022-12-07 16:02:25 -06:00
..
test_fixtures fingerprint: add fingerprinting for CNI plugins presense and version (#15452) 2022-12-05 14:22:47 -06:00
arch.go client: Move fingerprint structs to pkg 2018-12-01 17:10:39 +01:00
arch_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
bridge.go client/fingerprint: detect unloaded dynamic bridge kernel module 2020-11-09 13:56:14 -06:00
bridge_default.go gofmt all the files 2021-10-01 10:14:28 -04:00
bridge_linux.go deps: bump gopsutil to v3.21.2 2021-03-30 16:02:51 -04:00
bridge_linux_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
cgroup.go CI: make make check clean on macOS (#14528) 2022-09-09 12:26:34 -04:00
cgroup_default.go client: enable support for cgroups v2 2022-03-23 11:35:27 -05:00
cgroup_linux.go CI: make make check clean on macOS (#14528) 2022-09-09 12:26:34 -04:00
cgroup_test.go client: enable support for cgroups v2 2022-03-23 11:35:27 -05:00
cni.go fingerprint: add fingerprinting for CNI plugins presense and version (#15452) 2022-12-05 14:22:47 -06:00
cni_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
consul.go client: accommodate Consul 1.14.0 gRPC and agent self changes. (#15309) 2022-11-21 09:19:09 -06:00
consul_test.go client: accommodate Consul 1.14.0 gRPC and agent self changes. (#15309) 2022-11-21 09:19:09 -06:00
cpu.go fingerprint: add node attr for reserverable cores (#14694) 2022-09-26 13:03:03 -07:00
cpu_default.go gofmt all the files 2021-10-01 10:14:28 -04:00
cpu_linux.go client: enable support for cgroups v2 2022-03-23 11:35:27 -05:00
cpu_test.go fingerprint: add node attr for reserverable cores (#14694) 2022-09-26 13:03:03 -07:00
env_aws.go client: Add AWS EC2 instance-life-cycle from metadata to client fingerprint (#12371) 2022-03-25 11:50:52 -04:00
env_aws_cpu.go build: update aws env cpu info 2022-08-02 07:59:58 -05:00
env_aws_test.go client: Add AWS EC2 instance-life-cycle from metadata to client fingerprint (#12371) 2022-03-25 11:50:52 -04:00
env_azure.go chore: bump golangci-lint from v1.24 to v1.39 2021-04-03 09:50:23 +02:00
env_azure_test.go testing: setting env var incompatible with parallel tests (#14405) 2022-08-30 14:49:03 -04:00
env_digitalocean.go chore: remove use of "err" a log line context key for errors. (#14433) 2022-09-01 15:06:10 +02:00
env_digitalocean_test.go testing: setting env var incompatible with parallel tests (#14405) 2022-08-30 14:49:03 -04:00
env_gce.go chore: bump golangci-lint from v1.24 to v1.39 2021-04-03 09:50:23 +02:00
env_gce_test.go testing: setting env var incompatible with parallel tests (#14405) 2022-08-30 14:49:03 -04:00
fingerprint.go client: sandbox go-getter subprocess with landlock (#15328) 2022-12-07 16:02:25 -06:00
fingerprint_default.go gofmt all the files 2021-10-01 10:14:28 -04:00
fingerprint_linux.go CNI Implementation (#7518) 2020-06-18 11:05:29 -07:00
fingerprint_test.go fingerprint code refactor 2019-11-26 10:51:28 -05:00
host.go fingerprint kernel architecture name (#13182) 2022-06-02 15:51:00 -04:00
host_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
landlock.go client: sandbox go-getter subprocess with landlock (#15328) 2022-12-07 16:02:25 -06:00
landlock_test.go client: sandbox go-getter subprocess with landlock (#15328) 2022-12-07 16:02:25 -06:00
memory.go deps: bump gopsutil to v3.21.2 2021-03-30 16:02:51 -04:00
memory_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
network.go fix host network reserved port fingerprint (#11728) 2021-12-22 15:29:54 -05:00
network_default.go gofmt all the files 2021-10-01 10:14:28 -04:00
network_linux.go Log network device name during fingerprinting (#11184) 2021-09-16 10:48:31 -04:00
network_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
network_windows.go Disable PowerShell profile and simplify fingerprinting link speed on Windows (#11183) 2021-09-22 11:17:47 -04:00
nomad.go client: add service discovery feature enabled attribute. 2022-03-14 12:42:01 +01:00
nomad_test.go Merge branch 'main' into f-1.3-boogie-nights 2022-03-23 09:41:25 +01:00
plugins_cni.go fingerprint: add fingerprinting for CNI plugins presense and version (#15452) 2022-12-05 14:22:47 -06:00
plugins_cni_test.go fingerprint: add fingerprinting for CNI plugins presense and version (#15452) 2022-12-05 14:22:47 -06:00
signal.go client: Move fingerprint structs to pkg 2018-12-01 17:10:39 +01:00
signal_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
storage.go client: Move fingerprint structs to pkg 2018-12-01 17:10:39 +01:00
storage_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
storage_unix.go gofmt all the files 2021-10-01 10:14:28 -04:00
storage_windows.go Revert "lint: ignore generated windows syscall wrappers" 2019-10-22 08:23:44 -04:00
structs.go Add gosimple linter (#9590) 2020-12-09 11:05:18 -08:00
vault.go fingerprint: lengthen Vault check after seen (#14693) 2022-09-26 12:14:19 -07:00
vault_test.go fingerprint: lengthen Vault check after seen (#14693) 2022-09-26 12:14:19 -07:00
zstorage_windows.go Revert "lint: ignore generated windows syscall wrappers" 2019-10-22 08:23:44 -04:00