luxolus/open-nomad
2
0
Fork 0
Code Issues 1 Pull requests Packages Releases Wiki Activity
open-nomad/nomad
History
Mahmood Ali 4b2ba62e35 acl: check ACL against object namespace 
Fix a bug where a millicious user can access or manipulate an alloc in a
namespace they don't have access to.  The allocation endpoints perform
ACL checks against the request namespace, not the allocation namespace,
and performs the allocation lookup independently from namespaces.

Here, we check that the requested can access the alloc namespace
regardless of the declared request namespace.

Ideally, we'd enforce that the declared request namespace matches
the actual allocation namespace.  Unfortunately, we haven't documented
alloc endpoints as namespaced functions; we suspect starting to enforce
this will be very disruptive and inappropriate for a nomad point
release.  As such, we maintain current behavior that doesn't require
passing the proper namespace in request.  A future major release may
start enforcing checking declared namespace.
2019-10-08 12:59:22 -04:00
..
deploymentwatcher add create and modify timestamps to evaluations (#5881) 2019-08-07 09:50:35 -07:00
drainer add create and modify timestamps to evaluations (#5881) 2019-08-07 09:50:35 -07:00
mock connect: add unix socket to proxy grpc for envoy (#6232) 2019-09-03 08:43:38 -07:00
state Merge pull request #5791 from hashicorp/b-plan-snapshotindex 2019-07-17 09:25:00 -07:00
structs acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
types
acl.go
acl_endpoint.go server 2018-09-15 16:23:13 -07:00
acl_endpoint_test.go non-Existent -> nonexistent 2018-03-12 11:59:33 -07:00
acl_test.go
alloc_endpoint.go acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
alloc_endpoint_test.go acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
autopilot.go goimports 2019-01-22 15:44:31 -08:00
autopilot_test.go tests: give up on TestAutopilot_CleanupStaleRaftServer for now 2019-09-04 09:10:53 -04:00
blocked_evals.go blocked_evals reset system evals on Flush 2019-07-18 10:32:13 -04:00
blocked_evals_system.go blocked_evals system evals indexed by job and node 2019-07-18 10:32:12 -04:00
blocked_evals_test.go blocked_evals_test disable calls Flush 2019-07-18 10:32:13 -04:00
client_alloc_endpoint.go acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
client_alloc_endpoint_test.go acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
client_fs_endpoint.go acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
client_fs_endpoint_test.go acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
client_rpc.go server 2018-09-15 16:23:13 -07:00
client_rpc_test.go tests: update time sensitive tests 2019-09-04 08:45:25 -04:00
client_stats_endpoint.go server 2018-09-15 16:23:13 -07:00
client_stats_endpoint_test.go fix tests that fail as a result of async client startup 2018-12-20 00:53:44 -05:00
config.go default raft protocol v2 2019-09-24 14:37:55 -04:00
core_sched.go core_sched add compat comment for later removal 2019-07-10 13:56:20 -04:00
core_sched_test.go Don't GC running but desired stop allocations 2018-12-05 13:01:12 -08:00
deployment_endpoint.go acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
deployment_endpoint_test.go Fix tests 2018-05-07 14:50:01 -05:00
deployment_watcher_shims.go Fix typos 2018-05-07 14:50:01 -05:00
drainer_int_test.go tests: fix usages of TestClient cleanup and mock driver 2018-10-29 14:21:05 -07:00
drainer_shims.go set node.StatusUpdatedAt in raft 2019-05-21 16:13:32 -04:00
endpoints_oss.go
eval_broker.go nomad: refactor waitForIndex into SnapshotAfter 2019-05-17 13:30:23 -07:00
eval_broker_test.go evalbroker: test for no enqueue on disabled 2019-05-15 11:02:21 +02:00
eval_endpoint.go acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
eval_endpoint_test.go Update nomad/eval_endpoint_test.go 2019-03-05 15:19:15 -08:00
fsm.go fsm attach UnblockNode on node updates 2019-07-18 10:32:12 -04:00
fsm_not_ent.go
fsm_registry_oss.go
fsm_test.go NodeDeregisterBatch -> NodeBatchDeregister match JobBatch pattern 2019-07-10 13:56:20 -04:00
heartbeat.go goimports 2019-01-22 15:44:31 -08:00
heartbeat_test.go Fix raft tests 2019-09-03 14:53:29 -04:00
job_endpoint.go use RequestNamespace(), the canonical way to get namespace 2019-09-27 07:40:58 -04:00
job_endpoint_hook_connect.go connect: add unix socket to proxy grpc for envoy (#6232) 2019-09-03 08:43:38 -07:00
job_endpoint_hook_connect_test.go Builtin Admission Controller Framework (#6116) 2019-08-15 11:22:37 -04:00
job_endpoint_hooks.go Builtin Admission Controller Framework (#6116) 2019-08-15 11:22:37 -04:00
job_endpoint_oss.go
job_endpoint_test.go nomad: defensive check for namespaces in job registration call 2019-09-26 17:02:47 -04:00
leader.go Merge pull request #5911 from hashicorp/b-rpc-consistent-reads 2019-08-20 09:29:37 -04:00
leader_oss.go
leader_test.go Fix raft tests 2019-09-03 14:53:29 -04:00
merge.go
node_endpoint.go add create and modify timestamps to evaluations (#5881) 2019-08-07 09:50:35 -07:00
node_endpoint_test.go add create and modify timestamps to evaluations (#5881) 2019-08-07 09:50:35 -07:00
operator_endpoint.go Add code for plan normalization 2019-04-23 09:18:01 -07:00
operator_endpoint_test.go update tests to run with v2 2019-08-28 16:42:08 -04:00
periodic.go add create and modify timestamps to evaluations (#5881) 2019-08-07 09:50:35 -07:00
periodic_endpoint.go goimports 2019-01-22 15:44:31 -08:00
periodic_endpoint_test.go test: fix race and nil panic in nomad/ tests 2018-12-19 15:48:02 -08:00
periodic_test.go server 2018-09-15 16:23:13 -07:00
plan_apply.go add create and modify timestamps to evaluations (#5881) 2019-08-07 09:50:35 -07:00
plan_apply_not_ent.go
plan_apply_pool.go
plan_apply_pool_test.go
plan_apply_test.go tests: update time sensitive tests 2019-09-04 08:45:25 -04:00
plan_endpoint.go goimports 2019-01-22 15:44:31 -08:00
plan_endpoint_test.go goimports 2019-01-22 15:44:31 -08:00
plan_normalization_test.go Add comments to functions, and use require instead of assert 2019-04-23 09:57:21 -07:00
plan_queue.go nomad: refactor waitForIndex into SnapshotAfter 2019-05-17 13:30:23 -07:00
plan_queue_test.go
raft_rpc.go
regions_endpoint.go server 2018-09-15 16:23:13 -07:00
regions_endpoint_test.go goimports 2019-01-22 15:44:31 -08:00
rpc.go Merge pull request #5911 from hashicorp/b-rpc-consistent-reads 2019-08-20 09:29:37 -04:00
rpc_test.go Merge pull request #5911 from hashicorp/b-rpc-consistent-reads 2019-08-20 09:29:37 -04:00
search_endpoint.go server 2018-09-15 16:23:13 -07:00
search_endpoint_oss.go
search_endpoint_test.go
serf.go do not bootstrap with non voters 2018-09-19 17:17:39 -07:00
serf_test.go backfill region from job hcl in jobUpdate and jobPlan endpoints 2019-06-13 08:03:16 -07:00
server.go nomad/server comments 2019-09-24 14:36:18 -04:00
server_setup_oss.go server 2018-09-15 16:23:13 -07:00
server_test.go backfill region from job hcl in jobUpdate and jobPlan endpoints 2019-06-13 08:03:16 -07:00
stats_fetcher.go server 2018-09-15 16:23:13 -07:00
stats_fetcher_test.go
status_endpoint.go server 2018-09-15 16:23:13 -07:00
status_endpoint_test.go goimports 2019-01-22 15:44:31 -08:00
system_endpoint.go server 2018-09-15 16:23:13 -07:00
system_endpoint_test.go goimports 2019-01-22 15:44:31 -08:00
testing.go tests: disable server auto join by default 2019-09-04 07:54:54 -04:00
timetable.go
timetable_test.go
util.go acl: check ACL against object namespace 2019-10-08 12:59:22 -04:00
util_test.go util partitionAll for paging 2019-07-10 13:56:19 -04:00
vault.go Merge pull request #6082 from hashicorp/b-vault-deadlock 2019-08-06 15:30:17 -07:00
vault_test.go vault: fix deadlock in SetConfig 2019-08-06 10:40:14 -07:00
vault_testing.go nomad: refactor waitForIndex into SnapshotAfter 2019-05-17 13:30:23 -07:00
worker.go add create and modify timestamps to evaluations (#5881) 2019-08-07 09:50:35 -07:00
worker_test.go nomad: SnapshotAfter -> SnapshotMinIndex 2019-06-24 12:16:46 -07:00