client: disable running artifact downloader as nobody #16375
Conversation
This PR reverts a change from Nomad 1.5 where artifact downloads were executed as the nobody user on Linux systems. This was done as an attempt to improve the security model of artifact downloading where third party tools such as git or mercurial would be run as the root user with all the security implications thereof. However, doing so conflicts with Nomad's own advice for securing the Client data directory - which when setup with the recommended directory permissions structure prevents artifact downloads from working as intended. Artifact downloads are at least still now executed as a child process of the Nomad agent, and on modern Linux systems make use of the kernel Landlock feature for limiting filesystem access of the child process.
|
Are set_environment_variables and disable_filesystem_isolation artifact client config entries obsolete once this lands? |
|
Hi @bfqrst, those two config values will still be relevant. The artifact downloader is still running as a child process with a limited environment - the |
|
Spot check on an e2e instance created with #16399 job filejob "example" {
group "cache" {
network {
port "db" {
to = 6379
}
}
task "redis" {
driver = "docker"
artifact {
source = "https://github.com/shoenig/ssh-key-sync/releases/download/v1.7.0/ssh-key-sync_1.7.0_linux_amd64.tar.gz"
destination = "local/"
}
config {
image = "redis:7"
ports = ["db"]
auth_soft_fail = true
}
identity {
env = true
file = true
}
resources {
cpu = 500
memory = 256
}
}
}
}node has expected directory structure Inspect that the downloaded artifact is owned by And finally passing full |
shoenig
force-pushed
the
no-more-mr-nobody
branch
from
8a7c839 to
5ba49a1
Compare
Thanks for the clarification @shoenig, that makes sense! And seeing the |
|
This is in the |
|
Hi @jeffawang, this particular change is in 1.5.1; in 1.5.2 we fixed more bugs related to artifact sandboxing, but specific to downloading artifacts using git-ssh. |
This PR reverts a change from Nomad 1.5 where artifact downloads were
executed as the nobody user on Linux systems. This was done as an attempt
to improve the security model of artifact downloading where third party
tools such as git or mercurial would be run as the root user with all
the security implications thereof.
However, doing so conflicts with Nomad's own advice for securing the
Client data directory - which when setup with the recommended directory
permissions structure prevents artifact downloads from working as intended.
Artifact downloads are at least still now executed as a child process of
the Nomad agent, and on modern Linux systems make use of the kernel Landlock
feature for limiting filesystem access of the child process.
Note: the tests for this is really the bank of artifact e2e test cases