{"action":"created","issue":{"url":"https://api.github.com/repos/dcos/dcos/issues/3449","repository_url":"https://api.github.com/repos/dcos/dcos","labels_url":"https://api.github.com/repos/dcos/dcos/issues/3449/labels{/name}","comments_url":"https://api.github.com/repos/dcos/dcos/issues/3449/comments","events_url":"https://api.github.com/repos/dcos/dcos/issues/3449/events","html_url":"https://github.com/dcos/dcos/pull/3449","id":360930971,"node_id":"MDExOlB1bGxSZXF1ZXN0MjE2MDI4ODUy","number":3449,"title":"Add root capabilities to dcos-diagnostics","user":{"login":"janisz","id":1616386,"node_id":"MDQ6VXNlcjE2MTYzODY=","avatar_url":"https://avatars0.githubusercontent.com/u/1616386?v=4","gravatar_id":"","url":"https://api.github.com/users/janisz","html_url":"https://github.com/janisz","followers_url":"https://api.github.com/users/janisz/followers","following_url":"https://api.github.com/users/janisz/following{/other_user}","gists_url":"https://api.github.com/users/janisz/gists{/gist_id}","starred_url":"https://api.github.com/users/janisz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/janisz/subscriptions","organizations_url":"https://api.github.com/users/janisz/orgs","repos_url":"https://api.github.com/users/janisz/repos","events_url":"https://api.github.com/users/janisz/events{/privacy}","received_events_url":"https://api.github.com/users/janisz/received_events","type":"User","site_admin":false},"labels":[{"id":364878184,"node_id":"MDU6TGFiZWwzNjQ4NzgxODQ=","url":"https://api.github.com/repos/dcos/dcos/labels/Ready%20For%20Review","name":"Ready For Review","color":"0e8a16","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2018-09-17T15:46:27Z","updated_at":"2018-09-25T07:28:44Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/dcos/dcos/pulls/3449","html_url":"https://github.com/dcos/dcos/pull/3449","diff_url":"https://github.com/dcos/dcos/pull/3449.diff","patch_url":"https://github.com/dcos/dcos/pull/3449.patch"},"body":"## High-level description\r\n\r\nWith capabilities we can run root-only commands as a normal user. \r\n\r\nSee: \r\n* https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Capabilities\r\n* http://man7.org/linux/man-pages/man7/capabilities.7.html\r\n\r\n\r\n## Corresponding DC/OS tickets (obligatory)\r\n\r\nThese DC/OS JIRA ticket(s) must be updated (ideally closed) in the moment this PR lands:\r\n\r\n  - [DCOS_OSS-3877](https://jira.mesosphere.com/browse/DCOS_OSS-3877) \r\n  - [DCOS_OSS-4138](https://jira.mesosphere.com/browse/DCOS_OSS-4138) "},"comment":{"url":"https://api.github.com/repos/dcos/dcos/issues/comments/424236267","html_url":"https://github.com/dcos/dcos/pull/3449#issuecomment-424236267","issue_url":"https://api.github.com/repos/dcos/dcos/issues/3449","id":424236267,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNDIzNjI2Nw==","user":{"login":"gpaul","id":442,"node_id":"MDQ6VXNlcjQ0Mg==","avatar_url":"https://avatars1.githubusercontent.com/u/442?v=4","gravatar_id":"","url":"https://api.github.com/users/gpaul","html_url":"https://github.com/gpaul","followers_url":"https://api.github.com/users/gpaul/followers","following_url":"https://api.github.com/users/gpaul/following{/other_user}","gists_url":"https://api.github.com/users/gpaul/gists{/gist_id}","starred_url":"https://api.github.com/users/gpaul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gpaul/subscriptions","organizations_url":"https://api.github.com/users/gpaul/orgs","repos_url":"https://api.github.com/users/gpaul/repos","events_url":"https://api.github.com/users/gpaul/events{/privacy}","received_events_url":"https://api.github.com/users/gpaul/received_events","type":"User","site_admin":false},"created_at":"2018-09-25T07:28:44Z","updated_at":"2018-09-25T07:28:44Z","author_association":"CONTRIBUTOR","body":"This PR does not impact the ultimate security of this project:\r\n- `dcos-rexray.service` runs as `root`.\r\n- `dcos-net.service` runs as `root`.\r\n- `dcos-pkgpanda-api.service` runs as `root`.\r\n\r\nUsing `capabilities` instead of just running dcos-diagnostics as `root` introduces a maintenance burden by haphazardly introducing `capabilitites` into DC/OS. There is no prior art.\r\n\r\nWhat we see here is good folks seeing a bad practice and wanting to do the best we can. That's clearly a good thing. However, deciding to switch from `User=root` to a separate mechanism needs careful consideration. Capabilities are probably _not_ the answer given how quickly (the first PR!) we had to reach for `CAP_SYS_ADMIN`. The security PM and security team should carefully research alternatives like `selinux`, custom binaries (like @lloesche suggested), etc.\r\n\r\nLet's not block a very useful PR which makes DC/OS significantly easier to debug with what are essentially feature requests for tighter security.\r\n\r\nMy recommendation, given the prior art in this project, is:\r\n- Create a COPS ticket assigned to the security team to implement a solution that works _for all components_ instead of introducing a new technique in a lonely corner of the project. I've created this COPS ticket here: https://jira.mesosphere.com/browse/COPS-3847\r\n- Switch this PR to run the service as `root`. This simplifies maintenance by sticking to prior art. Also, capabilities don't work for this use case: the moment you need to reach for CAP_SYS_ADMIN you're doomed.\r\n- Concentrate our well-deserved skepticism and improved designs in COPS-3847 where they can be referenced in future and help form the basis of a project-wide strategy instead. \r\n- Ship this PR ASAP"}}
{"actor":{"display_login":"gpaul"}}