hashicorp / hashicorp/nomad

permissions for CSI volume mounted to `exec` driver don't allow task's user

Open
#15,540 6 comments 2 reactions 0 assignees View on GitHub
theme/driver/exec theme/storage type/bug
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Nomad version
> Nomad v1.4.3 (f464aca721d222ae9c1f3df643b3c3aaa20e2da7)

### Operating system and Environment details
Fedora 36 (Server)

### Issue
Using CSI volume mounted in the task started using `exec` driver is impossible due to mount point being owned by root with 0755 permissions.

### Reproduction steps
* Ceph 3 node cluster
* Nomad configured using https://docs.ceph.com/en/latest/rbd/rbd-nomad/#create-a-pool
* Volume created with RW permission as "file-system"
* Job with `exec` driver that mounts above volume with `read_only = false`

#### Expected Result
* Mount point is owned by the same user as the one inside the namespace (default `nobody`)
* OR mount point is otherwise made write-able (i.e. setting permissions)

#### Actual Result
* Mount point is owned by root and uses 0755 permissions. Hence default `nobody` user can't use it.

#### Note
I'd consider this a bug since there is no clear way to use CSI volumes with `exec` driver other than running process as `root`.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with Nomad's exec driver and CSI volume mount handling, then reproduce the Fedora 36 setup with a non-root task user and a writable Ceph-backed volume. Trace where the mount point ownership and 0755 permissions are established. Done means the task user can write to a read-write CSI volume without requiring root, with regression coverage if the relevant tests are found.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.