{"action":"created","comment":{"url":"https://api.github.com/repos/appc/spec/pulls/comments/32471365","id":32471365,"diff_hunk":"@@ -49,6 +51,14 @@ Volumes that are specified in the Pod Manifest are mounted into each of the apps\n For example, say that the worker-backup and reduce-worker both have a `mountPoint` named \"work\".\n In this case, the executor will bind mount the host's `/opt/tenant1/work` directory into the `path` of each of the matching \"work\" `mountPoint`s of the two app filesystems.\n \n+If the target `path` does not exist in the rendered filesystem, it SHOULD be created, including any missing parent directories. If the target `path` is a non-empty directory, its contents SHOULD be discarded (e.g. obscured by the bind mount). If the target `path` refers to a file, ACE SHOULD remove that file and create a directory in its place.\n+\n+Mount point `path` directories that ACE creates SHOULD be owned by UID 0 and GID 0, and have access mode `0755` (`rwxr-xr-xr-x`). ACE implementation MAY provide a method for administrator to specify different permissions on a per-pod basis.\n+\n+ACE MUST NOT create any paths in the host file system, and is REQUIRED to consider missing volume source paths as an error. If an underlying operating system supports it ACE MAY implement single-file volumes.","path":"spec/ace.md","position":24,"original_position":23,"commit_id":"0fc11dc91ae10b3a9483a9dcb8878d725a82fec6","original_commit_id":"ede6d4936a7cba48033c2d257e33edc1b522bb87","user":{"login":"jonboulle","id":2601015,"avatar_url":"https://avatars.githubusercontent.com/u/2601015?v=3","gravatar_id":"","url":"https://api.github.com/users/jonboulle","html_url":"https://github.com/jonboulle","followers_url":"https://api.github.com/users/jonboulle/followers","following_url":"https://api.github.com/users/jonboulle/following{/other_user}","gists_url":"https://api.github.com/users/jonboulle/gists{/gist_id}","starred_url":"https://api.github.com/users/jonboulle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonboulle/subscriptions","organizations_url":"https://api.github.com/users/jonboulle/orgs","repos_url":"https://api.github.com/users/jonboulle/repos","events_url":"https://api.github.com/users/jonboulle/events{/privacy}","received_events_url":"https://api.github.com/users/jonboulle/received_events","type":"User","site_admin":false},"body":"> If ACE can be tricked into actively altering host filesystem, this may lead to security vulnerabilities. \r\n\r\nI would prefer this be downgraded to a SHOULD because there are legitimate use cases for this behaviour and I don't think we should necessarily preclude them in the spec. I'm happy with the addition you suggest.","created_at":"2015-06-15T21:53:27Z","updated_at":"2015-06-15T21:53:27Z","html_url":"https://github.com/appc/spec/pull/431#discussion_r32471365","pull_request_url":"https://api.github.com/repos/appc/spec/pulls/431","_links":{"self":{"href":"https://api.github.com/repos/appc/spec/pulls/comments/32471365"},"html":{"href":"https://github.com/appc/spec/pull/431#discussion_r32471365"},"pull_request":{"href":"https://api.github.com/repos/appc/spec/pulls/431"}}},"pull_request":{"url":"https://api.github.com/repos/appc/spec/pulls/431","id":37469997,"html_url":"https://github.com/appc/spec/pull/431","diff_url":"https://github.com/appc/spec/pull/431.diff","patch_url":"https://github.com/appc/spec/pull/431.patch","issue_url":"https://api.github.com/repos/appc/spec/issues/431","number":431,"state":"open","locked":false,"title":"spec: app filesystem clarifications","user":{"login":"mpasternacki","id":56355,"avatar_url":"https://avatars.githubusercontent.com/u/56355?v=3","gravatar_id":"","url":"https://api.github.com/users/mpasternacki","html_url":"https://github.com/mpasternacki","followers_url":"https://api.github.com/users/mpasternacki/followers","following_url":"https://api.github.com/users/mpasternacki/following{/other_user}","gists_url":"https://api.github.com/users/mpasternacki/gists{/gist_id}","starred_url":"https://api.github.com/users/mpasternacki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpasternacki/subscriptions","organizations_url":"https://api.github.com/users/mpasternacki/orgs","repos_url":"https://api.github.com/users/mpasternacki/repos","events_url":"https://api.github.com/users/mpasternacki/events{/privacy}","received_events_url":"https://api.github.com/users/mpasternacki/received_events","type":"User","site_admin":false},"body":"- Rephrase ACI dependencies unpacking (hopefully fixes #425)\n - Clarify behaviour of mount points: nonexistent mount points are created, existing files are removed, existing directories' contents are discarded\n - Specify that symlinks are not a valid volume source (to protect against attacks on host)\n - Add explicit reference to RFC2119 in SPEC.md","created_at":"2015-06-11T14:36:16Z","updated_at":"2015-06-15T21:53:27Z","closed_at":null,"merged_at":null,"merge_commit_sha":"c43ee641bb5f60f140415b12712f686bb59fa32f","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/appc/spec/pulls/431/commits","review_comments_url":"https://api.github.com/repos/appc/spec/pulls/431/comments","review_comment_url":"https://api.github.com/repos/appc/spec/pulls/comments{/number}","comments_url":"https://api.github.com/repos/appc/spec/issues/431/comments","statuses_url":"https://api.github.com/repos/appc/spec/statuses/0fc11dc91ae10b3a9483a9dcb8878d725a82fec6","head":{"label":"3ofcoins:dependencies-unpacking","ref":"dependencies-unpacking","sha":"0fc11dc91ae10b3a9483a9dcb8878d725a82fec6","user":{"login":"3ofcoins","id":1698837,"avatar_url":"https://avatars.githubusercontent.com/u/1698837?v=3","gravatar_id":"","url":"https://api.github.com/users/3ofcoins","html_url":"https://github.com/3ofcoins","followers_url":"https://api.github.com/users/3ofcoins/followers","following_url":"https://api.github.com/users/3ofcoins/following{/other_user}","gists_url":"https://api.github.com/users/3ofcoins/gists{/gist_id}","starred_url":"https://api.github.com/users/3ofcoins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/3ofcoins/subscriptions","organizations_url":"https://api.github.com/users/3ofcoins/orgs","repos_url":"https://api.github.com/users/3ofcoins/repos","events_url":"https://api.github.com/users/3ofcoins/events{/privacy}","received_events_url":"https://api.github.com/users/3ofcoins/received_events","type":"Organization","site_admin":false},"repo":{"id":27829295,"name":"appc-spec","full_name":"3ofcoins/appc-spec","owner":{"login":"3ofcoins","id":1698837,"avatar_url":"https://avatars.githubusercontent.com/u/1698837?v=3","gravatar_id":"","url":"https://api.github.com/users/3ofcoins","html_url":"https://github.com/3ofcoins","followers_url":"https://api.github.com/users/3ofcoins/followers","following_url":"https://api.github.com/users/3ofcoins/following{/other_user}","gists_url":"https://api.github.com/users/3ofcoins/gists{/gist_id}","starred_url":"https://api.github.com/users/3ofcoins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/3ofcoins/subscriptions","organizations_url":"https://api.github.com/users/3ofcoins/orgs","repos_url":"https://api.github.com/users/3ofcoins/repos","events_url":"https://api.github.com/users/3ofcoins/events{/privacy}","received_events_url":"https://api.github.com/users/3ofcoins/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/3ofcoins/appc-spec","description":"App Container Specification and Tooling","fork":true,"url":"https://api.github.com/repos/3ofcoins/appc-spec","forks_url":"https://api.github.com/repos/3ofcoins/appc-spec/forks","keys_url":"https://api.github.com/repos/3ofcoins/appc-spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/3ofcoins/appc-spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/3ofcoins/appc-spec/teams","hooks_url":"https://api.github.com/repos/3ofcoins/appc-spec/hooks","issue_events_url":"https://api.github.com/repos/3ofcoins/appc-spec/issues/events{/number}","events_url":"https://api.github.com/repos/3ofcoins/appc-spec/events","assignees_url":"https://api.github.com/repos/3ofcoins/appc-spec/assignees{/user}","branches_url":"https://api.github.com/repos/3ofcoins/appc-spec/branches{/branch}","tags_url":"https://api.github.com/repos/3ofcoins/appc-spec/tags","blobs_url":"https://api.github.com/repos/3ofcoins/appc-spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/3ofcoins/appc-spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/3ofcoins/appc-spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/3ofcoins/appc-spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/3ofcoins/appc-spec/statuses/{sha}","languages_url":"https://api.github.com/repos/3ofcoins/appc-spec/languages","stargazers_url":"https://api.github.com/repos/3ofcoins/appc-spec/stargazers","contributors_url":"https://api.github.com/repos/3ofcoins/appc-spec/contributors","subscribers_url":"https://api.github.com/repos/3ofcoins/appc-spec/subscribers","subscription_url":"https://api.github.com/repos/3ofcoins/appc-spec/subscription","commits_url":"https://api.github.com/repos/3ofcoins/appc-spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/3ofcoins/appc-spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/3ofcoins/appc-spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/3ofcoins/appc-spec/issues/comments{/number}","contents_url":"https://api.github.com/repos/3ofcoins/appc-spec/contents/{+path}","compare_url":"https://api.github.com/repos/3ofcoins/appc-spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/3ofcoins/appc-spec/merges","archive_url":"https://api.github.com/repos/3ofcoins/appc-spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/3ofcoins/appc-spec/downloads","issues_url":"https://api.github.com/repos/3ofcoins/appc-spec/issues{/number}","pulls_url":"https://api.github.com/repos/3ofcoins/appc-spec/pulls{/number}","milestones_url":"https://api.github.com/repos/3ofcoins/appc-spec/milestones{/number}","notifications_url":"https://api.github.com/repos/3ofcoins/appc-spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/3ofcoins/appc-spec/labels{/name}","releases_url":"https://api.github.com/repos/3ofcoins/appc-spec/releases{/id}","created_at":"2014-12-10T16:46:14Z","updated_at":"2015-02-09T13:49:05Z","pushed_at":"2015-06-11T20:28:14Z","git_url":"git://github.com/3ofcoins/appc-spec.git","ssh_url":"git@github.com:3ofcoins/appc-spec.git","clone_url":"https://github.com/3ofcoins/appc-spec.git","svn_url":"https://github.com/3ofcoins/appc-spec","homepage":null,"size":1186,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"appc:master","ref":"master","sha":"3241a8b2357976580e7671fa01b93b612d69da72","user":{"login":"appc","id":10080092,"avatar_url":"https://avatars.githubusercontent.com/u/10080092?v=3","gravatar_id":"","url":"https://api.github.com/users/appc","html_url":"https://github.com/appc","followers_url":"https://api.github.com/users/appc/followers","following_url":"https://api.github.com/users/appc/following{/other_user}","gists_url":"https://api.github.com/users/appc/gists{/gist_id}","starred_url":"https://api.github.com/users/appc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/appc/subscriptions","organizations_url":"https://api.github.com/users/appc/orgs","repos_url":"https://api.github.com/users/appc/repos","events_url":"https://api.github.com/users/appc/events{/privacy}","received_events_url":"https://api.github.com/users/appc/received_events","type":"Organization","site_admin":false},"repo":{"id":27782596,"name":"spec","full_name":"appc/spec","owner":{"login":"appc","id":10080092,"avatar_url":"https://avatars.githubusercontent.com/u/10080092?v=3","gravatar_id":"","url":"https://api.github.com/users/appc","html_url":"https://github.com/appc","followers_url":"https://api.github.com/users/appc/followers","following_url":"https://api.github.com/users/appc/following{/other_user}","gists_url":"https://api.github.com/users/appc/gists{/gist_id}","starred_url":"https://api.github.com/users/appc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/appc/subscriptions","organizations_url":"https://api.github.com/users/appc/orgs","repos_url":"https://api.github.com/users/appc/repos","events_url":"https://api.github.com/users/appc/events{/privacy}","received_events_url":"https://api.github.com/users/appc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/appc/spec","description":"App Container Specification and Tooling","fork":false,"url":"https://api.github.com/repos/appc/spec","forks_url":"https://api.github.com/repos/appc/spec/forks","keys_url":"https://api.github.com/repos/appc/spec/keys{/key_id}","collaborators_url":"https://api.github.com/repos/appc/spec/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/appc/spec/teams","hooks_url":"https://api.github.com/repos/appc/spec/hooks","issue_events_url":"https://api.github.com/repos/appc/spec/issues/events{/number}","events_url":"https://api.github.com/repos/appc/spec/events","assignees_url":"https://api.github.com/repos/appc/spec/assignees{/user}","branches_url":"https://api.github.com/repos/appc/spec/branches{/branch}","tags_url":"https://api.github.com/repos/appc/spec/tags","blobs_url":"https://api.github.com/repos/appc/spec/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/appc/spec/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/appc/spec/git/refs{/sha}","trees_url":"https://api.github.com/repos/appc/spec/git/trees{/sha}","statuses_url":"https://api.github.com/repos/appc/spec/statuses/{sha}","languages_url":"https://api.github.com/repos/appc/spec/languages","stargazers_url":"https://api.github.com/repos/appc/spec/stargazers","contributors_url":"https://api.github.com/repos/appc/spec/contributors","subscribers_url":"https://api.github.com/repos/appc/spec/subscribers","subscription_url":"https://api.github.com/repos/appc/spec/subscription","commits_url":"https://api.github.com/repos/appc/spec/commits{/sha}","git_commits_url":"https://api.github.com/repos/appc/spec/git/commits{/sha}","comments_url":"https://api.github.com/repos/appc/spec/comments{/number}","issue_comment_url":"https://api.github.com/repos/appc/spec/issues/comments{/number}","contents_url":"https://api.github.com/repos/appc/spec/contents/{+path}","compare_url":"https://api.github.com/repos/appc/spec/compare/{base}...{head}","merges_url":"https://api.github.com/repos/appc/spec/merges","archive_url":"https://api.github.com/repos/appc/spec/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/appc/spec/downloads","issues_url":"https://api.github.com/repos/appc/spec/issues{/number}","pulls_url":"https://api.github.com/repos/appc/spec/pulls{/number}","milestones_url":"https://api.github.com/repos/appc/spec/milestones{/number}","notifications_url":"https://api.github.com/repos/appc/spec/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/appc/spec/labels{/name}","releases_url":"https://api.github.com/repos/appc/spec/releases{/id}","created_at":"2014-12-09T19:17:54Z","updated_at":"2015-06-15T14:08:44Z","pushed_at":"2015-06-15T21:44:18Z","git_url":"git://github.com/appc/spec.git","ssh_url":"git@github.com:appc/spec.git","clone_url":"https://github.com/appc/spec.git","svn_url":"https://github.com/appc/spec","homepage":null,"size":2849,"stargazers_count":676,"watchers_count":676,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":87,"mirror_url":null,"open_issues_count":100,"forks":87,"open_issues":100,"watchers":676,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/appc/spec/pulls/431"},"html":{"href":"https://github.com/appc/spec/pull/431"},"issue":{"href":"https://api.github.com/repos/appc/spec/issues/431"},"comments":{"href":"https://api.github.com/repos/appc/spec/issues/431/comments"},"review_comments":{"href":"https://api.github.com/repos/appc/spec/pulls/431/comments"},"review_comment":{"href":"https://api.github.com/repos/appc/spec/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/appc/spec/pulls/431/commits"},"statuses":{"href":"https://api.github.com/repos/appc/spec/statuses/0fc11dc91ae10b3a9483a9dcb8878d725a82fec6"}}}}