File tree Expand file tree Collapse file tree 2 files changed +12
-10
lines changed
Expand file tree Collapse file tree 2 files changed +12
-10
lines changed Original file line number Diff line number Diff line change @@ -487,10 +487,11 @@ refer to the [drivers documentation](/nomad/docs/drivers).
487487
488488### ` template ` Parameters
489489
490- - ` function_denylist ` ` ([]string: ["plugin", "writeToFile"]) ` - Specifies a
491- list of template rendering functions that should be disallowed in job specs.
492- By default the ` plugin ` and ` writeToFile ` functions are disallowed as they
493- allow unrestricted root access to the host.
490+ - ` function_denylist ` `([ ] string: [ "plugin", "executeTemplate",
491+ "writeToFile"] )` - Specifies a list of template rendering functions that
492+ should be disallowed in job specs. By default the ` plugin ` , ` executeTemplate `
493+ and ` writeToFile ` functions are disallowed as they allow unrestricted root
494+ access to the host or allow recursive execution.
494495
495496- ` disable_file_sandbox ` ` (bool: false) ` - Allows templates access to arbitrary
496497 files on the client host via the ` file ` function. By default, templates can
Original file line number Diff line number Diff line change @@ -789,12 +789,13 @@ access it by index. This secret was set using
789789The `template` block has the following [client configuration
790790options](/nomad/docs/configuration/client#options):
791791
792- - `function_denylist` `([]string: ["plugin"])` - Specifies a list of template
793- rendering functions that should be disallowed in job specs. By default, the
794- `plugin` function is disallowed as it allows running arbitrary commands on the
795- host as root (unless Nomad is configured to run as a non-root user),
796- `executeTemplate` is disallowed to prevent accidental or malicious infinitely
797- recursive execution, and `writeToFile` is disallowed.
792+ - `function_denylist` `([]string: ["plugin", " executeTemplate" ,
793+ " writeToFile" ])` - Specifies a list of template rendering functions that
794+ should be disallowed in job specs. By default, the `plugin` function is
795+ disallowed as it allows running arbitrary commands on the host as root (unless
796+ Nomad is configured to run as a non-root user), `executeTemplate` is
797+ disallowed to prevent accidental or malicious infinitely recursive execution,
798+ and `writeToFile` is disallowed.
798799
799800- `disable_file_sandbox` `(bool: false)` - Allows templates access to arbitrary
800801 files on the client host via the `file` function. By default, templates can
You can’t perform that action at this time.
0 commit comments