add note about AllocNodeExec permission

client/alloc_endpoint.go

@@ -114,6 +114,7 @@ func (a *Allocations) exec(conn io.ReadWriteCloser) {
 		handleStreamResultError(err, nil, encoder)
 		return
 	} else if aclObj != nil {
+		// FIXME: check for AllocNodeExec if task is raw_exec
 		exec := aclObj.AllowNsOp(req.QueryOptions.Namespace, acl.NamespaceCapabilityAllocExec)
 		if !exec {
 			handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)

nomad/client_alloc_endpoint.go

@@ -212,6 +212,7 @@ func (a *ClientAllocations) exec(conn io.ReadWriteCloser) {
 		handleStreamResultError(err, nil, encoder)
 		return
 	} else if aclObj != nil {
+		// FIXME: check for AllocNodeExec if task is raw_exec
 		exec := aclObj.AllowNsOp(args.QueryOptions.Namespace, acl.NamespaceCapabilityAllocExec)
 		if !exec {
 			handleStreamResultError(structs.ErrPermissionDenied, nil, encoder)