This is an automated email from the ASF dual-hosted git repository.
smengcl pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new a65a32e7c4b HDDS-16800. Add availability to THREAT_MODEL.md (#11451)
a65a32e7c4b is described below
commit a65a32e7c4bc246515742f08487c7fe6060e743f
Author: Siyao Meng <[email protected]>
AuthorDate: Mon Oct 12 12:10:59 2026 -0700
HDDS-16800. Add availability to THREAT_MODEL.md (#11451)
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
THREAT_MODEL.md | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index bbc943054b8..6fcace08428 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -9,6 +9,7 @@
- **Author:** ASF Security team, via the threat-model-producer rubric (Scovetta
rubric) at the Ozone PMC's request (path 3, confirmed siyao@ 2026-06-02).
- **Status:** v1 — ratified by the Ozone PMC. Maintainer review complete
(Siyao Meng / smengcl and Wei-Chiu Chuang / jojochuang, 2026-06/07); wave-1–3
answers folded.
+- **Revisions:** 2026-10, availability added (§4, §7, §8 item 7, §9, §10,
§11a, §13).
- **Version binding:** versioned with the project; a report against version *N*
is triaged against the model as it stood at *N*.
- **Reporting cross-reference:** §8-violating findings go to
@@ -115,7 +116,8 @@ owns that boundary — an S3-Gateway finding from an
untrusted REST client; an
OM/SCM finding from an authenticated-but-unauthorized user; a block-access
finding from a client without a valid token in a token-enabled deployment; a
consensus finding from a Byzantine Datanode peer below the honest-majority
-threshold (§7).
+threshold (§7); an availability finding from an untrusted client or an
+authenticated non-admin user, with a small, fixed number of requests (§8 item
7).
## §5 Assumptions about the environment
@@ -223,6 +225,7 @@ Per-boundary input trust (grouped by family):
- **Authenticated-but-unauthorized user** — a valid Kerberos principal who
tries to exceed their ACLs (read another bucket, escalate). In scope —
authorization is the defence.
+- **Client attacking availability.** An untrusted client, or an authenticated
non-admin user acting *within* their ACLs, who uses a small, fixed number of
requests to stop a service for everyone else. In scope (§8 item 7). Attacks
that depend on request volume are not (§9). *(maintainer, smengcl, 2026-10.)*
- **On-path network attacker** — passive/active on the wire. In scope where the
deployment has enabled transport encryption for the relevant protocol.
- **Authenticated-but-Byzantine Datanode peer** — a compromised Datanode
holding
@@ -237,7 +240,9 @@ Per-boundary input trust (grouped by family):
on the path it serves**. *(maintainer — smengcl, 2026-06-23; checksum
behaviour documented in
[ozone-site#397](https://github.com/apache/ozone-site/pull/397).)*
- **Out of scope:** compromised KDC / Ranger / SCM-CA-key / operator host;
side-channel/co-tenant adversaries against the host; a client that an
operator
- has authorized to do the thing it did.
+ has authorized to do the thing it did. That exclusion covers the intended
+ effect of an authorized operation. It does not cover a service failure caused
+ by an operation a non-admin user was permitted to make (§8 item 7).
## §8 Security properties the project provides (secure mode)
@@ -273,6 +278,7 @@ Per-boundary input trust (grouped by family):
rest when enabled (keys in KMS). *Violation:* plaintext on a transport
configured for encryption / unencrypted blocks when TDE is configured.
*Severity:* high. *(documented — protect-in-transit-traffic, SecuringTDE.)*
+7. **Availability under a small, fixed number of requests.** A small, fixed
number of requests from an untrusted client or an authenticated non-admin user
does not terminate or hang an Ozone service process, and does not leave the
service unable to serve other users. "Small, fixed" means the effect comes from
what a request makes the server do, not from how many requests are sent. "Hang"
means the process stays up but stops making progress for other users, for
example a deadlock, a livel [...]
## §9 Security properties the project does *not* provide
@@ -298,6 +304,9 @@ Per-boundary input trust (grouped by family):
on the path it serves** — Ratis is not BFT, and while checksum +
replica/container
checks catch ordinary corruption, a peer that can forge consistently on its
served path is out of model (§7). *(maintainer — smengcl, 2026-06-23.)*
+- **No promise to withstand load by volume.** Request floods, connection
exhaustion, and many concurrent requests whose cost the server already limits
are outside §8 item 7. Limiting them is the operator's (§10). Concurrent
requests whose cost the caller chooses are not load by volume and stay under §8
item 7. *(maintainer, smengcl, 2026-10.)*
+- **Resource use within granted limits is not an availability finding.** A
user who fills their own quota, creates as many keys or buckets as they are
allowed to, or runs listings within the server's page limits is using the
service as authorized, provided the service keeps serving others (§8 item 7).
Quotas are off by default and are the operator's control (§10). *(maintainer,
smengcl, 2026-10.)*
+- **No availability guarantee against admins or service peers.** Admin
commands and a compromised service peer can stop a service (§7). *(maintainer,
smengcl, 2026-10.)*
- **Block tokens are bearer capabilities** — a leaked block token grants access
until expiry; the caller/operator must protect tokens in transit (TLS). The
default block/container-token lifetime is `1d` when those tokens are enabled.
@@ -330,6 +339,7 @@ Per-boundary input trust (grouped by family):
- **Enable HTTP authentication (SPNEGO)** for the OM and SCM web servers, or
network-isolate their HTTP ports. The DB checkpoint endpoints serve the
metadata DB.
- **Isolate the KMS** in a separate, firewalled network segment. *(maintainer —
jojochuang, 2026-06-25.)*
+- **Bound client load:** set namespace and space quotas, enable the RPC
`FairCallQueue` on the OM (for S3 traffic it needs the Ozone identity provider,
and it applies only when S3 Gateway reaches the OM over Hadoop RPC, the default
`ozone.om.transport.class`, not over gRPC), and put rate limiting in front of
an internet-facing S3 Gateway. Ozone does not promise to withstand load by
volume (§9).
- **Client side:** treat data read from Ozone per your own trust needs; protect
delegation tokens your app caches.
@@ -364,6 +374,9 @@ list. *(requested by jojochuang, 2026-06-25.)*
configured ACL or removing method-level checks from protocols shared by
callers with different privileges. User-facing entry points must enforce
the applicable authorization checks (§8). *(inferred, Q-svcacl.)*
+- **Denial of service by request volume** (floods, many connections, many
concurrent requests whose cost the server already limits): `BY-DESIGN:
property-disclaimed` (§9). A small, fixed number of requests that stops a
service is different and is `VALID` under §8 item 7.
+- **A user exhausts resources the operator granted them** (fills their quota,
creates all the keys or buckets they are allowed, runs listings within the
server's page limits): `BY-DESIGN: property-disclaimed` (§9/§10).
+- **An admin (a principal in a configured administrator list) can stop or
degrade a service**: `OUT-OF-MODEL: adversary-not-in-scope` (§7/§9). A caller
admitted to an internal protocol only by its service ACL is covered by the
service ACL entry above.
- **Findings in `ozone-thirdparty`, `integration-test-*`, `*TestImpl`** —
`OUT-OF-MODEL: unsupported-component` (§3).
- **KDC/KMS/Ranger/SCM-CA-key compromise scenarios** — out of layer (§3/§7).
@@ -386,10 +399,10 @@ list. *(requested by jojochuang, 2026-06-25.)*
| `VALID` | A §8 property breaks in secure mode, via an in-scope actor. | §8,
§6, §7 |
| `VALID-HARDENING` | No §8 break, but a §11 misuse is too easy to fall into.
| §11 |
| `OUT-OF-MODEL: trusted-input` | Requires control of operator config
(Ranger/object ACL, service-protocol ACLs, keys). | §6/§10 |
-| `OUT-OF-MODEL: adversary-not-in-scope` | Needs
KDC/CA-key/Byzantine-majority. | §7 |
+| `OUT-OF-MODEL: adversary-not-in-scope` | Needs
KDC/CA-key/Byzantine-majority, or an admin or service peer acting against
availability. | §7 |
| `OUT-OF-MODEL: non-default-build` | Only in non-secure mode (or a
discouraged knob). | §5a |
| `OUT-OF-MODEL: unsupported-component` | thirdparty / test / infra Ozone
doesn't own. | §3 |
-| `BY-DESIGN: property-disclaimed` | Non-secure mode, policy correctness,
dependency security. | §9 |
+| `BY-DESIGN: property-disclaimed` | Non-secure mode, policy correctness,
dependency security, load by volume, use within granted limits. | §9 |
| `KNOWN-NON-FINDING` | Matches §11a. | §11a |
| `MODEL-GAP` | Unroutable. | triggers §12 |
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
