potiuk commented on PR #1293: URL: https://github.com/apache/knox/pull/1293#issuecomment-4956878054
Thanks for the thorough line-by-line review, Larry — exactly the input the model needed. I've folded all of your 2026-07-09 answers into `THREAT_MODEL.md` and pushed an update. Summary: **§14 answers recorded** (Wave 1–3 core + meta); the corresponding claims are promoted from *(inferred)* to *(maintainer)*. **One disposition correction (Q14):** you called an ungated `HeaderPreAuth` OUT-OF-MODEL (the operator must avoid it / implicitly accepts the risk), which corrects the v0 draft's proposed "VALID whenever ungated". It's now `OUT-OF-MODEL: non-default-build` across §5a / §9 / §10 / §11 / §11a, with your paired point — Knox should default the gate to force explicit acceptance — captured as a standing VALID-HARDENING ask. **Substantive additions from your notes:** - Backend-hop TLS documented as *required together with Kerberos for proxy-user-based trusted proxies* (protecting the forwarded SPNEGO tokens) — §5 / §5a / §10 / Q16. - §6 nuance: clients that authenticate directly to the backend (e.g. Kerberos) are a legitimate deployment choice; without explicit proxy-user config they can't assert another user via `doAs`. - §9 / §10 / Q27: the reverse-proxy responsibility split — all operator responsibility, but Knox provides `WebAppSecProvider` (XSRF/CORS/CSP) and regexp whitelists (SSRF/open-redirect), which must be tuned per deployment. - §5a wording: "identity certificate" (not "keystore"). - §5 / Q12: flagged the "does the webshell terminal spawn a process?" verification you asked for as an explicit open item. Still open (not part of your review): Q7, Q9–Q13, Q17, Q21–Q22, Q28 (known-non-findings suppression set), Q29 (cross-topology isolation) — no rush; the model is scan-ready as-is. Re Q-meta-B (model in `docs/`, versioned with releases): agreed — kept at repo root for now so the AGENTS.md → SECURITY.md → THREAT_MODEL.md chain stays wired for this PR; happy to move it to `docs/` as a follow-up after merge, or here if you'd prefer. Re-requesting your review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
