[
https://issues.apache.org/jira/browse/YUNIKORN-3457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116614#comment-18116614
]
Wilfred Spiegelenburg commented on YUNIKORN-3457:
-------------------------------------------------
Updated the security mailing list to the {{security @ yunikorn.apache.org}}
> Add SECURITY.md to document vulnerability reporting process and security
> model for yunikorn-core
> ------------------------------------------------------------------------------------------------
>
> Key: YUNIKORN-3457
> URL: https://issues.apache.org/jira/browse/YUNIKORN-3457
> Project: Apache YuniKorn
> Issue Type: Improvement
> Components: core - common
> Reporter: Mit Desai
> Assignee: Mit Desai
> Priority: Major
>
> yunikorn-core currently has no security documentation. As per ASF guidance on
> documenting a project's security model
> ([https://cwiki.apache.org/confluence/spaces/SECURITY/pages/308153000/Documenting+your+security+model]),
> projects should publish the assumptions and guarantees they make with
> respect to security, so operators can deploy safely and maintainers can
> quickly triage whether an incoming report is a real vulnerability or expected
> behavior. yunikorn-core has several documented-but-unwritten assumptions
> worth capturing explicitly — e.g. the REST/web service on :9080 ships with no
> authentication, authorization, or TLS; Access-Control-Allow-Origin: * is set
> on all responses; and the scheduler core trusts the submitter identity
> (UserGroupInformation) asserted by the Resource Manager without independent
> verification.
> We need to add a SECURITY.md at the repository root containing:
> * A private vulnerability-reporting policy pointing to
> [email protected]
> * A documented security model: scope boundaries relative to sibling repos
> (yunikorn-k8shim, yunikorn-web, yunikorn-scheduler-interface,
> yunikorn-release, yunikorn-site), deployment trust assumptions, the REST
> API's endpoint sensitivity,
> ACL/authorization semantics, user/group and LDAP resolution, logging caveats,
> and a "not secure by default" note on service-account/RBAC scoping.
> * A triage table listing recurring non-findings (e.g. unauthenticated :9080,
> exposed pprof, LDAP Insecure option) with the reasoning for why each is out
> of scope, and what would make it in scope — to reduce noise from scanners and
> AI-assisted
> reports.
> * A "Supported Versions" section pointing to the project download page
> rather than asserting an unstated support policy.
> This will be the first SECURITY.md in the Apache YuniKorn project family and
> is intended to serve as a reference for the sibling repositories to adapt.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
