github-actions[bot] commented on issue #14525: URL: https://github.com/apache/cloudstack/issues/14525#issuecomment-6520629487
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/41040764159) for details. > > </details> ## ๐ฏ Triage report In the DNS Framework (4.23.0.0), tenants cannot manage zones for domains they own. `addDnsServer` is root-only, the documentation says domain admins may call it, and `addDnsServer` and `createDnsZone` have no `account`, `domainid` or `projectid` parameters. A maintainer comment says root-only add, update and delete is intentional (#13821, a security fix), that ownership by account, domain or project is tracked in #13911, and that zone ownership is not covered by #13911 and will be designed with it. ### ๐ Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:enhancement | Feature and ownership-model request; docs mismatch noted | | **Component** | component:api | Parameters and permission checks on DNS framework APIs | | **Severity** | n/a | Not a bug report | | **Labels** | type:enhancement, component:api | No DNS-specific label exists in the repository | | **Coding agent** | Not suitable | Ownership and permission design; maintainers want it designed together with #13911 | ### ๐ Similar issues - #13911 (related) โ allow root admin to configure DNS servers on behalf of a user or domain, with project-scoped servers. Maintainers say this is the tracking issue for the ownership part. - #7296 (related) โ global setting to restrict domain admin changes to domain and account settings - #2865 (related) โ DNS records for additional local IP addresses <details> <summary>๐ก Notes and suggestions</summary> - The docs-versus-permission mismatch (domain admins documented as able to call `addDnsServer`, but the API is root-only) is already acknowledged by a maintainer as a docs issue to fix. - Maintainers may want to split the zone-ownership question into its own tracking item if it stays out of #13911. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/41040764159) ยท copilot ยท haiku55 ยท \~3 AIC ยท โ 3.8K ยท [โท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 41040764159, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/41040764159 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"41040764159","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/41040764159","publishing_job":{"key":"safe_outputs","check_run_id":"124016161242"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
